What's new in

BlackBerry UEM

This release includes the following changes:

The "Allow marketplace apps" IT policy rule has been added to allow you to control whether users can install marketplace apps. This rule is supported for
iOS
17.4 and later. (EMM-155942)
The functionality of the following
iOS
IT policy rules now extend to marketplace apps: Allow installing apps (supervised only), Allow removing apps (supervised only).
The functionality of the following
iOS
compliance rules now extend to marketplace apps: Show only allowed apps on the device, Restricted app is installed.

For more information, see the UEM 12.19 IT policy rules reference.

The following IT policy rules have been added for devices with

iOS

17.2 and later:

Preserve eSIM data plan on device wipe (supervised only)
Allow Live Voicemail (supervised only)

For more information, see the UEM 12.19 IT policy rules reference.

The

UEM

console URLs have changed in this release to include additional information at the end of the path:

Management console: https://
<server_name>
:
<port>
/admin/index.jsp?tenant=
<tenant_ID>
&redirect=no
UEM Self-Service
console: https://
<server_name>
:
<port>
/mydevice/index.jsp?tenant=
<tenant_ID>
&redirect=no

If you integrate UEM with Entra ID, the

UEM

console URLs change to the following ("&redirect=no" is removed from the end of the URL):

Management console: https://
<server_name>
:
<port>
/admin/index.jsp?tenant=
<tenant_ID>
Self-service console: https://
<server_name>
:
<port>
/mydevice/index.jsp?tenant=
<tenant_ID>

The following operating systems are now supported:

iOS
17: Includes support for RSA-PSS and DH group 32 in VPN profiles and TLS 1.3 in
Wi-Fi
profiles
Android
14

You must install JRE 17 on the servers where you will install

UEM

, and you must set an environment variable that points to the BB_JAVA_HOME home location.

For more information, see Set an environment variable for the Java location.

You can now connect

BlackBerry UEM

on-premises to

Entra ID

to create and synchronize users and directory-linked groups.

For more information, see Connect BlackBerry UEM to Entra ID.

Three new activation types that support the

Android Management

API have been added:

Work and personal - full control (
Android Management
fully managed device with work profile)
Work and personal - user privacy (
Android Management
with work profile)
Work space only (
Android Management
fully managed device)

For more information, see the following:

Considerations for Android Management activation types
Configuring BlackBerry UEM to support Android Management devices
Activation types: Android devices
Activating Android devices

You can now configure KSP policies from the Policies and profiles menu in the

UEM

management console instead of an app configuration.

For more information, see Managing Android devices with OEM app configurations profile.

You can now specify new "Required without updates" or "Optional without updates" dispositions for

iOS

VPP apps and assign them to users, user groups, device groups, shared device groups, and public device groups. For shared

iPad

groups you can assign "Required without updates".

You can now select an RSR version as the minimum allowed OS version in activation profiles for

iOS

devices.

You can use the new "Allow

WatchOS

apps" setting to control whether end users can pair their Apple

WatchOS

apps with

BlackBerry Dynamics

apps. This setting is off by default.

For more information, see BlackBerry Dynamics profile settings.

You can now use the %ComplianceApplicationList% variable to display the names of restricted apps that are installed on a device in compliance notifications that are sent to users.

For more information, see Using variables in profiles, emails, and notifications.

Paged search results are now supported for LDAP directories.

You can now view the information for multiple SIMs for a device on the Device details screen, including eSIM information.

You can now add the

Bluetooth

MAC address as an optional field in the Advanced view of the Managed device users screen. You can also export this data from this view.

You can now export a list of the personal apps that are installed on a user's device. The list includes the user and device name, the app name and version, the OS type and version, and the installation date.

See the

UEM Client

Release Notes to learn about the latest features:

UEM Client for Android
UEM Client for iOS

You can now export a list of the personal apps that are installed on a user's device. The list includes the user and device name, the app name and version, the OS type and version, and the installation date.

UEM

now provides an option to preserve the data plan on an

Android

eSIM device when you select the delete all device data command. By default, the data plan information is preserved when you select the delete all device data command.

For more information, see Sending commands to users and devices.

The date and time of the last time that a user changed the password for the

BlackBerry UEM Client

or a

BlackBerry Dynamics

app is now displayed in the devices table and on the device details page. This feature requires a version of the

UEM Client

or

BlackBerry Dynamics

apps released in June 2023 or later.

If a device has more than one SIM (for example, a physical and eSIM), information for all SIMs is now displayed in the device report. The device details page shows SIM information only for the phone number that has been selected by the user as the default for voice calls.

See the

UEM Client

Release Notes to learn about the latest features:

UEM Client for Android
UEM Client for iOS

You can now export a list of the personal apps that are installed on a user's device. The list includes the user and device name, the app name and version, the OS type and version, and the installation date.

UEM

now provides an option to preserve the data plan on an

iOS

eSIM device when you select the delete all device data command. If eSIM information is detected on the device, a pop-up will display asking if you want to preserve the data plan. The default action is to delete the data plan and you have to choose to preserve it.

For more information, see Sending commands to users and devices.

After a Rapid Security Response (RSR) build has been installed on an

iOS

16 or later device, the RSR version is displayed in the users table, the device details page, device reports, and exports. You can also select the RSR version as a restricted OS version in compliance profiles.

Android Enterprise

devices can now be activated when they are using a mobile network. This feature applies only to Work space only (

Android Enterprise

) and Work and personal - full control (

Android Enterprise

) activation types.

You can now use multiple languages (German, Spanish, French, and Japanese) with the following compliance variables in email templates:

%ComplianceDynamicsEnforcementAction%
%ComplianceDynamicsEnforcementActionWithDescription%
%ComplianceEnforcementAction%
%ComplianceEnforcementActionWithDescription%
%ComplianceRuleViolated%
%ComplianceViolationExpiration%

For more information, see Variables.

Allow screenshots in the work profile to be stored in the personal profile: Specify whether screenshots taken in the work profile can be saved in the personal profile.

For more information, see the Policy reference spreadsheet.

This release adds support for devices running:

Android
13
iOS
16

After the

UEM Client

has been activated on an

iOS

device that is enrolled in DEP, during any subsequent activation, if there is no device activation password set for the user, the

UEM Client

displays a message that tells the user how to activate their device.

You can export a list of devices that are not already using a hardened channel and migrate them so that they use a hardened channel.

For more information, see Migrate iOS devices to use a hardened channel.

A new option, "Permit fallback to device passcode if biometric authentication fails", has been added to the

BlackBerry Dynamics

profile. This option allows

iOS

biometric (TouchID/FaceID) authentication to fall back to the device passcode if biometric authentication fails.

For more information, see Controlling BlackBerry Dynamics on users devices.

For devices that were activated using the

Work space only

(

Android Enterprise

) activation type, when an app is removed from

Google Play

or unassigned from a user, the app is removed from the device automatically.

For more information, see Extending the management of Chrome OS devices to BlackBerry UEM.

For more information, see the Policy reference spreadsheet.

UEM

now supports devices that are running

Chrome OS

. The

Chrome OS

integration with

BlackBerry UEM

extends some of the

Chrome OS

management functionality to

UEM

. You can perform some commands on

Chrome OS

devices, such as view device report, view device actions, and delete only work data.

For more information, see KB 98789 and Extending the management of Chrome OS devices to BlackBerry UEM.

You can now configure multiple

Entra ID

connections for conditional access in a

UEM

tenant. You can also configure multiple

UEM

domains to connect to the same

Entra ID

tenant.

For more information, see Connecting BlackBerry UEM to Microsoft Azure.

The

BlackBerry Affinity Manager

,

BlackBerry Dispatcher

, and

BlackBerry MDS Connection Service

components have been removed from the installation and upgrade process. These components were used only for managing

BlackBerry 10

devices, which are no longer supported.

For more information about a

BlackBerry Affinity Manager

disconnected status, see KB 90941.

iPad

devices can now be shared between multiple users. When users sign in with a Managed

Apple

ID, their data loads and the user has access to their own email accounts, files,

iCloud

Photo Library, app data, and more.

For more information, see Creating and managing shared iPad groups.

UEM

now supports the CryptoTokenKit framework for

iOS

devices so that

BlackBerry Dynamics

apps can access cryptographic tokens from PKI apps such as Purebred. Support for cryptographic tokens is enabled when you select the “Native keystore” connection option and the

iOS

platform in the user credential profile. This feature requires apps that use

BlackBerry Dynamics SDK

10.2 or later.

For more information, see Sending client certificates to devices and apps using user credential profiles.

When you use the

Purebred

app version 2.1 (8) or later, which must be submitted through the Custom App Distribution mechanism, you must update the uniform type identifiers (UTI) that contain underscores (‘_’) to dashes ('-') for the

BlackBerry UEM Client

app policy.

For example, use

purebred.select.all-user; purebred.select.no-filter; purebred.zip.all-user; purebred.zip.no-filter

. Users may need to reactivate the new

Purebred

app on their device.

Work apps exempt from VPN: Specify the work apps that are not required to send data over the work connection when "Force work apps to only use VPN" is selected.

For more information, see the Policy reference spreadsheet.

Recommended software update cadence (supervised only): Specify how software updates are presented to the user. When there is only one update available, the system shows the update to the user. Otherwise, the updates are displayed in the specified order. This rule applies only to devices running

iOS

14.5.0 and later.

For more information, see the Policy reference spreadsheet.