BlackBerry Work

app configuration settings

In the "Automatically download the body of S/MIME emails" drop-down list, select how the body of S/MIME email messages is downloaded.

Wi-Fi

is supported on

Android

devices only. If you select this option,

iOS

devices are set to "Never."

Select the "Perform name checking (verify email address in certificate matches user's account)" option to perform name checking. Name checking verifies that the email address in the certificate matches user's account.

Select the "Enable certificate check before opening old S/MIME email" option if you want BlackBerry Work to check if the certificate used to encrypt an email message is still available for the user.

Select "Block access to signed messages when no certificate is available" if you want BlackBerry Work to block access if no certificate is available.

Specify when to clear the public certificate cache. By default, this setting is Weekly. 

Select the "Enable revocation checking" option to enable revocation checks and specify the depth of certificate checking. Available settings:

Check entire certificate chain
Check user / client certificate only

Select the "Use AIA extension in certificate if present" option to use the AIA extension in certificates if present.

In the "Default OCSP URL" field, specify the default OCSP URL to use if the AIA extension cannot be used or it is not present in a certificate.

Specify whether caching is enabled. When caching is enabled, the cache is used to offer autocomplete suggestions for recipients during email composition.

Select the "Tap SMS icon to initiate SMS using native SMS apps" option to specify whether to allow users to initiate their native SMS apps by tapping the SMS icon or select the "Tap SMS icon to initiate SMS using entitled and installed GD SMS apps" option to specify that users must use

BlackBerry Dynamics

SMS apps.

Specify whether to allow access to the user's native browser or native maps app.

Select the "Enable integration with 3rd party RSA SecurID app using CTF token seed" to enable two-factor authentication integration with a third-party

RSA SecurID

app using a CTF token seed.

Select the "Enable launching to 3rd party native apps (iOS only policy)" option to enable launching third-party native apps. When you enable native apps, enter the App URL scheme in the field.

Universal links allow

iOS

users to be automatically redirected to an installed app without going through

Safari

when they click links in a website. If the app isn’t installed on the device, the link opens the website in

Safari

.

You can specify a list of universal links that users can open from

BlackBerry Work for iOS

. If you add a universal link to this list, the link will redirect to the appropriate app if it is installed on a user's device. If a user clicks on a universal link that is not added to this list, the link will not be redirected to an app and will open in

Safari

, even if the app is installed on a user's device.

To add multiple URLs, insert a carriage return between each URL that you want to add.

Select the "Enable exporting to 3rd-party native apps" option to specify whether to allow the transfer of files to third-party native apps on the user's device. You can allow and disallow specific apps by app ID and app share extensions. If your environment includes

iOS

devices that run

iOS

14 or later, add both the app ID and app share extension for a specific app to make sure that

BlackBerry Work for iOS

contains the necessary information to compare the app against the blacklists or whitelists configured in

BlackBerry UEM

. If the necessary information is not included, users running

iOS

14 and later might be unable to transfer a file and receive an error message. For more information, visit support.blackberry.com/community to read article 69436. 

Select the "Enable Importing from 3rd-party native apps (iOS 12 and below and Android)" option or the "Enable Importing from 3rd-party native apps (iOS 13 and above only)" option to allow the import of files from third-party native apps on the user's device. You can allow and disallow specific apps by app ID and app share extensions. Note that exceptions to importing apply only to

iOS

.

The combined size of the imported files cannot exceed 120 MB.

Specify whether to allow incoming attachments and specify a maximum size and the file extensions that are allowed or disallowed.

Specify whether to enable event classifications markings such as INTERNAL, CONFIDENTIAL, NO FORWARD, and/or NO REPLY.

After you have enabled event classifications, you can select the "Require all events to have Event Classification" option to force all events to include a classification setting.

Note that the classifications for calendar events are applicable only when email classifications are enabled.

If you select the "Disable display of time zone information in meeting and contact card" option,

BlackBerry Work

will not retrieve the time zone information from Microsoft Exchange that is displayed in the calendar and contacts for users.

Select one or more of the conference platform options to enable users to click a Join button in a meeting request to quickly join a meeting on their device using the associated platform, such as Zoom.

In the Sync Email Body Size (Kb) field, specify the size, in KB, of the partial message body downloaded from the server if the user selects the option to download partial message content.

Select the "Use BEMS to perform AutoDiscover of the EAS/EWS endpoint for the user" option to specify that the client will use the

BlackBerry

Server Autodiscover service to determine the EAS/EWS endpoint for the user.

Select the "Create and consume rights-managed email messages option" to specify that Information Rights Managements (IRM) must be enabled for user mailboxes on

Microsoft Exchange

.

In the Send Feedback Email Address field, specify the email address where client feedback email messages are sent. Add multiple comma delimited recipients as needed.

In the Report Phishing Email Address field, specify whether users can report emails as phishing. The reported emails are forwarded to the email address provided in this field then moved to Trash folder.

When the "Skip Email Short Form Setup" option is selected, users must input their

Microsoft Active Directory

usernames, passwords, and domains during device activation.

Specify the authentication methods to use. If only certain authentication methods are supported from

Microsoft Exchange

, set those values to minimize the user setup time. (For example, if Auto Discover and

ActiveSync

IIS Auth Settings are set to allow only NTLM and Basic, then de-select Negotiate in above app setting.) If none are selected, the default

Microsoft Exchange

setting is used. If using client-based authentication, check none of the options.

Specify the authentication methods to use. If only certain authentication methods are supported from

Microsoft Exchange

, set those values to minimize the user setup time. (For example, if EWS IIS Auth Setting is set to allow only NTLM, then select only NTLM above for an optimal setup experience.) If none are selected above, the default

Microsoft Exchange

setting is used. If using client-based authentication, check none of the options.

Specify the

Microsoft Exchange Web Services

URL endpoint (for example, https://mydomain.com/EWS/Exchange.asmx). If you select the "Disable Exchange Web Services" option, all

Microsoft Exchange Web Services

activities, including calendar forward and calendar attachment, are disabled.

In the Default Domain field, specify the

Windows NT

Domain to try automatically when logging in. If your server uses newer UPN (email@host.com) style login instead of the older (domain\user) style login, this field should be left blank.

In the ActiveSync Server field, specify the default

Microsoft Exchange

Server to connect to (for example, cas.mydomain.com).

In the Autodiscover URL field, specify the auto discover URL if known. This speeds up the auto discover setup process (for example, https://autodiscover.<

mydomain

>.com/autodiscover/autodiscover.xml).

In the Autodiscover Connection Timeout in Seconds (iOS only) field, specify the timeout setting for

iOS

devices.

Select the "Enforce App Configuration" option to ensure that modern authentication, EAS/EWS endpoints, and

Microsoft Office 365

settings configured in the

BlackBerry Dynamics

connectivity profile are applied. This option is useful when you are troubleshooting issues after you have migrated a

BlackBerry Work

mailbox from an on-premises

Microsoft Exchange

Server to

Microsoft Office 365

.

Specify additional configuration parameters in this text area. Contact

BlackBerry

Support for more details.

In the "UPN type" drop-down list, select "Explicit UPN" to override the default UPN setting in the Dynamics Global properties.

Specify the user credential profile that contains the TLS certificate to be used to connect to

Microsoft Exchange

. The name of the profile that you specify here must match the name of the user credential profile that was created in the

BlackBerry UEM

management console.

For more information on user credential profiles, see Using user credential profiles to send certificates to devices.

In the "Maximum Email Sync Window Allowed" drop-down list, specify the number of days in the past to synchronize email messages to devices. If the setting on a device allows for more days than the server setting, the server setting is used and email messages that are older than the server setting are removed from the device. If the setting on the device allows fewer days than the server setting, the setting on the device remains the same. The user can change the setting on the device to fewer days than the server setting.

Select the "Report HTTP responses taking long time" option to specify whether to report HTTP responses that are taking longer than the specified time. Enter the application server addresses to monitor.

Select the "Report HTTP status codes received" option to specify whether to report a specified HTTP status code. Enter the application server addresses to monitor

Specify the amount of time to wait before sending another report.

If you are currently using

Skype for Business

2015 or later in your environment, you can allow users to add meetings and join meetings directly from their calendars.

Select the "Allow to create Skype For Business meetings in calendar" option to allow users to add

Skype for Business

meetings to their calendars.

Select the "Allow launching into Skype for Business app on mobile" option to allow users to make voice and video calls and to be able to join

Skype for Business

meetings directly from a calendar invitation. The meeting is automatically opened in the

Skype for Business

client and users must have the

Skype for Business

client installed on their devices.

In the

Domain of Skype for Business meeting link

field, enter the fully qualified domain name or the domain-only portion of the

Skype for Business

meeting server to allow internal users to use the Join meeting button in the event details. For example, meet.example.com or example.com. By entering this domain name,

BlackBerry Work

can locate which meeting link to capture from the meeting invitation if it is different from the user's email address domain.

Select the "Disable email decryption with legacy certificates" option to disable using legacy certificates when decrypting email messages. This option cannot be selected if the “Enable certificate check before opening old SMIME email” option is also selected.

Type the FQDN of the computers that host the

BEMS-Presence

service. If you have multiple servers, separate the names using commas, not spaces (for example, domain01.example.com:8443,domain02.example.com:8443).

Type the FQDN of the computers that host the

BEMS-Docs

service. If you have multiple servers, separate the names using commas, not spaces (for example, domain01.example.com:8443,domain02.example.com:8443).

Disabling this policy will result in using legacy

Microsoft Entra ID

Active Directory Authentication Library when logging into Work mailbox account. (iOS Only)

Select the "Use legacy Proxy

Office 365

Modern Authentication requests" option to use legacy proxy requests through the

BlackBerry Dynamics

Proxy server. (Android only)

Select the "Disable SSL Certificate Checking" option to disable SSL Certificate verification for

Exchange ActiveSync

/

Microsoft Exchange Web Services

in test environments.

Select the "Enable BlackBerry Work app on

Apple Watch

" option to communicate between the device and the

Apple Watch