When users install BlackBerry Access for Windows or BlackBerry Access for macOS, BlackBerry Work is also installed as an integrated web extension for BlackBerry Access.

Before you deploy BlackBerry Access for Windows or BlackBerry Access for macOS with BlackBerry Work, note the following prerequisites:

• Verify that the “Disable BlackBerry Work” app configuration setting is not selected (see BlackBerry Access app configuration settings).
• BlackBerry Work uses Microsoft Exchange Web Services instead of Microsoft Exchange ActiveSync. BlackBerry Work doesn’t use a configuration file for the Microsoft Exchange Web Services Autodiscover service. Verify that the Microsoft Exchange Web Services Autodiscover service is enabled. For more information about using EWSEditor to check if the Autodiscover service is enabled, see KB 40351.
• Verify that the BlackBerry Enterprise Mobility Server is configured for the Microsoft Exchange Web Services Autodiscover service. For instructions, see the BlackBerry Enterprise Mobility Server Installation and Configuration content.
  Note: To use BEMS for Autodiscover, the user must be assigned the BlackBerry Core and Mail Services or Good Enterprise Services entitlement. The entitlement must be configured in the BlackBerry Dynamics connectivity profile linked to the FQDN of the BEMS and port 8443. For more information, see Configure BlackBerry Work connection settings.
  Autodiscovery of the user's mailbox occurs as follows:

  1. BlackBerry Work connects to BEMS to perform autodiscovery if the proper BEMS-related entitlements are configured in the BlackBerry Dynamics connectivity profile and assigned to the user. Good Enterprise Services or BlackBerry Core and Mail Services entitlements both cover this requirement.
  2. If that fails, BlackBerry Work attempts to connect to https://<emaildomain.com>/autodiscover/autodiscover.svc
  3. If that fails, BlackBerry Work attempts to connect to https://autodiscover.<emaildomain.com>/autodiscover/autodiscover.svc.
• If Microsoft Exchange Web Services is using a self-signed server certificate, ensure that the “Alert user for invalid or expired certificate” app configuration setting is not selected.

If you want to enable Kerberos Constrained Delegation, note the following prerequisites:

• In the Microsoft Internet Information Services (IIS), enable Kerberos authentication (under Windows authentication) for the Microsoft Exchange Web Services web server.
• In Microsoft Active Directory Users and Computers, in the Microsoft Management Console (MMC), on the Delegation tab, add the Microsoft Exchange Web Services HTTP service for the UEM administrator account.
• If Kerberos Constrained Delegation is enabled, users can’t enter their authentication credentials (username and password). Authentication is delegated to the UEM administrator account.
• For more information about setting up Kerberos Constrained Delegation, see Configuring Kerberos authentication for BlackBerry Dynamics apps.