Skip Navigation
  1. BlackBerry Docs
  2. BlackBerry UEM 12.13
  3. Administration
  4. Email, calendar, and contacts
  5. Controlling which devices can access Exchange ActiveSync
  6. Configure permissions for gatekeeping

Configure permissions for gatekeeping

To use 
Exchange ActiveSync
 gatekeeping, you must create a user account in 
Microsoft Exchange Server
 or 
Microsoft Office 365
 and give it the necessary permissions for gatekeeping.
If you are using 
Microsoft Office 365
, create a 
Microsoft Office 365
 user account and assign it the Mail Recipients and Organization Client Access roles.
If you are using 
Microsoft Exchange Server
 2010 or later, follow the instructions below to configure management roles with the correct permissions to manage mailboxes and client access for 
Exchange ActiveSync
. To perform this task, you must be a 
Microsoft Exchange
 administrator with the appropriate permissions to create and change management roles.
  • On the computer that hosts 
    Microsoft Exchange
    , create an account and mailbox to manage gatekeeping in 
    BlackBerry UEM
     (for example, BUEMAdmin). You must specify the login information for this account when you create an 
    Exchange ActiveSync
     configuration. Note the name of this account, you will specify it at the end of the task below.
  • WinRM must be configured with the default settings on the computer that hosts the 
    Microsoft Exchange Server
     that you configure for gatekeeping. You must run the command 
    Winrm quickconfig
     from a command prompt as an administrator. When the tool displays 
    Make these changes [y/n]
    , type 
    y
    . After the command is successful, you see the following message.
WinRM has been updated for remote management.

WinRM service type changed to delayed auto start.
WinRM service started.
Created a WinRM listener on HTTP://* to accept WS-Man requests to any IP on this
 machine.
  1. Open the 
    Microsoft Exchange Management Shell
    .
  2. Type 
    New-ManagementRole -Name "
    <name_new_role_mail_recipients>
    " -Parent "Mail Recipients"
    . Press ENTER.
  3. Type 
    New-ManagementRole -Name "
    <name_new_role_org_ca>
    " -Parent "Organization Client Access"
    . Press ENTER.
  4. Type 
    New-ManagementRole -Name "
    <name_new_role_exchange_servers>
    " -Parent "Exchange Servers"
    . Press ENTER.
  5. Type 
    Get-ManagementRoleEntry "
    <name_new_role_mail_recipients>
    \*" | Where {$_.Name -ne "Get-ADServerSettings"} | Remove-ManagementRoleEntry
    . Press ENTER.
  6. Type 
    Get-ManagementRoleEntry "
    <name_new_role_org_ca>
    \*" | Where {$_.Name -ne "Get-CasMailbox"} | Remove-ManagementRoleEntry
    . Press ENTER.
  7.  Type 
    Get-ManagementRoleEntry "
    <name_new_role_exchange_servers>
    \*" | Where {$_.Name -ne "Get-ExchangeServer"} | Remove-ManagementRoleEntry
    . Press ENTER.
  8. Type 
    Add-ManagementRoleEntry "
    <name_new_role_mail_recipients>
    \Get-ActiveSyncDeviceStatistics" -Parameters Mailbox
    . Press ENTER.
  9. Type 
    Add-ManagementRoleEntry "
    <name_new_role_mail_recipients>
    \Get-ActiveSyncDevice" -Parameters Identity
    . Press ENTER.
  10. Perform this step only if you are using Microsoft Exchange 2013 or later. Type 
    Add-ManagementRoleEntry “
    <name_new_role_mail_recipients>
    \Get-MobileDeviceStatistics” –Parameters Mailbox
    . Press ENTER.
  11. Perform this step only if you are using Microsoft Exchange 2013 or later. Type 
    Add-ManagementRoleEntry “
    <name_new_role_mail_recipients>
    \Get-MobileDevice” –Parameters Mailbox
    . Press ENTER.
  12. Type 
    Add-ManagementRoleEntry "
    <name_new_role_org_ca>
    \Set-CasMailbox" -Parameters Identity, ActiveSyncBlockedDeviceIDs, ActiveSyncAllowedDeviceIDs
    . Press ENTER.
  13. Type 
    New-RoleGroup "
    <name_new_group>
    " -Roles "
    <name_new_role_mail_recipients>
    ", "
    <name_new_role_org_ca>
    ", "
    <name_new_role_exchange_servers>
    "
    . Press ENTER.
  14. Type 
    Add-RoleGroupMember -Identity "
    <name_new_group>
    " -Member "BUEMAdmin"
    . Press ENTER.
  15. Type 
    Add-ManagementRoleEntry "
    <name_new_role_mail_recipients>
    \Set-AdServerSettings"
    . Press ENTER.
  16. Type 
    Add-ManagementRoleEntry "
    <name_new_role_mail_recipients>
    \Remove-ActiveSyncDevice" -Parameters Identity,Confirm
    . Press ENTER.
  17. Perform this step only if you are using Microsoft Exchange 2013 or later. Type 
    Add-ManagementRoleEntry "
    <name_new_role_mail_recipients>
    \Remove-MobileDevice" -Parameters Identity,Confirm
    . Press ENTER.