Prerequisites: Deploying 

BlackBerry Work

 with 

BlackBerry Access

Verify that the “Disable 

BlackBerry Work

” app configuration setting is not selected (see BlackBerry Access app configuration settings).

BlackBerry Work

 uses 

Microsoft Exchange Web Services

 instead of 

Microsoft Exchange ActiveSync

. 

BlackBerry Work

 doesn’t use a configuration file for the 

Microsoft Exchange Web Services

 Autodiscover service. Verify that the 

Microsoft Exchange Web Services

 Autodiscover service is enabled. For more information about using EWSEditor to check if the Autodiscover service is enabled, visit the BlackBerry Knowledge Base to read Test Application Impersonation (EWS) & Autodiscover.

Verify that the 

BlackBerry Enterprise Mobility Server

 is configured for the 

Microsoft Exchange Web Services

 Autodiscover service. For instructions, see the BlackBerry Enterprise Mobility Server Installation and Configuration content.

If 

Microsoft Exchange Web Services

 is using a self-signed server certificate, ensure that the “Alert user for invalid or expired certificate” app configuration setting is not selected.

In the 

Microsoft Internet Information Services

 (IIS), enable 

Kerberos

 authentication (under 

Windows

 authentication) for the 

Microsoft Exchange Web Services

 web server.

In 

Microsoft Active Directory Users and Computers

, in the 

Microsoft

 Management Console (MMC), on the Delegation tab, add the 

Microsoft Exchange Web Services

 HTTP service for the 

UEM

 or 

Good

 administrator account.

If 

Kerberos

 Constrained Delegation is enabled, users can’t enter their authentication credentials (username and password). Authentication is delegated to the 

UEM

 or 

Good

 administrator account.

For more information about setting up 

Kerberos

 Constrained Delegation, visit BlackBerry Help and Manuals: Good Control and Good Proxy to read the 

Good Control Help

 and the 

Kerberos Constrained Delegation Guide

.