Create a user credential profile to use Entrust smart credentials on devices

Entrust derived smart credentials are supported by the following apps:
  • BlackBerry Dynamics apps on iOS devices.
  • BlackBerry Dynamics apps on Android devices other than Samsung Knox Workspace devices.
  • Apps on Android Enterprise devices that use certificates for signing, encryption, and identity authentication, such as BlackBerry Hub and supported web browsers.
  • Apps on Samsung Knox Workspace devices that use certificates for signing, encryption, and identity authentication, such as the Samsung native email client and supported web browsers.

BlackBerry UEM doesn't support key history for derived smart credentials.

  1. On the menu bar, click Policies and profiles > Certificates > User credential.
  2. Click The Add icon.
  3. Type a name and description for the profile.
  4. In the Certificate authority connection drop-down list, select the Entrust smart credential connection that you configured.
  5. In the Certificate type drop-down list, specify whether the smart credential will be used for identity authentication, signing, or encryption.
    If you want to send smart credentials to apps for more than one purpose, create additional user credential profiles.
  6. If the smart credential will be sent to Samsung Knox Workspace devices or apps other than BlackBerry Dynamics apps on Android Enterprise devices, on the Android tab, select the Deliver to built-in key chain check box.
    If this setting is not selected, the smart credential can be used only by BlackBerry Dynamics apps.
  7. If the smart credential will be sent to BlackBerry Dynamics apps, on the BlackBerry Dynamics tab, do the following:
    1. If you want to allow users to dismiss certificate enrollment and complete it later, select Allow optional certificate enrollment. Optional certificate enrollment is supported for iOS and Android devices for the following user credential profile types: Device (App) Based Provider, Entrust Smart Credential and Native Keystore.
    2. If you want the device to delete duplicate credentials, select Delete duplicate certificates. The device deletes the credential that has the earliest start date.
    3. If you want the device to delete expired credentials, select Delete expired certificates.
    4. To allow all BlackBerry Dynamics apps to use the smart credentials, select Allow all apps to use certificates.
    5. To specify the BlackBerry Dynamics apps to use the smart credentials, select Allow specified apps to use certificates and click The Add icon to specify the apps. You must include BlackBerry UEM Client in the list of apps.
  8. Click Add.
  • Assign the profile to user accounts and user groups.
  • After a device receives the profile, users must log in to the Entrust IdentityGuard Self-Service Module to activate their smart credential and use the UEM Client to scan the QR code presented by the Entrust IdentityGuard Self-Service Module to add the smart credential to the device.
  • To remove an Entrust smart credential from a device, the user should deactivate the smart credential in the UEM Client before you unassign the profile or remove the certificate.