What's new in BlackBerry UEM Cloud
- : You can use theiOSapp integrity checkiOSapp integrity check framework to check the integrity ofiOSwork apps that have been published to the App Store. This feature usesAppleDeviceCheck and other methods to provide a way to identify that your app is running on a validAppledevice and that the app is published by the specifiedAppleTeam ID. For more information onAppleDeviceCheck, see the information from Apple. This setting applies only to devices runningiOS11 and later. Activation ofBlackBerry Dynamicsapps that were built usingBlackBerry DynamicsSDK foriOSversion 5.0 or earlier will fail if you enable the ‘Perform app integrity check onBlackBerry Dynamicsapp activation’ option in the activation profile and if you add those apps foriOSapp integrity check. If aBlackBerry Dynamicsapp that was built usingBlackBerry DynamicsSDK foriOSversion 5.0 or earlier is already activated, and you select the 'Perform periodic app integrity checks' option in the Activation profile, the app will fail the periodic attestation check and the device will be subject to the enforcement action specified in the compliance profile that is assigned to the user.Note: You cannot enable theiOSapp integrity checking on enterprise apps that your organization has developed and distributed internally using theAppleEnterprise Distribution program.
- : TheBlackBerry DynamicsConnectivity profile changeBlackBerry DynamicsConnectivity profile has been updated to allow for more detailed control over howBlackBerry Dynamicsapps built using the latestBlackBerry DynamicsSDK can connect to app servers. This allows you to configure rules to avoid double tunneling theUEMApp Store andUEMhosted application push.
- : You can now generateBlackBerry Dynamicsaccess keysBlackBerry Dynamicsaccess keys for users that do not have an email address.
- Whitelist antivirus vendors for: In the compliance profile, in the “Antivirus status” rule forWindowsdevicesWindowsdevices, you can now choose to allow antivirus software from any vendor, or allow only those that you added to the “Allowed antivirus vendors” list. The rule will be enforced if a device has antivirus software enabled from any vendor that is not whitelisted.
- User credential profiles support using: You can now use yourEntrustforBlackBerry DynamicsappsEntrustPKI connection to enroll certificates forBlackBerry Dynamicsapps using the User credential profile.
- Compliance violation reporting: When a device is out of compliance, violations and any applicable actions display on the device summary page. To see which apps are in a noncompliant state, click on the ‘View noncompliant apps’ link. A device with performance alerts or compliance violations is flagged with a caution icon. Types of violations that are reported include:
In the management console, you can filter on any of the compliance rules when they occur.
- Rooted OS or failed attestation (Androidonly)
- SafetyNet attestation failure (Androidonly)
- Jailbroken OS (iOSonly)
- Restricted OS version is installed (iOS,Android,macOS,Windows)
- Restricted device model detected (iOS,Android,macOS,Windows)
- BlackBerry Dynamicslibrary version verification (iOS,Android,macOS,Windows)
- BlackBerry Dynamics apps connectivity verification (iOS,Android,macOS,Windows)
- Antivirus status (Windowsonly)
- Device compliance report: On the dashboard, the device compliance report now includes if either theBlackBerry UEM Clientor aBlackBerry Dynamicsapp is out of compliance.
- Device report update: The device report now includes theBlackBerry Dynamicscompliance rule status.
- Automatic device and OS metadata updates: If a user activates a device with a model or OS version that is unknown toBlackBerry UEM,UEMautomatically adds the new device or version metadata to theUEMdatabase so that the metadata is available for Activation, Compliance, and Device SR profiles.
- Enable: You can now use the ‘Enable Android keyboard restricted mode’ option in aAndroidkeyboard restricted modeBlackBerry Dynamicsprofile to force custom keyboards into incognito mode.
- Shared device groups:Migration is not supported for shared device groups. Users who belong to a shared device group do not appear in the Migrate users list. Devices that are part of a shared device group do not appear in the Migrate devices list.
- New Event Notifications:BlackBerry UEMcan now email event notifications to administrators for the following events:
- iOSVPP account expiry
- DEP token expiry
- IT policy pack updated
- Metadata updated
- Activate: Administrators now have the option to allowAndroid Enterprisedevices without adding aAndroid Enterprisedevices to be activated without adding aGoogle Playaccount to the workspace. You might use this option if you do not want to useGoogle Playto manage work apps onAndroid Enterprisedevices or you want to activate and use the device without accessingGoogle Playto the workspace forAndroid Enterprisedevices. By default, the activation profile adds theGoogle Playmanages the apps. If you do not add aBlackBerry UEMinfrastructure viaBlackBerry UEM Client.
- : This activation type is for devices runningBlackBerry UEMnow includes Work and personal – full control activations forAndroid EnterprisedevicesAndroid8 and later. It lets you manage the entire device. It creates a work profile on the device that separates work and personal data but allows your organization to maintain full control over the device and wipe all data from the device. Data in both the work and personal profiles is protected using encryption and a method of authentication such as a password. This activation type supports the logging of device activity (SMS, MMS, and phone calls) inBlackBerry UEMlog files.To activate a device with Work and personal – full control, the user must wipe the device and start the activation in the same way as Work space only activations.To enableBlackBerry Secure Connect PlusKNOXPlatform for Enterprise support, you must select the "When activatingAndroid Enterprisedevices, enable premiumUEMfunctionality such asBlackBerry Secure Connect Plus" option.When applying IT policy rules toAndroid Enterprisedevices with Work and personal – full control activations, the different rule categories affect different profiles on the device:
For example: to apply password requirements to unlock the device, use the Global password rules. To apply password requirements only to the work profile, use the Work profile password rules. To prevent screen capture only of work data, deselect the Work profile “Allow screen capture” rule and select the Personal profile “Allow screen capture” rule. To prevent screen capture of both work and personal data, deselect the Personal profile “Allow screen capture” rule.
- Global rules apply to the entire device
- Work profile rules apply to apps and data in the work profile
- Personal profile rules apply to apps and data in the personal profile
Windows 10 Modern Management
Windows 10Modern Management
- Support for:AzureActive DirectoryJoinBlackBerry UEMnow supportsAzureActive DirectoryJoin which allows a simplified MDM enrollment process forWindows 10devices. Users can enroll their devices withUEMusing theirAzureActive Directoryusername and password.
- Windows Autopilot support:AzureActive DirectoryJoin is also required to supportWindowsAutoPilot, which allowsWindows 10devices to be automatically activated withUEMduring theWindows 10out-of-box setup experience.Note: To enable automatic MDM enrollment withBlackBerry UEMduring theWindows 10out-of-box setup, aUEMcertificate must be installed on the device.
- Create an enterprise endpoint in: You can manage and deployMicrosoft AzureCloudMicrosoft Intune-managed apps from theBlackBerry UEMmanagement console when your environment is configured for Modern authentication.
- Add public app source files as internal apps: You can now addBlackBerry Dynamicsapp source files from the public app stores as internal apps so that users can install the apps without connecting to the stores.
- Link to specific apps: You can now send users a link or QR code that links directly to the app details page for specificBlackBerry Dynamicsapps.
- Enhancements for certificate enrollment using app-based PKI solutions:BlackBerry UEMhas simplified certificate enrollment process for app-based PKI solutions such asPurebred. To use app-based certificates withBlackBerry Dynamicsapps, the "AllowBlackBerry Dynamicsapps to use certificate, SCEP profiles, and user credential profiles" check box no longer needs to be selected in theBlackBerry UEM Client.
- Support for BEMS-Docs services:TheBEMS-Docsservice is now integrated in theBlackBerry UEMCloud environment. You can use theBlackBerry UEMconsole to enable, configure, and maintain document and file repositories and user access policies for mobile app users of theBEMS-Docsservice. This release supports the following storage repositories:
File Share and CMIS-based repository storage providers are not supported.
- Microsoft SharePointconfigured to use theBlackBerry Connectivity NodewhenMicrosoft SharePointis not exposed outside of the firewall.
- Microsoft SharePoint Online
- Microsoft OneDrive for Business
- Trusted connection to the:Microsoft Exchange ServerenhancementsBEMSCloud now supports uploading the CA and Intermediate certificates to theBEMScertificate store using theBEMSsnapin. This allows administrators to upload self-signed and custom CA certificates to create the trusted connection betweenBEMSCloud and theMicrosoft Exchange Server.
- Security enhancements:BEMSCloud now enforces TLS 1.2 cipher suites when establishing secure communications withMicrosoft Exchange. Weaker cipher suites such as TLSv1 are disabled. IfMicrosoft Exchangehas not been updated to support TLS 1.2, push notifications will fail. For more information about TLS 1.2 cipher suits, see the following:
- Impact of enforcing TLS 1.2, visit support.blackberry.com/community to read article 56869.
- Preparing your environment for TLS 1.2, visit https://techcommunity.microsoft.com/t5/Exchange-Team-Blog/Exchange-Server-TLS-guidance-part-1-Getting-Ready-for-TLS-1-2/ba-p/607649
- Shared mailbox enhancements: Users can now receive notifications from both user mailboxes and shared mailboxes that are delegated or shared using the Exchange Control Panel (ECP) orMicrosoft Exchange Management Shell.
- : TheBlackBerry Connectivityapp updatesBlackBerry Connectivityapp (version 22.214.171.1241) forSamsung KNOX WorkspaceandAndroid Enterprisedevices does not include fixes or improvements, but is upversioned so that administrators can assign and update the app on devices. If enterprise connectivity is required, you are now required to use theBlackBerry UEMadministrator console to add theBlackBerry Connectivityapp as an internal app and assign it (with a Required disposition) toSamsung KNOX WorkspaceandAndroid Enterprisedevices that don't have access toGoogle Play. For more information, visit support.blackberry.com/community to read article 37299.
- Trace logging option removed:The option to set logging level to Trace has been removed from Service logging override. You can set logging level to Info, Error, Warning, or Debug.
- Component level logging is now available forBlackBerry ProxyService:BlackBerry ProxyService. You can enable logging forBlackBerry ProxyService on the Server group andBlackBerry Connectivity Nodedefault settings pages.
New IT policy rules
Specify whether users can use
Bluetoothon the device. If you don't want to allow
Bluetooth, the "Allow
Bluetoothchanges" rule should also not be selected. If "Allow
Bluetoothchanges" is selected, users can re-enable
Bluetoothon the device.
Allow modifying personal hotspot settings (supervised only)
Specify whether the user can to modify the personal hotspot settings.
Specify whether the device can send
Allow users to deactivate devices from
Specify whether the user can deactivate the device using the
BlackBerry UEM Client. If this rule is not selected, the Deactivate My Device button in the
BlackBerry UEM Clientis disabled.
Android Enterprise(Work profile)
Androiddevices can display windows other than app windows; for example, windows for toasts, system error messages, and phone calls.
Allow users to modify apps in Android Settings
Specify whether users can modify apps in Settings or launchers. If this rule is not selected, users can't uninstall apps, disable apps, clear app caches, clear app data, force apps to stop, or clear app defaults from the device Settings or launchers.
Allow system error dialogs
Specify whether system error dialogs for crashed or unresponsive apps display on the device. If this rule is not selected, when an app stops or is unresponsive, the system will force-stop the app as if the user chose the "close app" option in the dialog box. A feedback report isn't collected because users can't provide explicit consent.
Skip first use hints
Specify whether work apps should to skip showing any introductory hints that display the first time the app is launched.
Android Enterprise(Personal profile)
Allow screen capture
Specify if a user can take screen shots of the device.
Specify whether the device can save user-entered form data to automatically fill future forms.
Allow adding and removing accounts
Specify whether a user can add or remove accounts, such as email accounts, on the device.
Specify whether the user can add additional
Disallowed account types
Specify the types of accounts that cannot be added to the work space. If no account types are specified, there is no restriction. Disallowing an account type blocks users and apps from adding the account. Account types are defined by the app that uses the account and so can't be thoroughly documented here. Some useful examples are:
For more information, visit support.blackberry.com/community to read article 46860.
Allow lock screen features
Specify whether special features can be enabled on the device lock screen.
Allow camera on lock screen
Specify whether users can access the device camera on lock screen.
Specify whether the device can display notifications on the lock screen.
Allow all notification content
Specify whether all notification content can appear on the lock screen or only the notification type.
Allow fingerprint authentication
Specify whether the user can unlock the device using a fingerprint.
Allow trust agents
Specify whether trust agents can unlock the device.
Allow NFC trust agent
Specify if NFC can be used to unlock the device.
Allow tags with basic authentication to unlock the device
Specify if NFC tags that authenticate using the tag ID can be used to unlock the device.
Allow secure NFC tags to unlock the device
Specify if NFC tags that use challenge-response authentication can be used to unlock the device.
Bluetoothcan be used to unlock the device.
Allow places trust agent
Specify if places can be used to unlock the device.
Allow custom places
Specify if a user can trust places other than Home.
Allow Face trust agent
Specify if face image can be used to unlock the device.
Allow Voice trust agent
Specify if voice can be used to unlock the device.
Allow On-body trust agent
Specify if On-body can be used to unlock the device.
Trust agent inactivity timeout
Specify Device inactivity timeout in minutes. When a device is in an idle state for a certain period of time, trust agents will be revoked.
Allow installation of non Google Play apps
Specify whether a user can install apps using the app installer (the ACTION_INSTALL_PACKAGE mechanism).
Allow developer options
For work space only devices, specify whether users can enable developer options on the device. For Work and personal - user privacy devices, the option for users to turn on developer options can't be disabled. If this rule is not selected the device deletes any apps that aren't on the app list in
UEMthat users have installed to the work profile using the developer options.