Configure Entra ID conditional access

Verify that you meet the prerequisites for Entra ID conditional access.
  1. In the UEM management console, on the menu bar, click Settings > External integration > Entra ID Conditional Access.
  2. Click The add icon.
  3. Type a name for the configuration.
  4. In the Entra cloud drop-down list, click GLOBAL.
  5. In the Entra tenant ID field, type your organization’s tenant name in FQDN format or unique tenant ID in GUID format.
  6. Under Device mapping override, click UPN or Email.
    If you choose UPN, verify that the Entra ID tenant and all mapped directories share the same UPN value for users before you save the connection. After you save the connection, you cannot change the device mapping override.
  7. In the Available company directories list, select and add the appropriate company directories.
  8. Click Save.
  9. Select the administrator account that you want to use to log in to your organization's Entra tenant.
  10. When prompted, authenticate with your Entra tenant using the appropriate Microsoft account.
  11. On the menu bar, click Policies and Profiles > Policy > BlackBerry Dynamics. Perform the following steps for any BlackBerry Dynamics profile that you plan to assign to device users (for example, the default profile and any custom profiles).
    1. Open and edit the profile.
    2. Select Enable UEM Client to enroll in BlackBerry Dynamics.
    3. If you want to delay the conditional access enrollment process until the Microsoft Authenticator app is installed on devices, select Start Entra Conditional Access enrollment after authentication broker is installed.
    4. Click Save.
    5. Assign the profile to users and groups as necessary.
  12. On the menu bar, click Policies and Profiles > Networks and Connections > BlackBerry Dynamics connectivity. Perform the following steps for any BlackBerry Dynamics connectivity profile that you plan to assign to device users (for example, the default profile and any custom profiles).
    1. Open and edit the profile.
    2. In the App servers section, click Add.
    3. Search for and click Feature - Azure Conditional Access.
    4. Click Save.
    5. In the Azure Conditional Access table, click The add icon.
    6. In the Server field, type gdas-<UEM_SRP_ID>.<region_code>.bbsecure.com.
    7. In the Port field, type 443.
    8. Under Route type, click Direct.
    9. Click Save.
    10. Assign the profile to users and groups as necessary.
  13. Create and configure a compliance profile and assign the profile to users and groups as necessary. The following table details how UEM compliance actions are reported to Intune:

    UEM compliance enforcement action

    Behavior

    Enforcement action: Monitor and log

    Nothing is reported to Intune.

    Enforcement action:
    • Untrust
    • Delete only work data
    • Delete all data

    UEM notifies Entra ID after all user prompts have expired.

    Enforcement action for BlackBerry Dynamics apps: Monitor and log

    Nothing is reported to Intune.

    Enforcement action for BlackBerry Dynamics:
    • Do not allow BlackBerry Dynamics apps to run
    • Delete BlackBerry Dynamics app data

    UEM notifies Entra ID as soon as the compliance violation is detected.

  14. Optionally, if your conditional access policies include network-based restrictions (for example, blocking access from untrusted locations or allowing access only from the work network), you can route Microsoft Authenticator traffic through BlackBerry Secure Connect Plus to ensure the traffic comes from a trusted network path. Follow the instructions in Using BlackBerry Secure Connect Plus for connections to work resources to create and assign an enterprise connectivity profile. Use the following configuration:

    Platform

    Configuration

    iOS
    1. In the enterprise connectivity profile, select Enable per-app VPN.
    2. Add the Microsoft Authenticator app to UEM so you can deploy it to users and groups.
    3. When you assign the Microsoft Authenticator app to users and groups, in the Per-app VPN drop-down list, select the enterprise connectivity profile.

    Android
    1. In the enterprise connectivity profile, if you want to use per-app routing, select Enable per-app VPN and add the app package ID of the Microsoft Authenticator app. Otherwise, select Container wide VPN.
    2. Assign the enterprise connectivity profile to the appropriate users and groups.
  15. Assign the Feature – Azure Conditional Access app to users or groups. For more information, see Manage user accounts and Manage a user group.
  16. Install both the UEM Client and the Microsoft Authenticator app on users' devices. You can assign and deploy the Microsoft Authenticator app with UEM (see Adding public apps to the app list), or you can instruct users to download it themselves.
  17. Instruct users to activates their devices.
    When a user activates their device, the UEM Client prompts the user to register with Entra conditional access (Microsoft Online Device Registration). Users with activated devices are prompted to register with Entra conditional access the next time they open the UEM Client.
    Note: Instruct users to initiate the registration with Entra using the UEM Client, not using any sign-in options within Microsoft Authenticator. The registration prompt from the UEM Client will open Microsoft Authenticator to prompt the user for credentials and to complete the registration process.
  • Depending on the email client that your organization wants to use, you must complete additional steps to ensure that the mail client can validate and communicate with Entra:
  • After a user activates a device with UEM, you can check the user's device properties in Microsoft Endpoint Manager to confirm that it was registered with Entra as expected. The name of the device will be in the following format: <username> - <platform> unknown unknown - <xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx>.
  • If you change the scope of users or groups in the Entra partner compliance configuration, in the Entra portal, navigate to the security permissions for BlackBerry UEM Conditional Access and grant administrator consent for BlackBerry again.
  • When you remove a device from UEM, the device remains registered for Entra ID conditional access. Users can remove their Entra ID account from the account settings in the Microsoft Authenticator app, or you can remove the device from the Entra portal.