Data flow: Activating 

BBM Enterprise

 on a device

Create a 

BBM Enterprise

 profile.

Review the 

BBM Enterprise

 activation email template and modify it if necessary.

Add a user to 

BlackBerry UEM

 as a local user account or using the account information retrieved from your company directory.

Assign the 

BBM Enterprise

 profile to a user.

BlackBerry UEM
 pushes the assigned 
BBM Enterprise
 profile through the 
BlackBerry Infrastructure
 to 
BBM Enterprise
.

Use one of the following options to provide the user with activation details:

Automatically generate a device activation password and send an email with activation instructions for the user.
Set a device activation password and communicate the username and password to the user directly or by email.
Don't set a device activation password and communicate the 
BlackBerry UEM Self-Service
 address to the user so that they can set their own activation password.

If provided, the user can click a link in the activation email to be taken directly to 

BBM Enterprise

.

Establishes a connection to the 

BlackBerry Infrastructure

Sends a request for activation information to the 

BlackBerry Infrastructure

Verifies that the user is a valid, registered user.

Retrieves the 

BlackBerry UEM

 address for the user.

Sends the address to the 

BlackBerry UEM Client

.

Establishes a connection with 

BlackBerry UEM

.

Generates a shared symmetric key that is used to protect the CSR (certificate signing request) and responds to 

BlackBerry UEM

 using the activation password and EC-SPEKE.

Creates an encrypted CSR and HMAC as follows:

Generates a key pair for the certificate.
Creates a PKCS#10 CSR that includes the public key of the key pair.
Encrypts the CSR using the shared symmetric key and AES-256 in CBC mode with PKCS#5 padding.
Computes an HMAC of the encrypted CSR using SHA-256 and appends it to the CSR.
Sends the encrypted CSR and HMAC to BlackBerry UEM.

Verifies the HMAC of the encrypted CSR and decrypts the CSR using the shared symmetric key.

Retrieves the username, work space ID, and your organization’s name from the 

BlackBerry UEM

 database.

Packages a client certificate using the information it retrieved and the CSR that the device sent.

Signs the client certificate using the enterprise management root certificate.

Encrypts the client certificate, enterprise management root certificate, and the 

BlackBerry UEM

 URL using the shared symmetric key and AES-256 in CBC mode with PKCS#5 padding.

Computes an HMAC of the encrypted client certificate, enterprise management root certificate, and the 

BlackBerry UEM

 URL and appends it to the encrypted data.

Sends the encrypted data and HMAC to the device.

Verifies the HMAC.

Decrypts the data it received from 

BlackBerry UEM

.

Stores the client certificate and the enterprise management root certificate encrypted in 

BBM Enterprise

.

Sends the device information (if it is available) and  software information to 

BlackBerry UEM

.

The 

BlackBerry UEM

 Core assigns the 

BBM Enterprise

 device to a 

BlackBerry UEM

 instance in the domain.

Retrieves a SCEP profile from 

BlackBerry UEM

. This profile is used to trigger an assisted SCEP procedure in order to obtain a device-specific certificate, which will be used to access 

BlackBerry UEM

 and servers that are providing 

BBM Enterprise

 services.

The  snap-in returns a SCEP profile (default or configured).

The  client performs an assisted SCEP operation against the 

BlackBerry Enterprise Identity

 service mediated by 

BlackBerry UEM

.

The resulting certificate, specific to a  device, is sent back to the  client.