Skip Navigation
  1. BlackBerry Docs
  2. BlackBerry UEM 12.20
  3. UEM Configuration Guide
  4. Configuring BlackBerry UEM as an Intune compliance partner in Entra
  5. Prerequisites to configure Entra ID conditional access

Prerequisites to configure
Entra ID
 conditional access

  • Verify that you have a
    Microsoft
     account with an
    Intune
     license and with one of the following permissions in the
    Entra
     portal: global administrator, limited administrator with the Intune Service administrator role, or a custom role with the permissions described in KB 50341.
  • In the
    Microsoft
     Endpoint Manager admin center, in the section for Partner Compliance Management, add
    BlackBerry UEM Entra Conditional Access
     as a compliance partner for
    iOS
     and
    Android
     devices and assign it to users and groups.
  • In
    Entra ID
    , create and configure a conditional access profile and enable the option "Require device to be marked as compliant". Note that this is the only conditional access profile setting that
    UEM
     interacts with.
  • To use this feature, device users must meet the following requirements:
    • Users must exist in
      Entra ID
       and must have a valid
      Intune
       license. For more information, see Microsoft Intune licenses.
    • If you synchronize your on-premises
      Active Directory
       with
      Entra ID
      , users’ on-premises
      Active Directory
       UPN must match their
      Entra ID
       UPN.
    • Users must be added to
      UEM
       as directory users.
  • After you verify the prerequisites above, follow the steps in Configure Entra ID conditional access.
    • Note that the configuration steps will instruct you to enable the
      UEM Client
       to enroll in
      BlackBerry Dynamics
       and to install the
      UEM Client
       on devices.
    • The steps will instruct you to install the
      Microsoft Authenticator
       app on users' devices before activation with
      UEM
      . If you want to delay conditional access enrollment on the device until the
      Microsoft Authenticator
       app is installed (either manually by the user or deployed with
      UEM
      ), you can enable the "Start conditional access enrollment after authentication broker is installed" setting in the assigned
      BlackBerry Dynamics
       profile. Note that this option is not supported for
      Android
       devices with the User privacy activation type (it does apply to
      Android Enterprise
       user privacy and
      Android Management
       user privacy). If enabled, after the
      Microsoft Authenticator
       app is installed, the conditional access enrollment process is initiated when the user opens the
      UEM Client
      . On
      Android
       devices, if the work space is unlocked, the user will be prompted to open the
      UEM Client
       to start the conditional access enrollment.