Prerequisites: Deploying

BlackBerry Work

with

BlackBerry Access

Verify that the “Disable

BlackBerry Work

” app configuration setting is not selected (see BlackBerry Access app configuration settings).

BlackBerry Work

uses

Microsoft Exchange Web Services

instead of

Microsoft Exchange ActiveSync

.

BlackBerry Work

doesn’t use a configuration file for the

Microsoft Exchange Web Services

Autodiscover service. Verify that the

Microsoft Exchange Web Services

Autodiscover service is enabled. For more information about using EWSEditor to check if the Autodiscover service is enabled, visit the BlackBerry Knowledge Base to read Test Application Impersonation (EWS) & Autodiscover.

Verify that the

BlackBerry Enterprise Mobility Server

is configured for the

Microsoft Exchange Web Services

Autodiscover service. For instructions, see the BlackBerry Enterprise Mobility Server Installation and Configuration content.

If

Microsoft Exchange Web Services

is using a self-signed server certificate, ensure that the “Alert user for invalid or expired certificate” app configuration setting is not selected.

In the

Microsoft Internet Information Services

(IIS), enable

Kerberos

authentication (under

Windows

authentication) for the

Microsoft Exchange Web Services

web server.

In

Microsoft Active Directory Users and Computers

, in the

Microsoft

Management Console (MMC), on the Delegation tab, add the

Microsoft Exchange Web Services

HTTP service for the

UEM

or

Good

administrator account.

If

Kerberos

Constrained Delegation is enabled, users can’t enter their authentication credentials (username and password). Authentication is delegated to the

UEM

or

Good

administrator account.

For more information about setting up

Kerberos

Constrained Delegation, visit BlackBerry Help and Manuals: Good Control and Good Proxy to read the

Good Control Help

and the

Kerberos Constrained Delegation Guide

.