Data flow: Activating a BlackBerry Dynamics app for the first time on a device

This data flow describes how data travels when a BlackBerry Dynamics app is activated on a device and no other BlackBerry Dynamics app (including the BlackBerry UEM Client) has been activated yet.


Diagram showing the steps and components mentioned in the following data flow.

  1. An administrator performs the following actions:
    1. Assigns one or more BlackBerry Dynamics apps to a user.
    2. Issues activation credentials (access key, activation password, or QR code) or using a third-party identity provider, and sends them to the user or instructs the user to generate credentials from BlackBerry UEM Self-Service.
  2. The user performs the following actions:
    1. Installs the app on the device.
    2. Obtains and enters the provided activation credentials.
  3. The BlackBerry Dynamics app performs the following actions:
    1. The app registers itself with the BlackBerry Dynamics NOC and receives an ID that UEM can later use to confirm with the BlackBerry Dynamics NOC that the app was successfully activated.
    2. Obtains the UEM address using one of the following methods:
      • If the user manually entered the credentials, the app fetches the address from the BlackBerry Infrastructure.
      • If the user scanned a QR Code, the app receives the address from the QR code.
    3. Connects to UEM through the BlackBerry Infrastructure and establishes an end-to-end encrypted session with UEM using the EC-SPEKE protocol.

      This session can only be decrypted by the UEM instance that issued the activation credentials.

    4. Sends the activation request over the secured session.
  4. UEM verifies the activation request and sends encrypted activation response to the app. The activation response includes data required by the app to communicate with UEM, including a client certificate, master session key, list of BlackBerry Proxy instances, and trusted certificate authorities. UEM connects to the BlackBerry Dynamics NOC and notifies it that the BlackBerry Dynamics app (as identified by the unique ID from step 3) is successfully activated.
  5. The app prompts the user to set a password. Since the activated BlackBerry Dynamics app has been registered with the BlackBerry Dynamics NOC, it can now be used as the easy activation delegate to activate subsequent BlackBerry Dynamics apps on the device.