Prerequisites for configuring KCD for
BlackBerry Dynamics
apps

Item	Description
Active Directory port	Port 88 on the Active Directory service must be accessible by all UEM servers.
Kerberos environment	The Kerberos environment must include the following components: Microsoft Active Directory server: The directory service that authenticates and authorizes all users and computers associated with your Windows network. Kerberos Key Distribution Center (KDC): The authentication service on the Active Directory server that supplies session tickets and keys to users and computers in the Active Directory domain.
Service Principal Names (SPN)	Create SPNs for all HTTP services, including the BlackBerry Enterprise Mobility Server . You must set an SPN for every target resource you want devices to have access to. For more information about how to create and modify SPNs, see Register a Service Principal Name for Kerberos Connections.
Multi-realm Kerberos environments	A minimum of one UEM Core must be installed in each Kerberos realm. UEM must reside in the same Kerberos realm as the resource because cross-realm resource delegation is not supported. Ensure that single-realm KCD is working before configuring multi-realm KCD. All trusts must be bidirectional, transitive forest trust. Ensure a maximum of 5 ms latency between the UEM Core instances and the Microsoft SQL Server database.