Skip Navigation
  1. BlackBerry Docs
  2. BlackBerry UEM 12.21
  3. Managing email, calendar, and contacts
  4. Controlling which devices can access Exchange ActiveSync for work email and organizer data
  5. Configure permissions for gatekeeping

Configure permissions for gatekeeping

To use
Exchange ActiveSync
 gatekeeping, you must create a user account in
Microsoft Exchange Server
 or
Microsoft 365
 and give it the necessary permissions for gatekeeping.
If you are using
Microsoft 365
, create a
Microsoft 365
 user account and assign it the Mail Recipients and Organization Client Access roles.
If you are using
Microsoft Exchange Server
, follow the instructions below to configure management roles with the correct permissions to manage mailboxes and client access for
Exchange ActiveSync
. To perform this task, you must be a
Microsoft Exchange
 administrator with the appropriate permissions to create and change management roles.
  • On the computer that hosts
    Microsoft Exchange
    , create an account and mailbox to manage gatekeeping in
    BlackBerry UEM
     (for example, BUEMAdmin). You must specify the login information for this account when you create an
    Exchange ActiveSync
     configuration. Note the name of this account, you will specify it at the end of the task below.
  • WinRM must be configured with the default settings on the computer that hosts the
    Microsoft Exchange Server
     that you configure for gatekeeping. You must run the command
    Winrm quickconfig
     from a command prompt as an administrator. When the tool displays
    Make these changes [y/n]
    , type
    y
    . After the command is successful, you see the following message. 
    WinRM has been updated for remote management.

WinRM service type changed to delayed auto start.
WinRM service started.
Created a WinRM listener on HTTP://* to accept WS-Man requests to any IP on this
 machine.
  1. Open the
    Microsoft Exchange Management Shell
    .
  2. Type
    New-ManagementRole -Name "
    <name_new_role_mail_recipients>
    " -Parent "Mail Recipients"
    . Press ENTER.
  3. Type
    New-ManagementRole -Name "
    <name_new_role_org_ca>
    " -Parent "Organization Client Access"
    . Press ENTER.
  4. Type
    New-ManagementRole -Name "
    <name_new_role_exchange_servers>
    " -Parent "Exchange Servers"
    . Press ENTER.
  5. Type
    Get-ManagementRoleEntry "
    <name_new_role_mail_recipients>
    \*" | Where {$_.Name -ne "Get-ADServerSettings"} | Remove-ManagementRoleEntry
    . Press ENTER.
  6. Type
    Get-ManagementRoleEntry "
    <name_new_role_org_ca>
    \*" | Where {$_.Name -ne "Get-CasMailbox"} | Remove-ManagementRoleEntry
    . Press ENTER.
  7. Type
    Get-ManagementRoleEntry "
    <name_new_role_exchange_servers>
    \*" | Where {$_.Name -ne "Get-ExchangeServer"} | Remove-ManagementRoleEntry
    . Press ENTER.
  8. Type
    Add-ManagementRoleEntry "
    <name_new_role_mail_recipients>
    \Get-ActiveSyncDeviceStatistics" -Parameters Mailbox
    . Press ENTER.
  9. Type
    Add-ManagementRoleEntry "
    <name_new_role_mail_recipients>
    \Get-ActiveSyncDevice" -Parameters Identity
    . Press ENTER.
  10. Type
    Add-ManagementRoleEntry “
    <name_new_role_mail_recipients>
    \Get-MobileDeviceStatistics” –Parameters Mailbox
    . Press ENTER.
  11. Type
    Add-ManagementRoleEntry “
    <name_new_role_mail_recipients>
    \Get-MobileDevice” –Parameters Mailbox
    . Press ENTER.
  12. Type
    Add-ManagementRoleEntry "
    <name_new_role_org_ca>
    \Set-CasMailbox" -Parameters Identity, ActiveSyncBlockedDeviceIDs, ActiveSyncAllowedDeviceIDs
    . Press ENTER.
  13. Type
    New-RoleGroup "
    <name_new_group>
    " -Roles "
    <name_new_role_mail_recipients>
    ", "
    <name_new_role_org_ca>
    ", "
    <name_new_role_exchange_servers>
    "
    . Press ENTER.
  14. Type
    Add-RoleGroupMember -Identity "
    <name_new_group>
    " -Member "BUEMAdmin"
    . Press ENTER.
  15. Type
    Add-ManagementRoleEntry "
    <name_new_role_mail_recipients>
    \Set-AdServerSettings"
    . Press ENTER.
  16. Type
    Add-ManagementRoleEntry "
    <name_new_role_mail_recipients>
    \Remove-ActiveSyncDevice" -Parameters Identity,Confirm
    . Press ENTER.
  17. Type
    Add-ManagementRoleEntry "
    <name_new_role_mail_recipients>
    \Remove-MobileDevice" -Parameters Identity,Confirm
    . Press ENTER.