Installing or upgrading BlackBerry UEM in a dark site environment

BlackBerry UEM for dark sites provides a secure mobile device management solution without requiring UEM to connect to the BlackBerry Infrastructure and other services on the Internet. Because UEM does not connect to the Internet, some features are not supported. The following are some considerations to note when you set up UEM in a dark-site environment:

Item

Consideration

Supported components
Only the following components are enabled for UEM installed in a dark site environment:
  • UEM management console
  • BlackBerry UEM Core
  • BlackBerry Gatekeeping Service to control which devices can access Exchange ActiveSync

Supported iOS activation types

For iOS devices, dark site environments support the MDM controls activation type only.

Supported activation types for Android
  • Work and personal - user privacy (Android Enterprise with work profile)
  • Work and personal - full control (Android Enterprise fully managed device with work profile)
  • Work space only (Android Enterprise fully managed device)

Note that for all Android Enterprise activation types, the activation process requires the device user to be internally connected to the same network or to a network that has access to the dark site server without VPN.

Due to third-party limitations for Samsung Knox devices:
  • For devices with the Work and personal - user privacy (Android Enterprise with work profile) activation type, the CA certificate chain used to sign the Knox licensing server certificate must be sideloaded onto Samsung devices, or the certificate must be trusted by the device within the system pre-loaded CA certificates.
  • For DualDAR devices, devices with the Work and personal - full control (Android Enterprise fully managed device with work profile) activation type, and devices with the Work space only (Android Enterprise fully managed device) activation type, the CA certificate chain used to sign the Knox licensing server certificate must be trusted by the device within the system pre-loaded CA certificates. Sideloading alternative CA certificates is not supported.

Knox Service Plugin profiles are supported for Android devices. For more information, see the Licensing section below.

Unsupported components
Features that require devices to connect to your organization's resources through the BlackBerry Infrastructure are not supported, including:
  • BlackBerry Secure Connect Plus
  • BlackBerry Secure Gateway
  • Using UEM as a proxy for SCEP requests
  • BlackBerry Proxy

BlackBerry Dynamics

BlackBerry Dynamics is supported only if your organization has purchased the required dark site licenses. Documentation to support BlackBerry Dynamics in a dark site environment can be provided when the required licenses are purchased. If your organization does not have the required dark site licenses, BlackBerry Dynamics is not supported in a dark site environment.

Unsupported device features
  • BlackBerry Dynamics is not supported.
  • For supported activation types, not all all device features are supported. In activation profiles, do not enable the following options:
    • Enable MDM controls activation type for Android devices
    • Turn on registration with the BlackBerry Infrastructure
  • Google Play Integrity is not supported.
  • Compliance profiles are not supported for iOS devices because the BlackBerry UEM Client for iOS cannot be installed in dark site environments.
  • The default email app on Samsung Knox devices needs to connect to the Samsung infrastructure before it will send and receive data. You can choose to allow this connection or use a different email app on Samsung Knox devices.

Licensing
  • You must manually import license information into UEM.
  • If your organization uses Samsung Knox devices in a dark site environment, an on-premises Samsung Knox License On-Premises server must be installed locally with UEM.
  • Devices communicate with the Knox License On-Premises server using your work Wi-Fi network. If you are activating devices with Android Enterprise activation types and the Knox License On-Premises server certificate is signed by an internal CA, you need to send the Knox License On-Premises server certificate to devices using a CA certificate profile.
  • The local Knox License On-Premises server is required if your organization wants to use Knox Service Plugin profiles to configure Knox Platform for Enterprise devices. In dark site environments, the Knox Service Plugin app can be distributed to devices from UEM as an internal app. When you configure a Knox Service Plugin profile, you must add the KSP license to the profile; this is not required if Android Enterprise devices use premium activation (the following setting is turned on in the activation profile: "When activating Android Enterprise devices, enable premium UEM functionality such as BlackBerry Secure Connect Plus").

APNs

To manage iOS devices, UEM must send notifications to devices through an APNs server. When devices receive a notification from APNs, they contact UEM for updates.

Note: The process for obtaining an APNs certificate is different for dark site environments. After you download and save the unsigned CSR certificate from BlackBerry, you must send it to your BlackBerry customer support representative to have it signed by the BlackBerry CA. Once they return the signed certificate, you can complete the instructions to register the certificate.

VPN

After activation, iOS devices connect to UEM and your resources using a VPN connection. To use VPN, you must install an appropriate VPN app on devices and set up a VPN profile in UEM.

Samsung Knox can connect to UEM and your resources over a VPN connection. For information, see Set up VPN using Knox StrongSwan in the Configuration content.

FCM notifications for Android devices

FCM notifications are not available, but the UEM Client will periodically check for commands. You can configure the poll rate using the Enterprise Management Agent poll rate setting in the Enterprise Management Agent profile. You can reduce the poll rate to increase the rate at which apps are installed and commands are executed. Note that reducing the poll rate can have an impact on device battery use.