Key features for each device type

You can use

Apple Configurator

2 to prepare devices for activation with

UEM

. Users can activate the prepared devices without using the

BlackBerry UEM Client

.

You can use web content filter profiles to limit the websites that a user can view on a device. You can enable automatic filtering with the option to allow and restrict websites, or allow access only to specific websites.

The Volume Purchase Program (VPP) allows you to buy and distribute

iOS

apps in bulk. You can link

Apple

VPP accounts to a

UEM

domain so that you can distribute purchased licenses for

iOS

apps associated with the VPP accounts.

You can configure

UEM

to use the

Apple

Device Enrollment Program (DEP) so that you can synchronize

UEM

with the DEP. After you configure

UEM

, you can use the management console to manage the activation of the

iOS

devices that your organization purchased for the DEP. You can use multiple DEP accounts. You can link multiple

Apple

DEP accounts to one

UEM

domain.

UEM

supports app-based PKI solutions, such as

Purebred

, which can enroll certificates for

BlackBerry Dynamics

apps. You can now install the PKI app on devices and allow the latest versions of

BlackBerry Dynamics

apps, such as

BlackBerry Work

and

BlackBerry Access

, to use certificates enrolled through the PKI app.

You can use custom payload profiles to control features on

iOS

devices that are not controlled by existing

UEM

policies or profiles. You can create

Apple

configuration profiles using

Apple Configurator

and add them to

UEM

custom payload profiles. You can assign the custom payload profiles to users, user groups, and device groups.

BlackBerry Secure Gateway

allows

iOS

devices with the MDM controls activation type to connect to your work email server through the

BlackBerry Infrastructure

and

UEM

. If you use

BlackBerry Secure Gateway

you don't have to expose your mail server outside of the firewall to allow users with these devices to receive work email when they are not connected to your organization's VPN or work

Wi-Fi

network.

You can use the

BlackBerry Dynamics

profile to allow

iOS

devices to access

BlackBerry Dynamics

productivity apps such as

BlackBerry Work

,

BlackBerry Access

, and

BlackBerry Connect

. You can assign the

BlackBerry Dynamics

profile to user accounts, user groups, or device groups. Multiple devices can access the same apps.

The profile allows you to enable

BlackBerry Dynamics

for users that are not already

BlackBerry Dynamics

enabled.

You can set up per-app VPN for

iOS

devices to specify which apps on devices must use a VPN for their data in transit. Per-app VPN helps decrease the load on your organization’s VPN by enabling only certain work traffic to use the VPN (for example, accessing application servers or web pages behind the firewall). This feature also supports user privacy and increases connection speed for personal apps by not sending the personal traffic through the VPN.

For

iOS

devices, apps are associated with a VPN profile when you assign the app or app group to a user, user group, or device group.

The activation lock feature requires the user's

Apple

ID and password before a user can turn off Find My

iPhone

, erase the device, or reactivate and use the device. You can bypass the activation lock to give a COPE or COBO device to a different user.

You can view a list of apps that are installed in a user's personal space on

iOS

devices in your environment. You can view a list of personal apps installed on a user’s device on the user details page or view a list of all personal apps installed in users’ personal spaces on the personal apps page in the management console.

On

iOS

devices that are supervised using

Apple Configurator

2, you can use an app lock mode profile to limit the device to run only one app. For example, you can limit access to a single app for training purposes or for point-of-sales demonstrations.

Lost mode allows you to lock a device, set a message that you want to display, and view the current location of the lost device. You can enable lost mode for supervised

iOS

devices.

iOS

devices can connect to

IBM Notes Traveler

through the

BlackBerry Secure Gateway

.

UEM

supports Face ID for device authentication and to open

BlackBerry Dynamics

apps.

You can allow multiple users to share an

iOS

device. You can customize terms of use that users must accept to check out shared devices. A user can check out a device using local authentication and when they are done using it, they can check it in and the device is available for the next user. Shared devices remain managed by

UEM

during the check-out and check-in process. This feature was designed for supervised devices with the following configuration:

App lock mode enabled
VPP apps assigned

iPad

devices can be shared between multiple users. When users sign in with a managed

Apple

ID, their data loads and the user can access their own email accounts, files,

iCloud

photo library, app data, and more.

You can activate

Android

devices to use

Android Enterprise

or

Android Management

, which are features developed by

Google

that provide additional security for organizations that want to manage and allow apps and data on

Android

devices.

Devices can be activated to have only a work profile, or to have both work and personal profiles. You can have full control over both profiles and have the ability to wipe the entire device, or you can allow user privacy for the personal profile and only have the ability to wipe work data from the device.

Samsung

devices offer additional administrator options, including an enhanced set of IT policy rules, when activated with

Android Enterprise

.

This activation type allows you to manage the entire device. It creates a work profile on the device that separates work and personal data but allows your organization to maintain full control over the device and wipe all data from the device. Data in both the work and personal profiles is protected using encryption and a method of authentication such as a password.

UEM

can also manage

Samsung

devices using

Samsung Knox

MDM and

Samsung Knox Workspace

.

Knox Workspace

provides an encrypted, password-protected container on a

Samsung

device that includes your work apps and data. It separates a user’s personal apps and data from your organization’s apps and data, and protects work apps and data using enhanced security and management capabilities that

Samsung

developed.

When a device is activated,

UEM

automatically identifies whether the device supports

Knox

. In addition to the standard

Android

management capabilities,

UEM

includes the following capabilities for devices that support

Knox

:

An enhanced set of IT policy rules
Enhanced application management including silent app installations and uninstallations, silent uninstallations of restricted apps, and prohibitions to installing restricted apps
App lock mode

For more information about supported devices, see the Compatibility matrix.

You can use the

BlackBerry Dynamics

profile to allow

Android

devices to access

BlackBerry Dynamics

productivity apps such as

BlackBerry Work

,

BlackBerry Access

, and

BlackBerry Connect

. You can assign the

BlackBerry Dynamics

profile to user accounts, user groups, or device groups. Multiple devices can access the same apps.

The profile allows you to enable

BlackBerry Dynamics

for users that are not already

BlackBerry Dynamics

enabled.

You can enable per-app VPN for

Android

devices that have a work profile to restrict the use of

BlackBerry Secure Connect Plus

to specific work space apps that you add to an allowed list.

UEM

supports devices that have been enabled for zero-touch enrollment. Zero-touch enrollment offers a seamless deployment method for organization-owned

Android

devices, making large-scale device deployment fast, easy, and secure. Zero-touch enrollment makes it simple for IT administrators to configure devices online and have enforced management ready when employees receive their devices. For more information from

Google

, see Zero-touch enrollment management and the zero-touch enrollment overview. You can get started with zero-touch enrollment in just a few steps: purchase devices, assign the devices to users, configure policies for your organization, and deploy the devices to users. You need to work with your reseller or carrier to get access to the Zero-touch portal and get devices configured in the portal.

UEM

supports app-based PKI solutions, such as

Purebred

, which can enroll certificates for

BlackBerry Dynamics

apps. You can now install the PKI app on devices and allow the latest versions of

BlackBerry Dynamics

apps, such as

BlackBerry Work

and

BlackBerry Access

, to use certificates enrolled through the PKI app.

When administrators enable

Android

SafetyNet

or

Google Play Integrity

attestation,

UEM

sends challenges to test the authenticity and integrity of

Android

devices that have been activated with the

Android Enterprise

,

Samsung Knox

, and MDM controls activation types in your organization's environment.

You can apply security patch level enforcement to

BlackBerry Dynamics

apps. If the security patch level is not met, you can choose to delete the

BlackBerry Dynamics

app data, not allow

BlackBerry Dynamics

apps to run on the device, or perform no actions on the device.

Use

Entrust IdentityGuard

derived smart credentials for signing, encryption, and authentication for

BlackBerry Dynamics

apps and apps in the work space on

Android Enterprise

and

Samsung Knox Workspace

devices.

You can set up a factory reset protection profile for your organization’s

Android Enterprise

devices that have been activated using the Work space only activation type. This profile allows you to specify a user account that can be used to unlock a device after it has been reset to factory settings or remove the need to sign in after the device has been reset to factory settings.

You can manage

Windows

devices, including

Windows

10 Mobile devices and

Windows 10

tablets and computers.

You can configure VPN and

Wi-Fi

work connections for

Windows 10

devices and you can set up a proxy server as part of the

Wi-Fi

profile for

Windows 10 Mobile

devices.

You can set up per-app VPN for

Windows 10

devices to specify which apps on devices must use a VPN for their data in transit. Per-app VPN helps decrease the load on your organization’s VPN by enabling only certain work traffic to use the VPN (for example, accessing application servers or web pages behind the firewall). This feature also supports user privacy and increases connection speed for personal apps by not sending the personal traffic through the VPN.

You can configure

Windows

Information Protection profiles to separate personal and work data on devices, prevent users from sharing work data outside of protected work apps or with people outside of your organization, and audit inappropriate data sharing practices. You can specify which apps are protected and trusted to create and access work files.

In the compliance profile, in the “Antivirus status” rule for

Windows

devices, you can choose to allow antivirus software from any vendor, or allow only those that you added to the “Allowed antivirus vendors” list. The rule will be enforced if a device has antivirus software enabled from any vendor that is not allowed.

UEM

supports

Entra ID

Join, which allows a simplified MDM enrollment process for

Windows 10

devices. Users can enroll their devices with

UEM

using their

Entra ID

username and password.

Entra ID

Join is also required to support

Windows

AutoPilot, which allows

Windows 10

devices to be automatically activated with

UEM

during the

Windows 10

out-of-box setup experience.

When a user activates a

macOS

device, the device and the user are set up as separate entities on

UEM

. Separate communication channels are established between

UEM

and the device and

UEM

and the user account, allowing you to manage the device and the user separately.

Some profiles are assigned to the user only (for example, email profiles). Some profiles are assigned to the device only (for example, proxy profiles). Some profiles allow you to choose whether to apply the profile to the device or the user (for example,

Wi-Fi

profiles).

You can control the device using commands and IT policies. Users activate

macOS

devices using

BlackBerry UEM Self-Service

.