Skip Navigation
  1. BlackBerry Docs
  2. BlackBerry UEM 12.19
  3. UEM Configuration Guide
  4. Connecting BlackBerry UEM to Microsoft Entra ID
  5. Configuring BlackBerry UEM as an Intune compliance partner in Entra
  6. Configure Entra ID conditional access

Configure
Entra ID
 conditional access

  • Verify that you have a
    Microsoft
     account with an
    Intune
     license and with one of the following permissions in the
    Entra
     portal: global administrator, limited administrator with the Intune Service administrator role, or a custom role with the permissions described in KB 50341.
  • In the
    Microsoft
     Endpoint Manager admin center, in the section for Partner Compliance Management, add
    BlackBerry UEM Azure Conditional Access
     as a compliance partner for
    iOS
     and
    Android
     devices and assign it to users and groups.
  • To use this feature, device users must meet the following requirements:
    • Users must exist in
      Entra ID
       and must have a valid
      Intune
       license. For more information, see Microsoft Intune licenses.
    • If you synchronize your on-premises
      Active Directory
       with
      Entra ID
      , users’ on-premises
      Active Directory
       UPN must match their
      Entra ID
       UPN.
    • Users must be added to
      UEM
       as directory users.
    • Users must have both the
      Microsoft Authenticator
       app and the
      UEM Client
       installed on their devices.
  1. In the
    UEM
     management console, on the menu bar, click
    Settings > External integration > Azure Active Directory Conditional Access
    .
  2. Click The Add icon..
  3. Type a name for the configuration.
  4. In the
    Azure cloud
     drop-down list, click
    GLOBAL
    .
  5. In the
    Azure tenant ID
     field, type your organization’s tenant name in FQDN format or unique tenant ID in GUID format.
  6. Under
    Device mapping override
    , click
    UPN
     or
    Email
    .
    If you choose UPN, verify that the
    Entra ID
     tenant and all mapped directories share the same UPN value for users before you save the connection. After you save the connection, you cannot change the device mapping override.
  7. In the
    Available company directories
     list, select and add the appropriate company directories.
  8. Click
    Save
    .
  9. Select the administrator account that you want to use to log in to your organization's
    Entra
     tenant.
  10. Accept the
    Microsoft
     permission request.
  11. On the menu bar, click
    Policies and Profiles > Policy > BlackBerry Dynamics
    . Perform the following steps for any BlackBerry Dynamics profile that you plan to assign to device users (for example, the default profile and any custom profiles).
    1. Open and edit the profile.
    2. Select
      Enable UEM Client to enroll in BlackBerry Dynamics
      .
    3. Click
      Save
      .
    4. Assign the profile to users and groups as necessary.
  12. On the menu bar, click
    Policies and Profiles > Networks and Connections > BlackBerry Dynamics connectivity
    . Perform the following steps for any BlackBerry Dynamics connectivity profile that you plan to assign to device users (for example, the default profile and any custom profiles).
    1. Open and edit the profile.
    2. In the
      App servers
       section, click
      Add
      .
    3. Search for and click
      Feature - Azure Conditional Access
      .
    4. Click
      Save
      .
    5. In the
      Azure Conditional Access
       table, click The Add icon..
    6. In the
      Server
       field, type
      gdas-
      <UEM_SRP_ID>
      .
      <region_code>
      .bbsecure.com
      .
    7. In the
      Port
       field, type 443.
    8. Under
      Route type
      , click
      Direct
      .
    9. Click
      Save
      .
    10. Assign the profile to users and groups as necessary.
  13. Assign the
    Feature – Azure Conditional Access
     app to users or groups. For more information, see Manage user accounts and Manage a user group.
  • When a user activates their device, they are prompted to register with
    Active Directory
     conditional access. Users with activated devices are prompted to register with
    Active Directory
     conditional access the next time they open the
    UEM Client
    .
  • When you remove a device from
    UEM
    , the device remains registered for
    Entra ID
     conditional access. Users can remove their
    Entra ID
     account from the account settings in the
    Microsoft Authenticator
     app, or you can remove the device from the
    Entra
     portal.