Get the PDF

Configuring BlackBerry UEM Cloud for the first time
- Administrator permissions required to configure BlackBerry UEM
- Obtaining and activating licenses
Installing the BlackBerry Connectivity Node to connect to resources behind your organization's firewall
Configuring the BlackBerry Connectivity Node to use the BlackBerry Router or a TCP proxy server
- Sending data through a TCP proxy server to the BlackBerry Infrastructure
- Installing a standalone BlackBerry Router
Connecting BlackBerry UEM to Microsoft Azure
Linking company directory groups to BlackBerry UEM groups
Obtaining an APNs certificate to manage iOS and macOS devices
Configuring BlackBerry UEM for DEP
Configuring BlackBerry UEM to support Android Enterprise devices
Simplifying Windows 10 activations
- Integrating UEM with Azure Active Directory join
  - Integrate UEM with Azure Active Directory join
- Configuring Windows Autopilot in Microsoft Azure
  - Create a Windows Autopilot deployment profile in Azure
  - Import Windows Autopilot devices to Azure
Configuring BlackBerry UEM Cloud to support BlackBerry Dynamics apps
Configuring an on-premises BEMS in a BlackBerry UEM Cloud environment
Migrating users, devices, groups, and other data from a source server

Configure email notifications for
BlackBerry Work

BEMS

Cloud accepts push registration requests from devices, such as

iOS

and

Android

, and then communicates with the on-premises

Microsoft Exchange Server

Microsoft Office 365

server to check the user's mailbox for changes. When you specify the on-premises

Microsoft Exchange Server

Microsoft Office 365

server information, you specify the settings to create the

BEMS

Cloud tenant for your organization.

When the tenant is created, the following services are automatically enabled:

BlackBerry Directory Lookup

: This service allows users to look up other users by first name, last name, and associated photo or avatar from the company directory.

BlackBerry

Follow-Me: This feature supports the

BlackBerry Dynamics Launcher

BlackBerry Work

Verify that the service account has application impersonation permissions applied.

In a

Microsoft Office 365

environment, if you plan to enable modern authentication, verify that you completed the following:

If you enable modern authentication using credential authentication, obtain the client application ID.

If you enable modern authentication using client-certificate authentication, do one of the following:

Obtain the client application ID with certificate-based authentication

Create and associate a self-signed .pfx certificate to the

Azure

app ID for

BEMS

In an on-premises

Microsoft Exchange

environment, make sure that the

Microsoft Exchange Server

is updated to support TLS 1.2 or push notifications will fail. Weaker cipher suites such as TLSv1 or TLS 1.0 are disabled by default. Disabling the cipher suites provides enhanced security.

In the management console, click

Settings > BlackBerry Dynamics > Email notifications

In the

Authentication type

section, select an authentication type based on your environment and complete the associated tasks to allow

BEMS

to communicate with the

Microsoft Exchange Server

Microsoft Office 365

Authentication type	Description	Task
Credential	This option uses the BEMS username and password to authenticate to the Microsoft Exchange Server or Microsoft Office 365 .	In the Service account username field, enter the username of the BEMS service account. For Microsoft Office 365 , enter the service account's User Principal Name (UPN). For on-premises Microsoft Exchange Server , use the format <`domain`>\<`username`>. In the Service account password field, enter the password for the service account.
Client Certificate	This option uses a client certificate to allow the BEMS service account to authenticate to the Microsoft Exchange Server or Microsoft Office 365 .	Beside the Certificate file (.pfx) field, click Browse . Navigate to and select the client certificate file. In the Password field, enter the password for the client certificate.

If you connect to a

Microsoft Office 365

environment, do the following to enable modern authentication:

Select the

Enable Modern Authentication

check box.

In the

Authentication authority

field, enter the Authentication Server URL that

BEMS

accesses to retrieve the OAuth token for authentication with

Microsoft Office 365

(for example, https://login.microsoftonline.com/<tenantname>).

In the

Client application ID

field, enter one of the following

Azure

app IDs depending on the authentication type you selected. Do one of the following to obtain an

Azure

app ID:

Obtain an Azure app ID for BEMS with credential authentication

Obtain an Azure app ID for BEMS with certificate-based authentication

In the

Server name

field, enter the FQDN of the

Microsoft Office 365

server.

Optionally, select the

Use credentials if modern authentication fails

check box to allow

BEMS

to communicate with

Microsoft Office 365

in the event that

BEMS

can't access the modern authentication source. When you select this check box, you must provide the

BEMS

service account credentials.

When you configure modern authentication, all nodes use the specified configuration.

In the

Service account username

field, enter the username that is used to log in to the

Microsoft Exchange Server

Microsoft Office 365

server. The username must be in one of the following formats:

If your environment uses an on-premises

Microsoft Exchange Server

, use <Domain>\<Username> or UPN.

If your environment uses

Microsoft Office 365

, use <username>@<domain>.com.

In the

Service account password

field, enter the password for the service account username you provided.

Optionally, in the

Autodiscover URL override

field, enter the Autodiscover URL to allow

BEMS

to obtain user information from the

Microsoft Exchange Server

Microsoft Office 365

server when it discovers users for

BlackBerry Push Notifications

If you don't enter a URL,

BEMS

uses Autodiscover to locate the

Microsoft Exchange Server

Microsoft Office 365

server to obtain user information.

Select the

Allow HTTP redirection and DNS SRV record

check box to allow HTTP Redirection and DNS SRV lookups for retrieving the Autodiscover URL when discovering users for

BlackBerry Push Notifications

. By default, this feature is enabled.

Select the

Use BlackBerry Connectivity Node route

to allow

BEMS

Cloud to connect to the

BlackBerry Infrastructure

instead of using an inbound port. This setting requires that the

BlackBerry Connectivity Node

is installed and configured in your environment.

If your environment uses an internal URL to access and communicate with an on-premises

Microsoft Exchange Server

, select the

Use internal Exchange Web Services URL

check box. This setting requires that the

Use BlackBerry Connectivity Node route

is enabled. This option is not available if modern authentication is enabled.

Optionally, in the

User email address

field, enter an email address to test the connection to the

Microsoft Exchange Server

Microsoft Office 365

server. Click

Test connection

. If the test fails, resolve the issues that are identified and try the test again. You can delete the email address after you complete the test.

Click

Save

Test the connection to the on-premises

Microsoft Exchange Server

Microsoft Office 365

server and Autodiscover. Refresh or reopen the Email notifications screen. Click

Test connection

Make sure that the connection test is successful before provisioning devices to avoid any Autodiscover issues. If devices are activated prior to configuring the email notification service, have users log out of

BlackBerry Work

and then log in. If the test returns an error message, complete the tasks to resolve the issue and test the connection again.

Assign the BlackBerry Cloud Enterprise Services (com.blackberry.gdservice-entitlement.cloud) entitlement to users to receive email notifications for

BlackBerry Work

. For instructions, see the following administration content:

Assign an app to a user group

Assign an app group to a user group

Assign an app to a user account

Assign an app group to a user account

Optionally, create a trusted connection between the

BEMS

Cloud and