Architecture:
BlackBerry 2FA

Component	Description
User's computer or device	A user's computer or device is any computer or device, from inside or outside a firewall, that is used to connect to a resource that requires two-factor authentication.
BlackBerry 2FA server	The BlackBerry 2FA server connects to BlackBerry UEM to find the devices associated with a user and to send authentication requests to the BlackBerry 2FA app that's installed on devices.
VPN gateway (optional)	The VPN gateway is a computer that accepts VPN connections to your organization's network. This feature requires the BlackBerry 2FA server.
REST API client (optional)	The REST API client is a customer-defined, on-premises service that authenticates users who access it through the BlackBerry 2FA server's REST API. This feature requires the BlackBerry 2FA server.
BlackBerry Enterprise Identity (optional)	BlackBerry Enterprise Identity provides single sign-on (SSO) to cloud services, such as Box , Salesforce , and G Suite . Enterprise Identity connects directly to the BlackBerry 2FA service in BlackBerry UEM or BlackBerry UEM Cloud .
BES12 , or BlackBerry UEM , BlackBerry UEM Cloud	BlackBerry UEM also manages BlackBerry 2FA user configuration through the BlackBerry 2FA profile and the use of one-time password (OTP) tokens.
User's device with BlackBerry 2FA	For iOS and Android devices, BlackBerry 2FA is included in the BlackBerry UEM Client . For BlackBerry 10 devices, users install the BlackBerry 2FA app.