Data flow: Activating an

Android Enterprise

Work and personal - user privacy

device using a managed

Google Play

account

You perform the following actions:

Add a user to
BlackBerry UEM
as a local user account or using the account information retrieved from your company directory.
Make sure the "
Work and personal - user privacy
” activation type is assigned to the user.
Use one of the following options to provide the user with activation details:
Automatically generate a device activation password and, optionally, a
QR Code
and send an email with activation instructions for the user
Set a device activation password and communicate the username and password to the user directly or by email
Don't set a device activation password and communicate the
BlackBerry UEM Self-Service
address to the user so that they can set their own activation password and view a
QR Code
.

The user downloads

BlackBerry UEM Client

from

Google Play

and installs it on the device. After it is installed, the user opens the

BlackBerry UEM Client

and enters their email address and activation password or scans the

QR Code

.

The

BlackBerry UEM Client

on the device performs the following actions:

Establishes a connection to the
BlackBerry Infrastructure
Sends a request for activation information to the
BlackBerry Infrastructure

The

BlackBerry Infrastructure

performs the following actions:

Verifies that the user is a valid, registered user
Retrieves the
BlackBerry UEM
address for the user
Sends the address to the
BlackBerry UEM Client

The

BlackBerry UEM Client

establishes a connection with

BlackBerry UEM

using an HTTP CONNECT call over port 443 and sends an activation request to

BlackBerry UEM

. The activation request includes the username, password, device operating system, and unique device identifier.

BlackBerry UEM

performs the following actions:

Determines the activation type assigned to the user account
Connects to
Google
and creates a managed
Google Play
user
Creates a device instance
Associates the device instance with the specified user account
Adds the enrollment session ID to an HTTP session
Sends the user's managed
Google Play
account information and a successful authentication message to the device

If the device is not encrypted, the user is prompted to encrypt the device.

The

BlackBerry UEM Client

performs the following actions:

Connects to
Google
to verify the user
Creates the work profile on the device
Creates a CSR using the information received from
BlackBerry UEM
and sends a client certificate request to
BlackBerry UEM
over HTTPS.

BlackBerry UEM

performs the following actions:

Validates the client certificate request against the enrollment session ID in the HTTP session
Signs the client certificate request with the root certificate
Sends the signed client certificate and root certificate back to the
BlackBerry UEM Client

The

BlackBerry UEM Client

requests all configuration information and sends the device and software information to

BlackBerry UEM

.

BlackBerry UEM

stores the device information in the database and sends the requested configuration information to the device.

The device sends an acknowledgment to

BlackBerry UEM

that it received and applied the configuration information. The activation process is complete.