Administration Guide. BlackBerry Enterprise Service 12. Version 12.0

Transcription

1 Administration Guide BlackBerry Enterprise Service 12 Version 12.0

2 Published: SWD

3 Contents Introduction... 9 About this guide...10 What is BES12?...11 Key features of BES About BES12 Self-Service How to use this guide Steps to administer BES Examples of everyday administration scenarios How to use the management console Log in to BES Administrators...21 Setting up administrators Steps to set up administrators...22 How BES12 chooses which role to assign Creating and managing administrator groups Creating and managing administrators...24 Managing roles Secure Work Space Setting up Secure Work Space for ios and Android devices Managing devices that have a work space Upgrading work space apps...37 Test the Secure Work Space connection Recreating the Secure Work Space connection Work connections...39 Setting up work connections for devices Steps to set up work connections for devices...40 Managing work connections using profiles Best practice: Creating profiles Sending certificates to devices...43 Setting up work for devices Creating connection profiles... 52

4 Managing profiles Assigning profiles...63 How BES12 chooses which profiles to assign...64 Rank profiles View a profile Change profile settings Remove a profile from user accounts or user groups...66 Delete a profile Using variables Using variables in profiles Default variables...68 Custom variables Device standards...73 Setting your organization's standards for devices...74 Steps to set up your organization's standards for devices...74 Managing your organization's standards using profiles Enforcing compliance rules for devices Filtering web content on ios devices Limiting ios devices to a single app...79 Managing and web domains for ios 8 devices Creating organization notices to display on BlackBerry 10 devices...81 Displaying organization information on devices...82 IT policies...85 Controlling device capabilities using IT policies...86 Steps to manage IT policies...86 Restricting or allowing device capabilities...86 How BES12 chooses which IT policy to assign Creating and managing IT policies...88 Controlling BlackBerry OS device capabilities using IT policies...91 Steps to manage BlackBerry OS IT policies...91 Restricting or allowing BlackBerry OS device capabilities Preconfigured BlackBerry OS IT policies Assigning BlackBerry OS IT policies and resolving IT policy conflicts Deactivating BlackBerry OS devices that do not have IT policies applied Creating and managing BlackBerry OS IT policies...95 Apps... 99

5 Managing apps on devices Steps to manage apps Adding and deleting apps from the available app list Preventing users from installing specific ios, Android, and Windows Phone apps Managing app groups Managing Apple VPP accounts Change whether an app is required or optional View the status of apps and app groups assigned to user accounts View which apps are assigned to user groups Update the information in the available app list Set the organization name for BlackBerry World Managing apps on BlackBerry OS devices Managing apps on BlackBerry OS devices Preparing to distribute BlackBerry Java Applications Configuring application control policies Application control policies for unlisted applications Creating software configurations Install BlackBerry Java Applications on a BlackBerry OS device at a central computer View the users that have a BlackBerry Java Application installed on their BlackBerry OS devices Reconciliation rules for conflicting settings in software configurations Users and devices Managing user groups and user accounts Steps to create user groups and user accounts Creating and managing user groups Creating and managing user accounts Using filters to customize the users and devices view Managing device groups Steps to create and manage device groups Creating a device group View a device group Change the name of a device group Delete a device group Activating devices Steps to activate devices Requirements: Activation License requirements for activation types Controlling device activation settings using activation profiles...163

6 Manage default activation password expiration and length Turn off user registration with the BlackBerry Infrastructure Update the template for the activation Set an activation password and send an activation message Allowing users to set activation passwords Activate a BlackBerry 10 device Activate a BlackBerry OS device Activate an ios device Activate an Android device Activate a Windows Phone device Troubleshooting Managing devices Using dashboard reports Using IT administration commands to manage devices View and save a device report Verifying that a device is allowed to access work and organizer data Exchange Gatekeeping Deactivating devices Maintenance and monitoring Using log files Managing BES12 log files Finding log files Reading log files Auditing app activity on BlackBerry 10 and BlackBerry OS devices Viewing device actions Retrieving log files from devices Auditing actions in BES Configure audit settings View and filter the audit log Export the audit log to a.csv file Delete old audit records Using SNMP to monitor BES Profile settings profile settings Common settings BlackBerry 10 settings...203

7 ios settings Android settings Windows Phone settings SCEP profile settings Common settings BlackBerry 10 settings ios settings Wi-Fi profile settings Common settings BlackBerry 10 settings ios settings Android settings Windows Phone settings VPN profile settings BlackBerry 10 settings ios settings Product documentation Provide feedback Glossary Legal notice...263

8

9 Introduction Learn more about BES12 and how to use this guide.

10 Introduction About this guide 1 BES12 helps you manage the devices in your organization. This guide describes how to administer BES12, from creating administrators to getting your device users up and running to maintaining and monitoring BES12. This guide is intended for senior and junior IT professionals who are responsible for setting up and administering BES12. Before using this guide, a senior IT professional should configure the BES12 environment as described in the BlackBerry Enterprise Service 12 Configuration Guide. 10

11 Introduction What is BES12? 2 BES12 is an EMM solution from BlackBerry. EMM solutions help you do the following: Manage mobile devices for your organization to protect business information Keep mobile workers connected with the information that they need Provide administrators with efficient business tools With BES12, you can manage the following device types: BlackBerry 10 BlackBerry OS (version 5.0 to 7.1) ios Android Windows Phone You can manage these devices from a single, simplified UI with industry-leading security. Key features of BES12 Feature Management of many types of devices Single, unified UI Trusted and secure experience Balance of work and personal needs Description You can manage BlackBerry 10, BlackBerry OS (version 5.0 to 7.1), ios, Android, and Windows Phone devices. You can view all devices in one place and access all management tasks in a single, web-based UI. You can share administrative duties with multiple administrators who can access the management console at the same time. Device controls give you precise management of how devices connect to your network, what capabilities are enabled, and what apps are available. Whether the devices are owned by your organization or your users, you can protect your organization's information. BlackBerry Balance and Secure Work Space technologies are designed to make sure that personal information and work information are kept separate and secure on devices. If the device is lost or the employee leaves the organization, you can delete only work-related information or all information from the device. 11

12 Introduction About BES12 Self-Service 3 BES12 Self-Service is a web application that you can make available to users so that they can perform certain tasks such as creating activation passwords, locking devices, or deleting data from devices. Users do not need to install any software on their computers to use BES12 Self-Service. You must provide the BES12 Self-Service login information to users. You can send this information in an message, or edit the activation template to include the information. Users need the following information: Web address: The web address for BES12 Self-Service is displayed in the management console at Settings > Self- Service. Username and password: Company directory users can log in with their organization usernames and passwords. For local users, you must create the usernames and temporary passwords. Domain name: The domain name is required by Microsoft Active Directory users. 12

13 Introduction How to use this guide 4 The tasks in this guide are presented in a particular order to help get you up and running in the most efficient way, particularly if you are administering BES12 for the first time. You might not need to complete all of these tasks. You can choose to activate certain device types, separate work and personal data in different ways, or enforce different compliance rules, device capabilities, and connections. Steps to administer BES12 When you administer BES12, you perform the following actions. These actions are reflected in the sections of this guide. If you want to share administration work with other IT staff, set up administrators. Set up work connections (for example, , Wi-Fi, and VPN). Set up device standards (for example, compliance rules). Update the Default IT policy or create new IT policies. Determine which apps to send to devices. Create users and groups. Assign work connections, device standards, IT policies, and apps to users and groups. Help users activate their devices. Maintain and monitor BES12. 13

14 Introduction Examples of everyday administration scenarios The following scenarios provide examples of choices that you might make when setting up different devices for different users. Scenario Manage BlackBerry 10 devices for work and personal You might want to Create profiles for certificates Create a profile for single sign-on to secure work domains Create a profile for a proxy server Choose the "Work and personal - Corporate" or "Work and personal - Regulated" activation type Manage ios, Android, or Windows Phone devices with basic management Create profiles for work and work Wi-Fi Change the Default IT policy to enforce a device password Choose a work app to send to the device Choose the "MDM controls" activation type Manage BlackBerry OS (version 5.0 to 7.1) devices Change the Default BlackBerry OS IT policy to enforce a device password Resend the BlackBerry OS IT policy to devices Set up ios or Android devices with extra security for work data Create a profile for enterprise connectivity for extra security for data in transit Enable S/MIME for extra security Create a compliance profile to prevent access to work resources if the device is jailbroken or rooted Create a web content filter profile to limit the websites that the device user can access Set up Secure Work Space to separate and secure work data Secure an app to send to the device Set up BlackBerry 10 devices for work only Create profiles for certificates and VPN Enable S/MIME for extra security Create an IT policy to prevent the use of the device camera Choose the "Work space only" activation type Set up an ios device that is limited to one app for software demonstrations Create a single app mode profile 14

15 Introduction How to use the management console 5 The management console is the UI that you use to administer BES12. Set up administrators You can click Add user to add a user, and then use the settings to make the user an administrator. Set up work connections and device standards You can set up work connections and device standards using IT policies and profiles. Find users and devices 15

16 Introduction You can use filters to find the users and devices that you want to manage. Choose apps to send to devices You can add and manage apps and app groups, as well as view information about them. Create groups of users Groups simplify the management of users and devices. You can create groups to share IT policies, profiles, apps, and other configuration settings among similar users or devices. Assign IT policies, profiles, and apps to groups When you assign IT policies, profiles, and apps to a group, you assign the settings to all of the users in the group. 16

17 Introduction Help your users activate devices You can configure how you want devices to activate by using activation profiles and related settings. Users can then perform the activations themselves. Maintain and monitor BES12 With the dashboard, you can view information about BES12 and its users and devices. 17

18 Introduction When you view the details of a user's device, you can perform commands like resetting the password, locking the device, or deleting data. Log in to BES12 The management console allows you to perform administrative tasks for devices in your organization that are managed by BES12. Before you begin: Locate the web address (for example, and login information for the management console. You can find the information in the inbox of the account that is associated with your BES12 account. You must know the authentication method and the domain (applicable for Microsoft Active Directory authentication only). 1. In the browser, type the web address for the BES12 management console of your organization. 18

19 Introduction 2. In the Username field, type your username. 3. In the Password field, type your password. 4. If necessary, in the Sign in using drop-down list, do one of the following: Click Direct authentication. Click LDAP authentication. Click Microsoft Active Directory authentication. In the Domain field, type the Microsoft Active Directory domain. 5. Click Sign in. After you finish: You can change your login password by clicking the user icon in the top-right corner of the management console. 19

20

21 Administrators Set up administrators with permissions that are appropriate for their job responsibilities. Simple

22 Administrators Setting up administrators 6 Administrators are users that are assigned an administrative role by user group or user account. The actions that administrators can perform are defined in the role that is assigned to them. You can assign a preconfigured role or a custom role that you create. Each role has a set of permissions that specifies the information that administrators can view and the actions that they can perform in the BES12 management console. Roles help your organization to do the following: Reduce security risks associated with allowing all administrators to access all administrative options Define different types of administrators to better distribute job responsibilities Increase efficiency for administrators by limiting accessible options to their job responsibilities Steps to set up administrators When you set up administrators, you perform the following actions: If necessary, create a custom role. If necessary, rank the roles. Create a user group for administrators. Assign a role to a user group for administrators. Create a user account with an address and add it to an administrator group. How BES12 chooses which role to assign Only one role is assigned to each administrator. BES12 uses the following rules to determine which role to assign to an administrator: The role that is assigned directly to a user account takes precedence over a role that is assigned indirectly by a user group. If an administrator is a member of multiple groups that have been assigned a role, BES12 assigns the role that has a higher rank. You can specify the ranking of roles. 22

23 Administrators Creating and managing administrator groups Administrator groups are user groups that have a role assigned to them. You can assign a role to a directory-linked group or local group. A user can be a member of multiple administrator groups but is assigned only one role. For more information, see How BES12 chooses which role to assign. Only Security Administrators can add or remove members of a user group that has a role assigned to it. For more information about user groups, see Creating and managing user groups. Create an administrator group When you create an administrator group, you assign a role to a user group. Before you begin: You must be a Security Administrator to create an administrator group. Create a user group for administrators. Create a custom role, if necessary. 1. On the menu bar, click Settings. 2. In the left pane, expand Administrators. 3. Click Groups. 4. Click. 5. Search for and select the user group that you want to assign a role to. 6. In the Role drop-down list, click the role that you want to assign. 7. Click Save. BES12 sends the users an message with their username and a link to the management console. BES12 also sends the users a separate message with their password to the management console. If a user does not have a console password, BES12 generates a temporary password and sends it to the user. After you finish: To add users to the administrator group, add them to the user group that is assigned a role. For more information, see Creating and managing user groups Assign a different role to an administrator group Before you begin: You must be a Security Administrator to assign a different role to an administrator group. 1. On the menu bar, click Settings. 2. In the left pane, expand Administrators. 3. Click Groups. 4. Click the group of administrators whose role you want to change. 23

24 Administrators 5. In the Role drop-down list, click the role that you want to assign. 6. Click Save. Remove a role from an administrator group When you remove a role from an administrator group, the users in the group are no longer administrators (unless they have other roles assigned to them). The users and the user group remain in the management console. The users' devices are not affected. Before you begin: You must be a Security Administrator to remove a role from an administrator group. 1. On the menu bar, click Settings. 2. In the left pane, expand Administrators. 3. Click Groups. 4. Select the name of the administrator group that you want to remove a role from. 5. Click. 6. Click Delete. Creating and managing administrators You can create an individual administrator by assigning a role to a user account. Only one role can be assigned directly to a user account. For more information, see How BES12 chooses which role to assign. Create an administrator Before you begin: You must be a Security Administrator to create an administrator. Create a user account that has an address associated with it. Create a role, if necessary. 1. On the menu bar, click Settings. 2. In the left pane, expand Administrators. 3. Click Users. 4. Click. 5. Search for and select the user account that you want to assign a role to. 6. In the Role drop-down list, click the role that you want to assign. 7. Click Save. 24

25 Administrators BES12 sends the user an message with the username and a link to the management console. BES12 also sends the user a separate message with the password for the management console. If the user does not have a console password, BES12 generates a temporary password and sends it to the user. Assign a different role to an administrator You can change the role of another administrator. You cannot change your own role. Before you begin: You must be a Security Administrator to assign a different role to an administrator. 1. On the menu bar, click Settings. 2. In the left pane, expand Administrators. 3. Click Users. 4. Click the administrator whose role you want to change. 5. In the Role drop-down list, click the role that you want to assign. 6. Click Save. Remove a role from an administrator When you remove a role from an administrator, you remove the role that is assigned directly to the user account. If no other roles are assigned by user group, the user is no longer an administrator. The user can still be found in the management console and the user's devices are not affected. Before you begin: You must be a Security Administrator to remove a role from an administrator. 1. On the menu bar, click Settings. 2. In the left pane, expand Administrators. 3. Click Users. 4. Select the name of the administrator that you want to remove a role from. 5. Click. 6. Click Delete. Managing roles You can create roles and assign them to user accounts or user groups. When you assign a role, you grant administrator permissions to a user or user group. You must be a Security Administrator to create, view, change, rank, or assign roles. 25

26 Administrators Preconfigured roles In BES12, the Security Administrator role has full permissions to the management console, including creating and changing administrator users and roles. The Security Administrator role cannot be edited or removed. At least one administrator must be a Security Administrator. BES12 includes preconfigured roles in addition to the Security Administrator role. You can edit or remove all roles except the Security Administrator role. If you upgraded from BES5, the roles configuration from BES5 is copied to BES12. If you did not upgrade from BES5, the following preconfigured roles are available: Role Security Administrator Enterprise Administrator Senior HelpDesk Junior HelpDesk Description Full permissions All permissions except for creating and changing administrator users and roles Intermediate administrative tasks Basic administrative tasks Best practice: Reviewing the permissions of each role after upgrading from BES5 Review the permissions of each role after you upgrade from BES5. When you upgrade from BES5, the roles configuration in BES5 is copied to BES12. Because roles work differently in BES12, there may be permissions that you want to add or remove. Permissions for preconfigured roles The following tables list the permissions that are turned on for each preconfigured role in BES12. The Security Administrator role in BES12 has full permissions to the management console, including managing administrator users and roles. Note: If you upgrade from BES5, the role configuration from BES5 is copied to BES12. Roles that are copied may have similar names but different permissions. Users and devices Permission Enterprise Administrator Senior HelpDesk Junior HelpDesk View users and activated devices Create users Edit users Delete users Export user list 26

27 Administrators Permission Enterprise Administrator Senior HelpDesk Junior HelpDesk Generate an activation password and send Specify an activation password Specify console password Manage devices Specify device password Lock device and set message Unlock and clear password Delete only work data Delete all device data Specify work password and lock Groups Permission Enterprise Administrator Senior HelpDesk Junior HelpDesk View group settings Create and edit user groups Add and remove users from user groups Delete user groups Create and edit device groups Delete device groups Policies and profiles Permission Enterprise Administrator Senior HelpDesk Junior HelpDesk View IT policies and profiles Create and edit IT policies and profiles Delete IT policies and profiles Assign IT policies and profiles to users 27

28 Administrators Permission Enterprise Administrator Senior HelpDesk Junior HelpDesk Assign IT policies and profiles to user groups Assign IT policies and profiles to device groups Rank IT policies and profiles Apps Permission Enterprise Administrator Senior HelpDesk Junior HelpDesk View apps and app groups Create and edit apps and app groups Delete apps and app groups Assign apps and app groups to users Assign apps and app groups to user groups Assign apps and app groups to device groups View app licenses Create app licenses Edit app licenses Delete app licenses Assign app license to apps or app groups Restricted apps Permission Enterprise Administrator Senior HelpDesk Junior HelpDesk View restricted apps Create restricted apps Delete restricted apps 28

29 Administrators Settings Permission Enterprise Administrator Senior HelpDesk Junior HelpDesk View general settings Edit activation defaults Edit activation Edit console password settings Edit self-service console settings Edit default variables Edit custom variables View app management Edit BlackBerry World for Work Edit internal app storage Edit internal app distribution View external integration settings ios management Edit SMTP server settings Company directory settings Microsoft Exchange configuration View administrator users and roles View licensing summary Manage subscriptions Edit licensing settings View servers Edit servers Delete servers Manage servers 29

30 Administrators Permission Enterprise Administrator Senior HelpDesk Junior HelpDesk View audit settings Edit audit settings and purge data View migration settings Edit migration settings View BlackBerry Work Connect Notification Service settings Edit BlackBerry Work Connect Notification Service settings View server certificates Update server certificates Dashboard Permission Enterprise Administrator Senior HelpDesk Junior HelpDesk View dashboard Auditing Permission Enterprise Administrator Senior HelpDesk Junior HelpDesk View audit information BlackBerry OS permissions If you upgrade from BES5, the following additional permissions are available: View BlackBerry OS IT policies Create and edit BlackBerry OS IT policies Delete BlackBerry OS IT policies View jobs Edit jobs View default distribution settings for jobs Edit default distribution settings for jobs Manage job tasks 30

31 Administrators Change status of job tasks Custom roles If the preconfigured roles do not meet the needs of your organization, you can create custom roles for administrators. You can also create custom roles to restrict administrative tasks to a defined list of user groups. For example, you can create a role for new administrators that restricts their permissions to a user group for training only. Create a custom role Before you begin: You must be a Security Administrator to create a role. 1. On the menu bar, click Settings. 2. In the left pane, expand Administrators. 3. Click Roles. 4. Click. 5. Type a name and description for the role. 6. To copy permissions from another role, click a role in the Permissions copied from role drop-down list. 7. Perform one of the following tasks: Task Allow administrators in this role to search all company directories Allow administrators in this role to search selected company directories Steps 1. Select the All company directories option. 1. Select the Selected company directories only option. 2. Click Select directories. 3. Select one or more directories and click. 4. Click Save. 8. Perform one of the following tasks: Task Allow administrators in this role to manage all users and groups Allow administrators in this role to manage selected groups Steps 1. Select the All groups and users option. 1. Select the Selected groups only option. 2. Click Select groups. 3. Select one or more groups and click. 31

32 Administrators Task Steps 4. Click Save. 9. Select the permissions for administrators in this role. 10. Click Save. After you finish: If necessary, adjust the ranking of the role that you created. View the settings of a role Before you begin: You must be a Security Administrator to view the settings of a role. 1. On the menu bar, click Settings. 2. In the left pane, expand Administrators. 3. Click Roles. 4. Click the role that you want to view. Change the settings of a role You can change the settings of all roles except the Security Administrator role. Before you begin: You must be a Security Administrator to change the settings of a role. 1. On the menu bar, click Settings. 2. In the left pane, expand Administrators. 3. Click Roles. 4. Click the role that you want to change. 5. Click. 6. Type a name and description for the role. 7. Perform one of the following tasks: Task Allow administrators in this role to search all company directories Allow administrators in this role to search selected company directories Steps 1. Select the All company directories option. 1. Select the Selected company directories only option. 2. Click Select directories. 3. Select one or more directories and click. 32

33 Administrators Task Steps 4. Click Save. 8. Perform one of the following tasks: Task Allow administrators in this role to manage all users and groups Allow administrators in this role to manage selected groups Steps 1. Select the All groups and users option. 1. Select the Selected groups only option. 2. Click Select groups. 3. Select one or more groups and click. 4. Click Save. 9. Change the permissions for administrator users in this role. 10. Click Save. Delete a role You can delete all roles except the Security Administrator role. Before you begin: You must be a Security Administrator to delete a role. You must remove all administrators and administrator groups from the role that you want to delete. 1. On the menu bar, click Settings. 2. In the left pane, expand Administrators. 3. Click Roles. 4. Click the role that you want to delete. 5. Click. Ranking roles When an administrator belongs to more than one administrator group, the role that is ranked higher is assigned to the administrator. For example, if an administrator belongs to both Director and Supervisor administrator groups, and the Director role is ranked higher, the administrator is assigned the Director role. 33

34 Administrators After you create a custom role, the role is ranked lowest by default. You can adjust the ranking of roles to help BES12 choose which role to assign. For more information, see How BES12 chooses which role to assign. Rank roles Before you begin: You must be a Security Administrator to rank roles. 1. On the menu bar, click Settings. 2. In the left pane, expand Administrators. 3. Click Roles. 4. Use the arrows to move the roles up or down the ranking. 5. Click Save. 34

35 Secure Work Space Separate work data and personal data on ios and Android devices. Secure

36 Secure Work Space Setting up Secure Work Space for ios and Android devices 7 Secure Work Space is an option for providing extra security for work data on ios and Android devices. Secure Work Space is similar to the BlackBerry Balance feature on BlackBerry devices. Using containerization and app wrapping, Secure Work Space separates personal information from work information by creating a personal space and a work space on devices. You can choose whether you want administrative control of the entire device, or only the work space on a user's device. To set up Secure Work Space so that users can activate devices with a work space, you must complete the following tasks: Purchase Gold - Secure Work Space licenses Create an activation profile with the appropriate activation type and assign it to users or groups Send activation information to users When users activate their devices, they are prompted to set up a work space, create a work space password, and install the default work space apps. Managing devices that have a work space Having a work space on devices helps to keep work information separate and secure, and allows you to manage the work data on devices. Data that any of the apps in the work space use is saved securely and cannot be accessed outside of the work space. For more information about work space security, visit docs.blackberry.com/bes12 to see the BlackBerry Enterprise Service 12 Security Guide for ios, Android, and Windows Phone. If you assign the "Work and personal - full control" or "Work and personal - user privacy" activation type to user accounts, a work space is installed on the devices during activation and users are prompted to create work space passwords. To complete the work space setup, users must download the following apps on their devices: Device type Apps ios Work Connect: for , calendar, contacts, notes, and tasks Work Browser: for browsing Documents To Go: for securely viewing and editing work documents Android Work Space Manager: required to run the other work space apps on the device Secure Work Space: for , calendar, contacts, and browsing Documents To Go: for securely viewing and editing work documents 36

37 Secure Work Space The work space allows you to take advantage of the following features: Convert your organization's internal apps into secured apps that can be installed and run in the work space, or obtain secured apps from the App Store or Google Play. Use app lists and app groups to install and manage secured apps. For more information, see Adding and deleting apps from the available app list. Control specific behaviors of the work space on devices, such as password requirements and connection preferences, by applying an IT policy to user accounts. Use IT administration commands to reset the work space password or delete the work space on devices. Upgrading work space apps To support new features and more operating systems, BlackBerry posts new versions of the work space apps in the App Store and Google Play. Users should upgrade the work space apps when new versions become available. If users upgrade their device operating system and do not upgrade to the latest version of the work space apps, the work space may not function as expected. For more information about the supported device operating systems, visit docs.blackberry.com/bes12 to see the BlackBerry Enterprise Service 12 Compatibility Matrix. Test the Secure Work Space connection You can test the connection between BES12 and the Secure Work Space infrastructure at any time to verify that Secure Work Space is enabled. 1. On the menu bar, click Settings. 2. In the left pane, in the External integration section, click Secure Work Space. 3. Verify that Secure Work Space is enabled and the connection to the Secure Work Space infrastructure is Successful. 4. Optionally, click Test connection to test the work space connection. Recreating the Secure Work Space connection If the Secure Work Space connection to the BlackBerry Infrastructure is disabled, you must recreate the connection. For example, if you create a BES12 test environment that includes a virtual computer, BES12 instance, Secure Work Space, and BES12 database using an SRP ID and you decide to uninstall the BES12 test environment and create a BES12 production environment using the same SRP ID, you must recreate the Secure Work Space connection in the production environment because it contains a new virtual computer, BES12 instance, Secure Work Space, and BES12 database. The new production environment cannot connect to the BlackBerry Infrastructure because the original Secure Work Space connection that used the SRP ID used in the test environment still exists in the BlackBerry Infrastructure. 37

38 Secure Work Space Recreate the Secure Work Space connection 1. On the menu bar, click Settings. 2. In the left pane, in the External integration section, click Secure Work Space. 3. Click Recreate Secure Work Space tenant. In the Recreate Secure Work Space connection window, you are notified of the number of devices that require reactivation when you recreate the Secure Work Space connection. 4. Click Recreate. 5. Verify that Secure Work Space is enabled. After you finish: Make sure that users reactivate their ios and Android devices that use Secure Work Space. 38

39 Work connections Use profiles to configure work connections for BlackBerry 10, ios, Android, and Windows Phone devices. Multiplatform

40 Work connections Setting up work connections for devices 8 You can use profiles to set up and manage work connections for devices in your organization. A profile contains configuration information for devices and each profile type supports a particular configuration, such as settings, network settings, or certificates. You can specify settings for BlackBerry 10, ios, Android, and Windows Phone devices in the same profile and then distribute the configuration information to devices by assigning the profile to user accounts, user groups, or device groups. BES12 supports profiles and different types of certificate and connection profiles. You can use certificate profiles to specify the certificates that devices can use for authentication, and you can use and connection profiles to configure how devices connect to work resources, such as a work mail server and work Wi-Fi network. Steps to set up work connections for devices When you set up work connections for devices, you perform the following actions: If devices use certificate-based authentication to connect to work resources, create certificate profiles. Create and connection profiles to configure how devices connect to work resources in your organization's environment. If necessary, rank profiles. Assign profiles to user accounts, user groups, or device groups. Managing work connections using profiles You can manage work connections using the profiles available in the Policies and Profiles library. Certificate profiles You can use the following profiles to send certificates to devices: Profile CA certificate SCEP Description A CA certificate profile specifies a CA certificate that devices can use to establish trust with a work network or server. A SCEP profile specifies how devices obtain certificates used for authentication with a work network or mail server from your organization's CA using a SCEP service. 40

41 Work connections Profile Shared certificate Description A shared certificate profile specifies a client certificate that ios and Android devices can use to authenticate users with a work network or server. BES12 sends the same client certificate to every user that the profile is assigned to. To specify a different client certificate for each user, you can add a client certificate to a user account on the User summary tab and BES12 sends the certificate to the user's ios and Android devices. For more information, see Add a client certificate to a user account. and connection profiles You can use the following profiles to configure how devices connect to work resources: Profile Certificate retrieval OCSP CRL Single sign-on Proxy Enterprise connectivity Description An profile specifies how devices connect to a work mail server and synchronize data. A certificate retrieval profile specifies how BlackBerry 10 devices retrieve certificates from LDAP servers. An OCSP profile specifies the OCSP responders that BlackBerry 10 devices can use to check the status of certificates. A CRL profile specifies the CRL configurations that BES12 can use to check the status of certificates. A single sign-on profile specifies how devices authenticate with secure domains automatically after users type their username and password for the first time. A proxy profile specifies how devices use a proxy server to access web services on the Internet or a work network. An enterprise connectivity profile specifies whether secured apps on ios and Android devices with Secure Work Space must connect to a work network through the BlackBerry Infrastructure. Work apps on BlackBerry 10 devices use the BlackBerry Infrastructure if a work VPN or Wi-Fi connection is not available. BES12 includes a Default enterprise connectivity profile. VPN Wi-Fi A VPN profile specifies how devices connect to a work VPN. A Wi-Fi profile specifies how devices connect to a work Wi-Fi network. 41

42 Work connections Best practice: Creating profiles Some connection profiles can include one or more associated profiles. When you specify an associated profile, you link an existing profile to a connection profile, and devices must use the associated profile when they use the connection profile. Consider the following guidelines: Determine which work connections are required for devices in your organization. Create profiles that you can associate with other profiles before you create the connection profiles that use them. Use variables where appropriate. For more information, see Using variables in profiles. The following table lists profiles in the order that you should create them. You can associate profiles listed earlier with profiles listed later. For example, if you create a Wi-Fi profile first, you cannot associate a proxy profile with the Wi-Fi profile when you create it. After you create a proxy profile, you must change the Wi-Fi profile to associate the proxy profile with it. Profile Can associate with Applicable devices CA certificate VPN (BlackBerry 10 only) Wi-Fi BlackBerry 10 ios Android Windows Phone SCEP VPN Wi-Fi BlackBerry 10 ios Shared certificate VPN (ios only) Wi-Fi ios Android BlackBerry 10 ios Android Windows Phone Certificate retrieval BlackBerry 10 OCSP BlackBerry 10 CRL BlackBerry 10 42

43 Work connections Profile Can associate with Applicable devices Single sign-on BlackBerry 10 ios Proxy Enterprise connectivity VPN (BlackBerry 10 and ios) Wi-Fi (BlackBerry 10 and ios) BlackBerry 10 ios Android with Secure Work Space Enterprise connectivity BlackBerry 10 ios with Secure Work Space Android with Secure Work Space VPN Wi-Fi (BlackBerry 10 only) BlackBerry 10 ios Wi-Fi BlackBerry 10 ios Android Windows Phone Sending certificates to devices A certificate is a digital document issued by a CA that verifies the identity of certificate subject and binds the identity to a public key. Each certificate has a corresponding private key that is stored separately. The public key and private key form an asymmetric key pair that can be used for data encryption and identity authentication. A CA signs the certificate to verify that entities that trust the CA can also trust the certificate. Devices can use certificates to: Authenticate using SSL/TLS when connecting to webpages that use HTTPS Authenticate with a work mail server Authenticate with a work Wi-Fi network or VPN Encrypt and sign messages using S/MIME protection Many certificates used for different purposes can be stored on a device. You can use certificate profiles to send CA certificates and client certificates to devices. Related information Creating CA certificate profiles, on page 44 43

44 Work connections Creating SCEP profiles, on page 45 Creating shared certificate profiles, on page 46 Add a client certificate to a user account, on page 151 Creating CA certificate profiles You might need to distribute CA certificates to devices if your organization uses S/MIME or if the devices use certificate-based authentication to connect to a network or server in your organization s environment. When you send a CA certificate to a device, the device trusts the identity associated with any client or server certificate signed by the CA. When the certificate for the CA that signed your organization's network and server certificates is stored on devices, the devices can trust your networks and servers when they make secure connections. When the CA certificate that signed your organization's S/MIME certificates is stored on devices, the devices can trust the sender's certificate when a secure message is received. Many CA certificates that are used for different purposes can be stored on a device. You can use CA certificate profiles to send CA certificates to devices. Create a CA certificate profile Before you begin: You must obtain the CA certificate file that you want to send to devices. It must have a.der file name extension. 1. On the menu bar, click Policies and Profiles. 2. Click beside CA certificate. 3. Type a name and description for the profile. Each CA certificate profile must have a unique name. Some names (for example, ca_1) are reserved. 4. In the Certificate file field, click Browse to locate the certificate file. 5. If the CA certificate is sent to BlackBerry devices, specify one or more of the following certificate stores to send the certificate to on the device: Browser certificate store VPN certificate store Wi-Fi certificate store Enterprise certificate store 6. Click Add. Related information Assign a profile to a user account, on page 150 Assign a profile to a user group, on page

45 Work connections CA certificate stores on BlackBerry 10 devices CA certificates that are sent to BlackBerry 10 devices can be stored in different certificate stores, depending on the purpose of the certificate. Store Browser certificate store Description The work browser on BlackBerry 10 devices uses the certificates in this store to establish SSL connections with servers in your organization's environment. Devices that are running BlackBerry 10 OS version 10.0 also use the certificates in this store to authenticate S/MIME-protected messages that are received. VPN certificate store Wi-Fi certificate store Enterprise certificate store BlackBerry 10 devices use certificates in this store for VPN connections. You must set the "Trusted certificate source" setting in the VPN profile to "Trusted certificate store" to use the certificates in this store for work VPN connections. BlackBerry 10 devices use certificates in this store for Wi-Fi connections. You must set the "Trusted certificate source" setting in the Wi-Fi profile to "Trusted certificate store" to use certificates in this store for work Wi-Fi connections. Devices that are running BlackBerry 10 OS version 10.1 and later use certificates in this store to authenticate S/MIME-protected messages that are received. Creating SCEP profiles You can use a SCEP profile to specify how BlackBerry 10 and ios devices obtain certificates from your organization's CA through a SCEP service. SCEP is an IETF protocol that simplifies the process of enrolling certificates to a large number of devices without any administrator input or approval required to issue each certificate. Devices can use SCEP to request and obtain client certificates from a SCEP-compliant CA that is used by your organization. The CA that you use must support challenge passwords. The CA uses challenge passwords to verify that the device is authorized to submit a certificate request. Devices can use the certificates obtained using SCEP to connect to a work Wi-Fi network, work VPN, or work mail server. Android and Windows Phone devices do not support SCEP. Create a SCEP profile The required profile settings vary for each device type and depend on the SCEP service configuration in your environment. For more information about the profile settings for each device type, see SCEP profile settings. 1. On the menu bar, click Policies and Profiles. 2. Click beside SCEP. 3. Type a name and description for the profile. 4. In the URL field, type the URL for the SCEP service. The URL should include the protocol, FQDN, port number, and SCEP path. 45

46 Work connections 5. In the Instance name field, type the instance name for the CA. 6. In the SCEP challenge type list, select Static or Dynamic, and then specify the required settings for the challenge type. 7. Optionally, clear the check box for any device type that you do not want to configure the profile for. 8. Perform the following actions: a. Click the tab for a device type. b. Configure the appropriate values for each profile setting to match the SCEP service configuration in your environment. 9. Repeat step 8 for each device type in your organization. 10. Click Add. After you finish: If devices will use the certificate to authenticate with a work Wi-Fi network, work VPN, or work mail server, associate the SCEP profile with a Wi-Fi, VPN, or profile. Creating shared certificate profiles If your organization uses certificate-based authentication for connections to networks or servers in your environment, you may need to use BES12 to send client certificates to devices. Shared certificate profiles send a client certificate to all of the assigned users' ios and Android devices. The devices can present the client certificate for authentication to a network or server in your organization's environment. You should use shared certificate profiles only if you need to allow more than one user to share a client certificate. If your organization has a SCEP service, you can use SCEP profiles to distribute client certificates to BlackBerry 10 and ios devices. Alternatively, if you want to send a client certificate to Android or ios devices associated with only one user account, you can add a client certificate to a user account. Related information Add a client certificate to a user account, on page 151 Create a shared certificate profile Before you begin: You must obtain the client certificate file that you want to send to devices. It must have a.pfx or.p12 file name extension. 1. On the menu bar, click Policies and Profiles. 2. Click beside Shared certificate. 3. Type a name and description for the profile. Each shared certificate profile must have a unique name. Some names (for example, ca_1) are reserved. 4. In the Password field, type a password for the shared certificate profile. 5. In the Certificate file field, click Browse to locate the certificate file. 6. Click Add. 46

47 Work connections Related information Assign a profile to a user group, on page 138 Assign a profile to a user account, on page 150 Setting up work for devices You can use profiles to specify how devices connect to your organization's mail server and synchronize messages, calendar entries, and organizer data using Exchange ActiveSync or IBM Notes Traveler. If you want to use Exchange ActiveSync, you should note the following: If you require support for extended security, you can enable S/MIME for ios devices and S/MIME or PGP for BlackBerry 10 devices. PGP is supported by versions later than BlackBerry 10 OS version If you enable S/MIME for BlackBerry 10 devices, you can use additional profiles to allow devices to automatically retrieve S/MIME certificates and check certificate status. If you want to use Notes Traveler, you should note the following: To use Notes Traveler with ios or Android devices, you must enable Secure Work Space. To use Notes Traveler with BlackBerry 10 or Windows Phone devices, you must configure the appropriate settings in the profile. To Do data synchronization is only supported on BlackBerry 10 devices. It uses the SyncML communication protocol on the Notes Traveler server. If you require support for extended security on BlackBerry 10 devices, only IBM Notes encryption is supported (S/MIME is not supported). Create an profile The required profile settings vary for each device type and depend on the settings that you select. For more information about the profile settings, see profile settings. Before you begin: If you use certificate-based authentication for BlackBerry 10 or ios devices, create a CA certificate profile and assign it to users. For ios devices, you may also need to create a shared certificate profile or SCEP profile and associate it with the profile. BlackBerry 10 devices support SCEP profiles. ios devices support SCEP profiles and shared certificate profiles. To automatically apply an profile to Android devices, use any of the following options. If you do not use one of these options, BES12 still sends the profile to Android devices, but the user must manually configure the connection to the mail server: Set up Secure Work Space by activating Android devices using the "Work and personal - full control" or "Work and personal - user privacy" activation type. Install the TouchDown app on Android devices. For more information about the TouchDown app, visit nitrodesk.com. 47