Prerequisites Skip Navigation


  • Port 88 on the 
    Active Directory
     service must be accessible by all 
    BlackBerry UEM
  • The 
     environment must include the following components:
    • Microsoft Active Directory
       server: The directory service that authenticates and authorizes all users and computers associated with your 
    • Kerberos
       Key Distribution Center (KDC): The authentication service on the 
      Active Directory
       server that supplies session tickets and keys to users and computers in the 
      Active Directory
  • Create service principal names (SPN) for all HTTP services (including 
    BlackBerry Enterprise Mobility Server
     and other services). You must set an SPN for every target resource you want devices to have access to. For example:
    setspn –S HTTP/SPHOST.FQDN:PORT domain\AppPoolUser
    For more information on how to create and modify SPNs, see to read "Register a Service Principal Name for Kerberos Connections". SPNs should be configured by the owners of the app servers or the 
    Active Directory
For multi-realm 
  • A minimum of one 
    BlackBerry UEM Core
     server must be installed in each 
    BlackBerry UEM
     must reside in the same 
     realm as the resource because cross-realm resource delegation is not supported. 
  • Ensure that single-realm KCD is working before configuring multi-realm KCD.
  • All trusts must be bidirectional, transitive forest trust.
    Ensure a maximum of 5 ms latency between the 
    BlackBerry UEM Core
     servers and the 
    Microsoft SQL Server
     database. For more information see the BlackBerry UEM hardware requirements.