Create an enterprise endpoint in Entra

To give BlackBerry UEM access to Microsoft Entra ID you must create an enterprise endpoint within Entra. The enterprise endpoint allows BlackBerry UEM to authenticate with Microsoft Entra ID. For more information, see the Microsoft resource Quickstart: Register an application in Microsoft Entra ID.

If you are connecting BlackBerry UEM to both Microsoft Intune and the Windows Store for Business, use a different enterprise application for each purpose to avoid issues with different permissions and potential future changes.

Note: When you create the application to use Microsoft Intune (step 11), you must use the Entra account with Global administrator permissions.
  1. Log in to the Entra portal.
  2. In the left column, click Applications > App registrations.
  3. Click Endpoints.
  4. Copy the OAuth 2.0 token endpoint (v1) value and paste it to a text file.
    This is the OAuth 2.0 token endpoint required in BlackBerry UEM.
  5. Close the Endpoints list and click New registration.
  6. In the Name field, enter a name for the app.
  7. Select a supported account type.
  8. In the Redirect URI section, in the drop-down list, select Web and enter a valid URL. The URL format is https://<FQDN_of_the_BlackBerry_UEM_server>:<port>/admin/intuneauth
  9. Click Register. The new registered app appears.
  10. Copy the Application ID of your app and paste it to a text file.
    This is the Client ID required in BlackBerry UEM.
  11. Optionally, to maintain a successful connection to Intune based on the client key, add the following additional application permissions:
    • Microsoft Graph
    • Application permissions
    • Set the following application permissions:
      • Read and write Microsoft Intune apps (DeviceManagementApps > DeviceManagementApps.ReadWrite.All)
      • Read all groups (Group > Group.Read.All)
      • Read all users' basic profile (User > User.ReadBasic.All)

    Grant administrator consent for all accounts in the current directory. You must be a global administrator to grant permissions.

    It is a best practice to add Application permissions instead of Delegated permissions. If you grant Delegated permissions, the connection to Intune requires an update when the Intune administrator's refresh token expires (the token expires on a regular schedule and when the administrator password changes). Application permissions uses the client key for authentication when the administrator's refresh token expires.

  12. Select Certificates and secrets in the Manage section. Perform the following actions:
    1. Under Client secrets, click New client secret.
    2. Type a description for the client secret
    3. Select a duration for the client secret.
    4. Click Add.
    5. Copy the value of the new client secret.
      This is the Client Key that is required in BlackBerry UEM.
      Note: If you do not copy the value of your key now, you will have to create a new key because the value is not displayed after you leave this screen.
Configure BlackBerry UEM to synchronize with Microsoft Intune in BlackBerry UEM.