Configure BEMS to communicate with the Microsoft Exchange
Server, Microsoft Office
365, or hybrid environment
BEMSto communicate with the
Microsoft Exchange Server,
Microsoft Office 365, or hybrid environment
Microsoft Graphto communicate with
Microsoft Office 365, see Configure BEMS to communicate with a Microsoft Office 365 environment using Microsoft Graph API. You must allow
BEMSto authenticate to
Microsoft Exchange Serveror
Microsoft Office 365to access users’ mailboxes and send notifications to users’ devices when new email is received on the device. A hybrid modern authentication environment (for example, on-premises
Microsoft Exchange Serverand
Microsoft Office 365), allows the on-premises
Microsoft Exchange Serverto use a more secure user authentication and authorization by consuming OAuth access tokens obtained from the cloud. For more information on how to configure an on-premises
Microsoft Exchange Serverto use hybrid modern authentication, visit configure-exchange-server-for-hybrid-modern-authentication?view=o365-worldwide.
For information on configuring email notifications for
BEMSCloud, see the
BlackBerry UEM Cloudcontent.
Verify that you have the following information and completed the appropriate tasks.
- Verify that the service account has impersonation rights on theMicrosoft Exchange Server.
- In aMicrosoft Office 365environment, if you plan to enable Modern Authentication, verify that you completed the following:
- If you enable Modern Authentication using a Client Certificate:
- In environments where the metadata endpoint is protected by mutual TLS authentication, make sure that you imported the mutual TLS certificate in to theBEMSkeystore. For instructions, see Import the trusted mutual TLS certificates into the BEMS keystore. This feature requires that you enable modern authentication using Credential or Client Certificate.
- In a hybridMicrosoft Office 365and on-premisesMicrosoft Exchange Serverenvironment, if you enable Modern Authentication, make sure that the on-premisesMicrosoft Exchange Serveris configured to use hybrid modern authentication. For more information, visit configure-exchange-server-for-hybrid-modern-authentication?view=o365-worldwide. If theMicrosoft Exchange Serveris not configured appropriately, users won't receive email notifications.
- In aMicrosoft Office 365environment, if you use Passive Authentication, verify that you have the App ID for BEMS using credential authentication.
- In theBlackBerry Enterprise Mobility Server Dashboard, underBlackBerry Services Configuration, click
- ClickMicrosoft Exchange.
- In theSelect Authentication typesection, select an authentication type based on your environment and complete the associated tasks to allowBEMSto communicate with theMicrosoft Exchange ServerorMicrosoft Office 365:Authentication typeEnvironmentDescriptionTaskIntegratedMicrosoft Exchange Serveron-premisesThis option uses theWindowsauthentication credentialsGood Technology Common Servicesservice to authenticate to theMicrosoft Exchange Serverusing Basic Authentication.No additional actions are required.Credential
This option uses a definedBEMSusername and password to authenticate to theMicrosoft Exchange ServerorMicrosoft Office 365using Basic Authentication.
- On-premisesMicrosoft Exchange Server
- Microsoft Office 365
- In theUsernamefield, enter the username of theBEMSservice account.
- ForMicrosoft Office 365, enter the service account's User Principal Name (UPN).
- For on-premisesMicrosoft Exchange Server, use the format <domain>\<username>.
- In thePasswordfield, enter the password for the service account.
This option uses a client certificate to allow theBEMSservice account to authenticate to theMicrosoft Exchange ServerorMicrosoft Office 365.
- On-premisesMicrosoft Exchange Server
- Microsoft Office 365
- For theUpload PFX file, clickChoose Fileand select the client certificate file. For instructions on obtaining the .PFX file, see Associate a certificate with the Azure app ID for BEMS
- In theEnter PFX file Passwordfield, enter the password for the client certificate.
This option uses an identity provider (IDP) to authenticate the user and provideBEMSwith OAuth tokens to authenticate toMicrosoft Office 365. In a hybrid environment, authenticates to on-premisesMicrosoft Exchange Server*.
- Microsoft Office 365
- In a hybrid environment, on-premisesMicrosoft Exchange Server*
*TheMicrosoft Exchange Serveron-premises must be configured to use hybrid modern authentication. For more information, visit configure-exchange-server-for-hybrid-modern-authentication?view=o365-worldwide.
- In theAuthentication Authorityfield, enter the Authentication Server URL thatBEMSaccesses and retrieve the OAuth token for authentication withMicrosoft Office 365(for example, https://login.microsoftonline.com/<tenantname>). By default, the field is prepopulated with https://login.microsoftonline.com/common.
- In theClient Application IDfield, enter theAzureapp ID for the credential authentication. For instructions, see the App ID for BEMS using credential authentication.
- In theServer Namefield, enter the FQDN of theMicrosoft Office 365server. By default, the field is prepopulated with https://outlook.office365.com .
- In theRedirect URIfield, enter the URL that the IDP redirects the administrator to when the client app ID is authorized and the authentication tokens are provided. If you remotely log in to the computer that hosts theBEMSand perform the configuration from the computer's browser, enterhttps://localhost:8443/PassiveAuth), otherwise enterhttps://<FQDN of the computer that hosts the BEMS instance>:8443/PassiveAuthThe URI must be the same URI as theBEMSURI and whitelisted in theAzureportal for the application ID.
- Enter the credentials for the service account.
- ClickOKto acknowledge that the authentication tokens were obtained.
- Important:BEMSdoesn't automatically refresh the OAuth tokens. Repeat steps e to g to refresh the OAuth tokens. The tokens expiration time depends on your tenant policy (by default, the token expiration is 90 days). When the OAuth tokens expire, email notifications on the users' devices stop. The OAuth token expiration is displayed after you log in to the IDP.
- In aMicrosoft Office 365environment that uses Credential or Client certificate authentication, enable Modern Authentication and use mutual TLS authentication.
When you configure Modern Authentication, all nodes use the specified configuration.
- Select theEnable Modern Authenticationcheckbox.
- If your environment uses Client certificate authentication, in theAuthentication Authorityfield, enter the Authentication Server URL thatBEMSaccesses and retrieve the OAuth token for authentication withMicrosoft Office 365(for example, https://login.microsoftonline.com/<tenantname> or https://login.microsoftonline.com/<tenantid>). By default, the field is prepopulated with https://login.microsoftonline.com/common.
- In theClient Application IDfield, enter one of the followingAzureapp IDs depending on the authentication type you selected:
- In theServer Namefield, enter the FQDN of theMicrosoft Office 365server. By default, the field is prepopulated with https://outlook.office365.com.
- Optionally, select theUse Credentials if Modern Authentication failscheck box to allowBEMSto communicate withMicrosoft Office 365in the event thatBEMScan't access the modern authentication source. When you select this check box, you must provide theBEMSservice account credentials.
- Optionally, select theUse Mutual TLS Authenticationcheck box to allowBEMSto respond to mutual TLS authentication requests. This step requires that the mutual TLS certificate is imported intoBEMS. For instructions, see Import the trusted mutual TLS certificates into the BEMS keystore.
- Under theAutodiscover and Exchange Optionssection, complete one of the following actions:TaskStepsOverride Autodiscover URLIf you select to override the autodiscover process,BEMSuses the override URL to obtain user information from theMicrosoft Exchange ServerorMicrosoft Office 365. For more information about best practices when enabling autodiscover, see Best practice: Enabling autodiscovery.
Autodiscover andMicrosoft Exchange Serveroptions
- Select theOverride Autodiscover URLcheckbox.
- In theAutodiscover URLOverride Autodiscover field, type the autodiscover endpoint (for example, https://autodiscover<domain>.com/autodiscover/autodiscover.svc).
- Select theSwap ordering of <check box to assist in resolving the autodiscover URL. Consider selecting this option if the order results in timeouts or other failures.domain.com>/autodiscover and autodiscover. <domain.com>/autodiscover
- Optionally, modify theTCP Connect timeout for Autodiscover url (milliseconds)field as required to prevent failures when autodiscovery takes too long. By default, the timeout is set to 120000. The recommended timeout for the Autodiscover url is between 5000 milliseconds (5 seconds) and 120000 milliseconds (120 seconds).
- By default, theEnable SCP record lookupcheckbox is selected. If you clear the checkbox,BEMSdoes not perform aMicrosoft Active Directorylookup of Autodiscover URLs. This option is not available when Override Autodiscover URL is selected.
- Optionally, select theUse SSL connection when doing SCP lookupcheck box to allowBEMSto communicate with theMicrosoft Active Directoryusing SSL. If you enable this feature, you must import theMicrosoft Active Directorycertificate to each computer that hosts an instance ofBEMS. This option is not available when Override Autodiscover URL is selected.
- By default, theEnforce SSL Certificate validation when communicating with Microsoft Exchange and LDAP servercheck box is selected. If you clear this setting and use an un-trusted certificate, then the connection to the on-premisesMicrosoft Exchange Serverfails.
- By default, theAllow HTTP redirection and DNS SRV recordcheck box is selected. If you clear the checkbox, you disable HTTP Redirection and DNS SRV record lookups for retrieving the Autodiscover URL when discovering users forBlackBerry WorkPush Notifications.
- Optionally, select theForce re-autodiscover of user on all Microsoft Exchange errorscheckbox to forceBEMSto perform the autodiscover again for the user when theMicrosoft Exchange ServerorMicrosoft Office 365returns an error message.
- In theEnd User Email Addressfield, type an email address to test connectivity to theMicrosoft Exchange ServerorMicrosoft Office 365using the service account. ClickTest. You can delete the email address after you complete the test.If the service account is correctly configured and the test fails,BEMSis attempting to communicate with anMicrosoft Exchange Serverthat is not using a trusted SSL Certificate. If yourMicrosoft Exchange Serveris not set up to use a trusted SSL certificate, see "Importing CA certificates for BEMS" in the BEM-Core content.
If you selectedMail. The following certificate information is displayed:
Client Certificateauthentication, you can view the certificate information. Click
- Validation period
- Serial number