Data flow: Activating an iOS device


Diagram illustrating the data flow for activating an iOS device.

  1. If you plan to use Apple Automated Device Enrollment (ADE), you perform the following actions:
    1. Verify that BlackBerry UEM is configured to synchronize with ADE.
    2. Register the device in ADE and assign it to an MDM server.
    3. Assign an enrollment configuration to the device.
  2. You perform the following actions:
    1. Add a user to UEM as a local user account or using the account information retrieved from your company directory.
    2. Assign an activation profile to the user.
    3. Use one of the following options to provide the user with activation details:
      • Automatically generate a device activation password and, optionally, a QR Code and send an email with activation instructions for the user.
      • Set a device activation password and communicate the username and password to the user directly or by email.
      • Don't set a device activation password and communicate the BlackBerry UEM Self-Service address to the user so that they can set their own activation password and view a QR Code.
  3. If the device is registered with Apple ADE, the device communicates with the ADE web service during its initial setup. If you configured the device to install the UEM Client, the device automatically downloads and installs it.
  4. If the device is not registered with Apple ADE or if you did not configure the device to install the UEM Client, the user manually downloads and installs the UEM Client on the device. After it is installed, the user opens the UEM Client and enters the email address and activation password or scans the QR Code.
  5. The UEM Client does the following:
    1. Establishes a connection to the BlackBerry Infrastructure.
    2. Sends a request for activation information to the BlackBerry Infrastructure.
  6. The BlackBerry Infrastructure performs the following actions:
    1. Verifies that the user is a valid, registered user.
    2. Retrieves the UEM address for the user.
    3. Sends the address to the UEM Client.
  7. The UEM Client establishes a connection with UEM using an HTTP CONNECT call over port 443 and sends an activation request to UEM. The activation request includes the username, password, device operating system, and unique device identifier.
  8. UEM performs following actions:
    1. Inspects the credentials for validity.
    2. Creates a device instance.
    3. Associates the device instance with the specified user account in the UEM database.
    4. Adds the enrollment session ID to an HTTP session.
    5. Sends a successful authentication message to the device.
  9. The UEM Client creates a CSR using the information received from UEM and sends a client certificate request over HTTPS.
  10. UEM performs the following actions:
    1. Validates the client certificate request against the enrollment session ID in the HTTP session.
    2. Signs the client certificate request with the root certificate.
    3. Sends the signed client certificate and root certificate back to the UEM Client.

    A mutually authenticated TLS session is established between the UEM Client and UEM.

  11. The UEM Client displays a message to inform the user that a certificate must be installed to complete the activation. The user clicks OK and is redirected to the link for the native MDM Daemon activation. The UEM Client establishes a connection to UEM.
  12. UEM provides the MDM profile to the device. This profile contains the MDM activation URL and the challenge. The MDM profile is wrapped as a PKCS#7 signed message that includes the full certificate chain of the signer, which allows the device to validate the profile. This triggers the enrollment process.
  13. The native MDM Daemon on the device sends the device profile, including the customer ID, language, and OS version, to UEM.
  14. UEM validates that the request is signed by a CA and responds to the native MDM Daemon with a successful authentication notification.
  15. The native MDM Daemon sends a request to UEM asking for the CA certificate, CA capabilities information, and a device-issued certificate.
  16. UEM sends the CA certificate, CA capabilities information, and the device-issued certificate to the native MDM Daemon.
  17. The native MDM Daemon installs the MDM profile on the device. The UEM Client notifies UEM of the successful installation of the MDM profile and certificate and polls UEM periodically until it acknowledges that the MDM activation is complete.
  18. UEM acknowledges that the MDM activation is complete.
  19. The UEM Client requests all configuration information and sends the device and software information to UEM.
  20. UEM stores the device information in the database and sends configuration information to the device.
  21. The device sends an acknowledgment to UEM that it received and applied the configuration updates. The activation process is complete.