Enable the mailbox migration flow
- Ensure that your BlackBerry Dynamics connectivity profile is configured to route traffic for your email and authentication servers. Depending on your organization's routing requirements, this might mean one of the following:
- The authentication and email traffic must route through your internal network: If your organization requires traffic to be routed internally (for example, your authentication server is not accessible publicly, or security requirements or conditional access policies require internal routing), you should ensure that the following hosts are added to the "Additional Servers" section of the connectivity profile (ensure that the route entries are configured for BlackBerry Proxy):
- Internal Microsoft Exchange Server
- Microsoft 365 server (outlook.office365.com)
- Microsoft's Content Distribution servers (such as aad.cdn.mstauth.net)
- Authentication server (such as your Active Directory Federation Services (ADFS) server, PingFederate server, or Okta server)
- The authentication and email traffic does not have to route through your internal network: If your organization does not require routing these connections internally, to improve performance have these connections routed Direct instead. If your Default Route is set to Direct, then you do not need to specify any servers. If the "Default Route" is set to "BlackBerry Proxy" or "Block", then you must add the servers specified above to the "Additional Servers" list, but specify the route type as "Direct" instead.
For more information, about the BlackBerry Dynamics connectivity profile settings, see the BlackBerry UEM Managing apps content.
- The authentication and email traffic must route through your internal network: If your organization requires traffic to be routed internally (for example, your authentication server is not accessible publicly, or security requirements or conditional access policies require internal routing), you should ensure that the following hosts are added to the "Additional Servers" section of the connectivity profile (ensure that the route entries are configured for BlackBerry Proxy):
- Ensure that your organization’s app configuration is set up for Modern Authentication, Microsoft Exchange Online endpoints (Exchange ActiveSync, Exchange Web Services) and Autodiscover. For more information, see BlackBerry Work app configuration settings, and the Modern Authentication Guide.
- This feature requires a supported version of the BlackBerry Work app. Older versions of the app will immediately have the Microsoft 365 settings applied to them. To view a list of installed BlackBerry Work client version, see Export BlackBerry Dynamics app reports to a CSV file in the BlackBerry UEM Monitoring and reporting content.
- On the menu bar, click Apps.
- Click the BlackBerry Work app.
- Click the name of your organization’s app configuration.
- On the Advanced Configuration tab, select the Migration Flow Enabled option.
- To set an expiry time, enter a date in the Migration Flow Expiration Date field. After the date that you enter has passed, the Migration Flow Enabled setting is ignored.
- Click Save.
- Assign the new app configuration to users who will be migrated to Microsoft Exchange Online. If you are migrating users in batches, assign the new configuration prior to migrating users.
Note: To ensure that your environment is configured correctly, BlackBerry recommends performing a test migration with only a few users before you perform a larger migration of users.
If a new BlackBerry Work user is activated against an app configuration that has the "Migration Flow Enabled" option set, the device will immediately pick up the modern authentication and Microsoft Exchange endpoint configurations.
BlackBerry recommends that you either create a new app configuration to apply to users who will be or already are migrated to Microsoft 365, and have a separate app configuration for users who will continue to use an on-premises Microsoft Exchange Server.