Understanding services, entitlements, and groups

Services are applications, often located in the cloud, that users need to access. For example, 

Microsoft Office 365

, 

BlackBerry Workspaces

, or 

WebEx

. By configuring a service in 

BlackBerry UEM

, 

BlackBerry UEM Cloud

, or 

BlackBerry Enterprise Identity

, you set up a secure interface between 

Enterprise Identity

 and your instance, or tenant, of that service. After you use 

BlackBerry UEM

 or 

BlackBerry UEM Cloud

 to add a service, you use the 

BlackBerry UEM

 management console to manage the service and deploy entitlements for the service to users.

The most efficient way to entitle users is with app groups. An app group can bind together both the SSO entitlement for a service and the client applications needed on devices to interact with the service. You can assign app groups to users or user groups, giving them everything they need to access the service. 

User groups give administrators flexibility to entitle large numbers of users at the same time instead of maintaining the entitlement manually as users are added or removed from the group. When a user is added to the group, the entitlement is assigned to them automatically, allowing them to sign into the service from any device using the same credentials. If a user is removed from the group, they automatically lose access to that service. Service entitlements can also be assigned to individual users if required.