Architecture: 
BlackBerry 2FA

 
 
Component
Description
User's computer or device
A user's computer or device is any computer or device, from inside or outside a firewall, that is used to connect to a resource that requires two-factor authentication.
BlackBerry 2FA
 server
The 
BlackBerry 2FA
 server connects to 
BlackBerry UEM
 to find the devices associated with a user and to send authentication requests to the 
BlackBerry 2FA
 app that's installed on devices.
VPN gateway (optional)
The VPN gateway is a computer that accepts VPN connections to your organization's network.
This feature requires the 
BlackBerry 2FA
 server.
REST API client (optional)
The REST API client is a customer-defined, on-premises service that authenticates users who access it through the 
BlackBerry 2FA
 server's REST API.
This feature requires the 
BlackBerry 2FA
 server.
BlackBerry Enterprise Identity
 (optional)
BlackBerry Enterprise Identity
 provides single sign-on (SSO) to cloud services, such as 
Box
Salesforce
, and 
G Suite
Enterprise Identity
 connects directly to the 
BlackBerry 2FA
 service in 
BlackBerry UEM
 or 
BlackBerry UEM Cloud
.
BES12
, or 
BlackBerry UEM
BlackBerry UEM Cloud
BlackBerry UEM
 also manages 
BlackBerry 2FA
 user configuration through the 
BlackBerry 2FA
 profile and the use of one-time password (OTP) tokens.
User's device with 
BlackBerry 2FA
For 
iOS
 and 
Android
 devices, 
BlackBerry 2FA
 is included in the 
BlackBerry UEM Client
. For 
BlackBerry 10
 devices, users install the 
BlackBerry 2FA
 app.