Configure

BlackBerry UEM

for a BSI-certified environment

See Administrator roles in a BSI-certified UEM environment.

Follow the instructions in Install a standalone BlackBerry Router.

With the LDAP directory connection configured, you can now proceed to add user accounts and groups to your

UEM

environment to manage the assignment of common configurations to users in the tasks that follow.

To add user accounts and groups, see the following:

Enable directory-linked groups
Create user accounts
Create user groups
Create device groups

Follow the instructions in Request and register an APNs certificate.

Follow the instructions in Configure BlackBerry UEM for DEP.

Follow the instructions in Configure global logging settings.

See Exporting audit records to a syslog server.

You can set up a syslog server for storing both device audit logs and server audit logs. You must use mutual X.509v3 authentication for the connection between

UEM

and the syslog server. The syslog server must use a valid X.509v3 certificate for the presented server certificate in the TLS negotiation. The syslog certificate must be chained to the trust root certificate (CA) that you upload to

UEM

server.

Follow the instructions in Configure audit settings.

For more information about the options that you have to monitor your

UEM

environment, see the UEM Monitoring and reporting Administration Guide.

See Managing Android devices with OEM app configurations and follow the instructions in Create a Knox Service Plugin profile.

You can configure user password requirements using the

Knox Service Plugin

configuration.

Assign the profile to users and groups.

Follow the instructions in Send client certificates to devices using ACME.

Assign the profile to users and groups.

Follow the instructions in Create an activation profile and configure the following:

For

iOS

:

Activation type:
MDM controls
Select the
Pinning revocation check required
check box.
Configure the
Identify certificate
settings as appropriate.
Certificate type:
ACME
RSA strength:
3072
or higher

For

Android

, set the Activation type to

Work space only (Android Enterprise fully managed device)

.

Assign the profile to users and groups.

For more information about using

UEM

to distribute and manage certificates, see the Managing secure connections Administration Guide.

To configure attestation, follow the instructions in Configure attestation for iOS devices and Configure attestation for Android devices.

Optionally, you can configure compliance rules to define actions that

UEM

will carry out when attestation failures occur on devices. See the next row for more information about creating and configuring a compliance profile.

Follow the instructions in Create a compliance profile and configure the profile as appropriate for your environment. Configure the following settings for

iOS

:

Select the
Unapproved certificate is installed
check box.
Click
Browse
next to the
Trusted signing certificate
field and upload the trusted signing certificate.
Configure the desired compliance settings for this rule.

Assign the profile to users and groups.

After

iOS

users activate their devices on

UEM

, they will use an option in

UEM Self-Service

that allows them to manually install the user certificate that is trusted by the uploaded signing certificate (see the last 2 rows below).

Follow the instructions in Manage IT policies to create and configure IT policies. For more information about the available policy rules, see the IT policy spreadsheet.

For

iOS

, turn off the “Allow installing configuration profiles (supervised only)” policy rule.

UEM

features policy rules for all current

iOS

restrictions, including the following:

Force encrypted backups
Allow apple personalized ads
Allow remote screen observation in Classroom
Allow devices to join classes automatically (supervised only)
Allow users to leave Classroom sessions (supervised only)
Allow teachers to lock Classroom app and device (supervised only)
Allow shared device temporary sessions
Allow use of satellite connectivity (supervised only)
Allowed External Intelligence Workspace IDs (supervised only)
Notes transcription summary (supervised only)
Allow Visual Intelligence Summary (supervised only)

You can use IT policy rules to configure password requirements for

iOS

device users.

Assign the IT policies to users and groups.

Follow the instructions in Activate multiple devices using Knox Mobile Enrollment.

If you want to activate an individual

Samsung

Android

device using a QR code, do the following:

Create a
Knox Mobile Enrollment
profile in the
Samsung
Knox Mobile Enrollment
portal. See Samsung Knox: Create profiles - Configure standard settings. Select
BlackBerry UEM
as the EMM solution and use the JSON configuration file that you can download from the management console (Settings > External integration > KNOX Mobile Enrollment).
When you create the profile, a QR code is generated that can be used to activate devices.
Factory reset the device.
Use the QR code created in step 1 to complete device enrollment. See Samsung Knox: QR code enrollment for device users.
The device will automatically download the
BlackBerry UEM Client
. You or the user can accept the license agreement, then scan the QR code from the activation email that the user received from
UEM
to start the
UEM
activation process.

Following activation, Work space only devices have only a limited set of the standard pre-installed apps, such as Camera, Phone, and Settings, plus any apps you have assigned with a required disposition. The list of retained preinstalled apps depends on the device vendor and OS version.

Certificate pinning is not used for communication between enrolled

Android

devices and

UEM

. Enrolled

Android

devices must be configured to trust only approved certificate authorities.

Follow these instructions to activate

iOS

DEP devices:

Register iOS devices in DEP and assign them to the BlackBerry UEM server.
When you configured
UEM
for DEP, if you selected the "Automatically assign new devices to this configuration" check box, any DEP devices you add will automatically receive the DEP enrollment configuration. If you did not select that option, follow the instructions in Assign a DEP enrollment configuration.
Assign a user to an iOS device.
Distribute devices to users and have them complete the activation. See Set an activation password and send an activation email message, Send an activation email to multiple users, or Allow users to set activation passwords in BlackBerry UEM Self-Service.

Instruct

iOS

device users to log in to

UEM Self-Service

and click

Temporarily allow profile installation > Enable

.

This will temporarily allow the user to manually install the user certificate that is trusted by the signing certificate that you associated with the compliance profile. Instruct device users on the preferred way to install the user certificate on the device.