Configure permissions for gatekeeping

To use Exchange ActiveSync gatekeeping, you must create a user account in Microsoft Exchange Server or Microsoft 365 and give it the necessary permissions for gatekeeping.

If you are using Microsoft 365, create a Microsoft 365 user account and assign it the Mail Recipients and Organization Client Access roles.

If you are using Microsoft Exchange Server, follow the instructions below to configure management roles with the correct permissions to manage mailboxes and client access for Exchange ActiveSync. To perform this task, you must be a Microsoft Exchange administrator with the appropriate permissions to create and change management roles.

  • On the computer that hosts Microsoft Exchange, create an account and mailbox to manage gatekeeping in BlackBerry UEM (for example, BUEMAdmin). You must specify the login information for this account when you create an Exchange ActiveSync configuration. Note the name of this account, you will specify it at the end of the task below.
  • WinRM must be configured with the default settings on the computer that hosts the Microsoft Exchange Server that you configure for gatekeeping. You must run the command Winrm quickconfig from a command prompt as an administrator. When the tool displays Make these changes [y/n], type y. After the command is successful, you see the following message. 
    WinRM has been updated for remote management.

WinRM service type changed to delayed auto start.
WinRM service started.
Created a WinRM listener on HTTP://* to accept WS-Man requests to any IP on this
 machine.
  1. Open the Microsoft Exchange Management Shell.
  2. Type New-ManagementRole -Name "<name_new_role_mail_recipients>" -Parent "Mail Recipients". Press ENTER.
  3. Type New-ManagementRole -Name "<name_new_role_org_ca>" -Parent "Organization Client Access". Press ENTER.
  4. Type New-ManagementRole -Name "<name_new_role_exchange_servers>" -Parent "Exchange Servers". Press ENTER.
  5. Type Get-ManagementRoleEntry "<name_new_role_mail_recipients>\*" | Where {$_.Name -ne "Get-ADServerSettings"} | Remove-ManagementRoleEntry. Press ENTER.
  6. Type Get-ManagementRoleEntry "<name_new_role_org_ca>\*" | Where {$_.Name -ne "Get-CasMailbox"} | Remove-ManagementRoleEntry. Press ENTER.
  7. Type Get-ManagementRoleEntry "<name_new_role_exchange_servers>\*" | Where {$_.Name -ne "Get-ExchangeServer"} | Remove-ManagementRoleEntry. Press ENTER.
  8. Type Add-ManagementRoleEntry "<name_new_role_mail_recipients>\Get-ActiveSyncDeviceStatistics" -Parameters Mailbox. Press ENTER.
  9. Type Add-ManagementRoleEntry "<name_new_role_mail_recipients>\Get-ActiveSyncDevice" -Parameters Identity. Press ENTER.
  10. Type Add-ManagementRoleEntry “<name_new_role_mail_recipients>\Get-MobileDeviceStatistics” –Parameters Mailbox. Press ENTER.
  11. Type Add-ManagementRoleEntry “<name_new_role_mail_recipients>\Get-MobileDevice” –Parameters Mailbox. Press ENTER.
  12. Type Add-ManagementRoleEntry "<name_new_role_org_ca>\Set-CasMailbox" -Parameters Identity, ActiveSyncBlockedDeviceIDs, ActiveSyncAllowedDeviceIDs. Press ENTER.
  13. Type New-RoleGroup "<name_new_group>" -Roles "<name_new_role_mail_recipients>", "<name_new_role_org_ca>", "<name_new_role_exchange_servers>". Press ENTER.
  14. Type Add-RoleGroupMember -Identity "<name_new_group>" -Member "BUEMAdmin". Press ENTER.
  15. Type Add-ManagementRoleEntry "<name_new_role_mail_recipients>\Set-AdServerSettings". Press ENTER.
  16. Type Add-ManagementRoleEntry "<name_new_role_mail_recipients>\Remove-ActiveSyncDevice" -Parameters Identity,Confirm. Press ENTER.
  17. Type Add-ManagementRoleEntry "<name_new_role_mail_recipients>\Remove-MobileDevice" -Parameters Identity,Confirm. Press ENTER.