Skip Navigation
  1. BlackBerry Docs
  2. BlackBerry UEM 12.23
  3. UEM Configuration Guide
  4. Connecting to your company directories
  5. Enable and configure onboarding and offboarding

Enable and configure onboarding and offboarding

When you enable onboarding, you add universal or global directory groups to
UEM
 as onboarding directory groups (onboarding is not supported for domain local groups). During a synchronization process, if
UEM
 detects a directory user in an onboarding directory group that does not have a corresponding
UEM
 user account, it creates that user account in
UEM
. When you enable onboarding you can also configure offboarding; when you disable or remove a user from an onboarding directory group,
UEM
 can delete device data and remove the user from
UEM
.
When offboarding is enabled, any
UEM
 user accounts that are not members of an onboarding directory group, regardless of how they were added to
UEM
, are offboarded during the next synchronization process.
  1. In the management console, on the menu bar, click
    Settings > External integration > Company directory
    .
  2. Click a company directory connection.
  3. On the
    Sync settings
     tab, select the
    Enable directory-linked groups
     check box.
  4. Select the
    Enable onboarding
     check box.
  5. Do any of the following:
    Task
    Steps
    Add onboarding directory groups and configure device activation options.
    1. Click The add icon.
    2. Search for and add universal or global directory groups.
    3. For each directory group, select whether you want to link nested groups.
    4. In the
      Device activation
       section, select whether you want onboarded users to receive an autogenerated activation password and email, or no activation password. If you select the autogenerated password option, configure the activation period and select an activation email template.
    Onboard users that you only want to use
    BlackBerry Dynamics
     apps.
    Follow these steps if you want to onboard users who will use
    BlackBerry Dynamics
     apps only. These users will not activate their devices on
    UEM
     using the
    UEM Client
     and their devices will not be managed by
    UEM
    .
    1. Select the
      Onboard users with BlackBerry Dynamics apps only
       check box.
    2. Click The add icon.
    3. Search for and add universal or global directory groups.
    4. For each directory group, select whether you want to link nested groups.
    5. Specify the number of access keys to generate per user, the access key expiration period, and the email template.
    Configure offboarding.
    If you want to delete device data when a user is offboarded from
    UEM
    , select the
    Delete device data when the user is removed from all onboarding directory groups
     check box. Do the following:
    • Select the appropriate option for the data that you want to remove from the device.
    • If you want to remove a user from
      UEM
       when that user is removed from all onboarding directory groups, select the
      Delete user when the user is removed from all onboarding directory groups
       check box.
    • If you want to delay the deletion of users and device data for two hours after a synchronization cycle, select the
      Offboarding protection
       check box. This option can help avoid unexpected deletions because of directory replication latency.
  6. In the
    Sync limit - percent of users to be off-boarded or removed
     field, specify the maximum percentage of users in a group that can be removed or offboarded in a synchronization activity. If this maximum is exceeded,
    UEM
     does not carry out any removal or offboarding actions on the group during a synchronization. For example, if you specify the limit as 80%, if 81% or more of the users in a group would be removed or offboarded in a synchronization activity,
    UEM
     will not remove or offboard any users from that group. By default, the limit is 100%, which means that
    UEM
     will not carry out removal or offboarding actions on a group if all of the users that belong to that group are impacted.
  7. In the
    Sync limit - minimum group size threshold field
    , specify the minimum number of users that a directory group must contain before
    UEM
     will apply the maximum limit that you specified in
    Sync limit - percent of users to be off-boarded or removed
    . The maximum sync limit percentage does not apply to groups with fewer users than the minimum group size that you specify. The default minimum threshold is 10 (a group must contain at least 10 users for
    UEM
     to factor in the maximum sync limit percentage; the maximum synch limit does not apply to groups of 9 or less users). Type 0 if you want
    UEM
     to apply the maximum sync limit to all groups regardless of group size.
  8. If you want to force the synchronization of company directory groups, select the
    Force synchronization
     check box.
    If enabled, when a group is removed from the company directory, the links to that group are removed from directory-linked groups and onboarding directory groups. If all of the company directory groups associated with a directory-linked group are removed, the directory-linked group is converted to a local group.
  9. In the
    Maximum nesting level of directory groups
     field, type the number of nested levels to synchronize for company directory groups.
  10. Click
    Save
    .