BlackBerry Enterprise Service 10. Universal Device Service Version: Administration Guide

Transcription

1 BlackBerry Enterprise Service 10 Universal Service Version: 10.2 Administration Guide

2

3 Published: SWD

4

5 Contents 1 Introduction...9 About this guide...10 What is BlackBerry Enterprise Service 10?...10 Key features of BlackBerry Enterprise Service About the Universal Service Using the Universal Service console Log in to the Universal Service console About BES10 Self-Service Setting up administrator accounts...15 Administrative roles and permissions...16 Administrator permissions...16 Create an administrator account Setting up device controls...21 Creating and assigning profiles...22 Using variables Use custom variables Sending certificates to devices Setting up encrypted using S/MIME Create a CA certificate profile Create a client certificate profile for SCEP Create a client certificate profile for a shared certificate Create a user certificate profile and assign it to a user account Controlling how devices can connect to your organization's network Create a Microsoft ActiveSync profile...28 Create a Wi-Fi profile Create a VPN profile Routing data for ios devices through a proxy server Create a global HTTP proxy profile for ios devices...33 Enforcing compliance rules Assigning and reconciling compliance profiles Change the default compliance profile...35 Create a compliance profile Update the template for the device compliance notification Returning devices to compliance...39 Controlling how ios and Android devices are activated and managed...40

6 Change the default activation type...41 Create an activation type profile...41 What is the BES12 Client?...41 Managing devices that have a work space...42 Upgrading work space apps Controlling the capabilities of devices Create an IT policy...43 Create a work space IT policy Routing data for the work browser through a proxy server...44 Create a proxy profile for Secure Work Space Managing app availability on devices...46 Create an application definition Create a software configuration Assign a software configuration to a user account Assign a software configuration to a group View whether work apps are installed on a device...48 Installing apps in the work space Managing groups and user accounts...53 Creating and managing groups...54 Create a group Change the properties of a group Assign an account to a group...55 Remove an account from a group Assign an IT policy to a group...56 Assign a profile to a group...56 Synchronizing groups with Microsoft Active Directory...56 Creating and managing user accounts...58 Add a user account View a user account Assign an IT policy to a user account...60 Assign a profile to a user account...60 Edit user account information...60 Change the device activation password for a user Activating and managing devices Activating devices Configure the default settings to activate a device Update the template for the activation message Send an activation message Activate an ios device Activate an Android device... 67

7 Setting an activation password using BES10 Self-Service Managing devices Using IT administration commands to manage devices Users with multiple devices Jailbroken or rooted status Disable new device activations Change the device ownership setting...71 View and save a device report...71 View device communication logs Deactivating devices Maintaining and monitoring Check the status of the BlackBerry Secure Connect Service...74 Logging...74 Log files Audit logs IT policy rules s of IT policy rules Browser policy group...78 Camera and video policy group...80 Certificates policy group Cloud service policy group...83 Connectivity policy group...85 Content policy group Diagnostics and usage policy group Encryption policy group Lock screen policy group Messaging policy group Online store policy group Password policy group...98 Phone and messaging policy group Profiles and certificates policy group Security policy group Social policy group Storage and backup policy group Voice assistant policy group s of work space IT policy rules Allow sequential and repeated character passwords rule Require letters rule Require lowercase letters rule Require numbers rule...116

8 Require special characters rule Require uppercase letters rule Restrict password length rule Minimum length for the work space password rule Maximum length for the work space password rule Maximum password history rule Lock work space when device locks rule Lock device after inactivity in work space rule Lock work space after inactivity rule Track incorrect password attempts rule Action after maximum incorrect password attempts rule Enable plugins in secure browser rule Deactivate device after period of inactivity rule Work Connect contacts rule Allow apps in the personal space to access files in the work space rule Notification level rule Allow S/MIME rule Product documentation Provide feedback Glossary Legal notice...135

9 Introduction Chapter 1 Introduction Topics: About this guide What is BlackBerry Enterprise Service 10? About the Universal Service About BES10 Self-Service

10 Introduction About this guide The Universal Service allows you to manage ios devices and Android devices in your organization's environment. This guide provides instructions on how to manage user accounts and devices after the Universal Service is installed and configured. This guide is intended for IT professionals who are responsible for activating devices and managing user accounts. Before you can use the tasks in this guide, you need to complete the tasks to configure the Universal Service. You can find instructions on configuring the Universal Service in the BlackBerry Enterprise Service 10 Configuration Guide. What is BlackBerry Enterprise Service 10? BlackBerry Enterprise Service 10 helps you manage mobile devices for your organization. You can manage BlackBerry devices and BlackBerry PlayBook tablets, as well as ios and Android devices, all from a unified interface. BlackBerry Enterprise Service 10 is designed to help protect business information, keep mobile workers connected with the information they need, and provide administrators with efficient tools that help keep business moving forward. BlackBerry Enterprise Service 10 includes the following components: Component BlackBerry Service Universal Service Provides advanced administration for BlackBerry 10 devices and BlackBerry PlayBook tablets Provides advanced administration for ios and Android devices BlackBerry Management Studio Provides a unified interface to administer common tasks for BlackBerry 10 devices, BlackBerry PlayBook tablets, BlackBerry 7.1 and earlier devices, ios devices, and Android devices BES10 Self-Service Provides a console to users so that they can perform some self-service tasks. For example, users can create activation passwords, remotely change the password on their device, or delete data from the device. Key features of BlackBerry Enterprise Service 10 The table below describes some of the key features for BlackBerry Enterprise Service

11 Introduction Feature Management of most types of devices Single, unified interface Trusted and secure experience Balance of work and personal needs BlackBerry Enterprise Service 10 supports all types of BlackBerry devices and tablets, as well as ios devices and Android devices. BlackBerry Management Studio is a single, web-based interface where you can view all devices in one place and access the most common management tasks across multiple domains. These tasks include creating and managing groups, managing device controls, and activating mobile devices. controls give you precise management of how devices connect to your network, what capabilities are enabled, and what apps are available. Whether the devices are owned by your organization or your users, you can protect your organization's information. BlackBerry Balance and Secure Work Space technology are designed to ensure that personal and work information are kept separate and secure on devices. If the device is lost or the employee leaves the organization, you can delete only work-related information or all information from the device. Additional security features are available depending on the device type. About the Universal Service The Universal Service is designed to permit you to manage devices that run ios or Android OS in your organization's environment. If you activate devices using the Universal Service, you can use the Universal Service to: Manage devices using the IT policies and IT administration commands that the devices support Configure profiles for devices so that you can control the connections to your organization's environment Assign activation type profiles to user accounts to control how devices are managed Provision and manage work applications on devices View the device inventory for your organization To provide a single interface for helpdesk administrators to manage all the devices in your organization's environment, you can connect BlackBerry Management Studio to the Universal Service. 11

12 Introduction Using the Universal Service console Feature Drag and drop functionality User list Required fields Available settings Online help When viewing a group or user account, you can quickly apply IT policies, profiles and software configurations using drag and drop functionality. In the user list, each row is a link that you can click to view the properties of the user account. You can sort and reverse sort the information in the user list by clicking any of the column headers. To display user accounts with multiple devices, sort by user. Fields that have a red asterisk (*) beside them are required. You must submit a value in all required fields to complete a task. Default values, which you can customize, are often displayed in the fields. In the Available Settings pane, you can view the number of users that are assigned to an IT policy, profile, or software configuration. The value shown represents the number of unique users that are assigned to a particular policy, profile, or software configuration. The user is not counted twice if they are assigned directly and by group assignment. Click the Help link in the upper-right corner of the screen to access online help. The online help is updated regularly to provide the most recent information. Log in to the Universal Service console Also known as the Administration Console, the Universal Service console allows you to manage the Universal Service and the user accounts associated with it. To open the Administration Console, you can use a browser on any computer that has access to the computer that hosts the Administration Console. When you install BlackBerry Enterprise Service 10, you specify the username and password that you use to log in for the first time. 1. In the browser, type where <server_name> is the FQDN of the computer that hosts the Administration Console. The default port for the Administration Console is port In the Username field, type your username. 3. In the Password field, type your password. 4. Click Log in. 12

13 Introduction About BES10 Self-Service BES10 Self-Service is a web-based application that you can make available to users so that they can perform certain tasks such as creating activation passwords, remotely locking their devices, or deleting data from their devices. Users do not need to install any software on their computers to use BES10 Self-Service. You must provide the BES10 Self-Service web address and login information to users. You can send this information in an message, or edit the activation template to include the information. Provide the following information: Web address. The web address for BES10 Self-Service is where <server_name> is the FQDN of the computer that hosts the console, and 7445 is the default port. You can change the port in the BES10 Configuration Tool. Username and password. Company directory users can log in with their organization usernames and passwords. For local users that have BlackBerry 10 devices, you must create their usernames and passwords in the BlackBerry Service. Local users that have ios or Android devices cannot use BES10 Self-Service. Domain name (for Microsoft Active Directory users) 13

14

15 Setting up administrator accounts Chapter 2 Setting up administrator accounts Topics: Administrative roles and permissions Create an administrator account

16 Setting up administrator accounts Administrative roles and permissions When you create administrator accounts, you assign roles to the accounts so that you can control who can perform tasks in the Universal Service. Each role has a set of associated permissions. Permissions specify the information that you can view and the tasks that you can perform using the Administration Console. Each action that you perform in the Administration Console is associated with a specific permission. Assign the Security role to the administrator account that you use to change other administrator account permissions. Related information Create an administrator account, 18 Administrator permissions Each role contains multiple permissions that are turned on. The roles make sure that administrators who do not have specific administrative permissions cannot escalate their permissions. For example, junior helpdesk administrators cannot escalate their roles to senior helpdesk administrator roles. Permission Security role Enterprise role Senior Helpdesk role Junior Helpdesk role Create a group Delete a group View a group Edit a group Add user to a group Create a user Delete a user View a user Edit a user Assign an administrative role View a device 16

17 Setting up administrator accounts Permission Security role Enterprise role Senior Helpdesk role Junior Helpdesk role Edit a device Specify device ownership Specify an activation password Generate an activation View device activation settings Edit device activation settings Create an IT policy Delete an IT policy View an IT policy Edit an IT policy Assign an IT policy or a profile to a user Create a software configuration View a software configuration Edit a software configuration Delete a software configuration Create an application definition View an application Edit an application Delete an application Assign a software configuration to a user Delete all device data and remove device Delete only the organization data and remove device 17

18 Setting up administrator accounts Create an administrator account Before you begin: If you configured the Universal Service to connect to a company directory, you can add an administrator account directly from your organization's list of users. If you did not configure these settings, you can create local administrator accounts only. 1. In the left pane, beside Administrators, click the + icon. 2. In the Add a user window, perform one of the following tasks: Task Add an administrator account from the company directory. If you have not configured the Universal Service to connect to a company directory, the Directory tab is not shown. Create a local administrator account. Steps 1. On the Directory tab, search for an administrator account. 2. In the Name drop-down list, select the administrator account. 3. If you want to add the administrator account to a group, in the Group membership drop-down list, select a group. 4. To specify if this administrator will use a work or personal device, in the ownership drop-down list, select an option. 5. Verify that the Administrator account check box is selected. 6. In the Administrator role drop-down list, select a role for the administrator. 1. Select the Local tab. 2. Specify the administrator details. 3. If you want to add the administrator account to a group, in the Group membership drop-down list, select a group. 4. To specify if this administrator will be using a corporate or personal device, in the ownership drop-down list, select an option. 5. Verify that the Administrator account check box is selected. 6. Type a password. 7. In the Administrator role drop-down list, select a role for the administrator. 3. To specify device activation settings for the administrator account, in the Activation section, select Enable new device activations. 4. Select one of the following options: Use directory password to allow the administrator to use the company directory password to activate a device. Specify an activation password to specify a password that the administrator must enter to activate a device. 18

19 Setting up administrator accounts 5. To specify when the activation password expires, select a time and date in the Activation expiration (date) and Activation expiration (time) fields. If you do not specify an expiration date and time, the activation password will never expire. 6. To specify a maximum number of activation attempts the administrator is allowed to make before the device is locked, in the Maximum number of activations per device field, type a value. 7. To specify a maximum number of devices the administrator is allowed to have associated with this user account, in the Maximum number of devices to activate field, type a value. 8. To specify the device platforms that are supported, select Permitted devices and select one or more platforms. 9. To specify the device versions that are supported, in the drop-down list, select one or more versions. 10. To send an message that contains the information that the administrator requires to activate the device, select Send activation If you are using custom variables, click the arrow beside Custom Variables and fill in the fields. 12. Do one of the following: To save this administrator account and create another, click Save & New. To save this administrator account, click Save. Related information Administrative roles and permissions, 16 19

20

21 Setting up device controls Chapter 3 Setting up device controls Topics: Creating and assigning profiles Using variables Sending certificates to devices Controlling how devices can connect to your organization's network Routing data for ios devices through a proxy server Enforcing compliance rules Controlling how ios and Android devices are activated and managed Controlling the capabilities of devices Routing data for the work browser through a proxy server Managing app availability on devices

22 Setting up device controls Creating and assigning profiles You can use profiles to define the settings on devices. After you create profiles, you can assign them to a user account or to a group of user accounts. Profile VPN Wi-Fi Microsoft ActiveSync Global HTTP proxy CA certificate Client certificate User certificate Compliance Activation type Work space HTTP proxy Allows you to specify how devices connect to your organization's VPN Allows you to specify how devices connect to your organization's Wi-Fi network Allows you to specify how devices connect to your organization's messaging server and synchronize messages and organizer data using Microsoft ActiveSync Allows you to direct all HTTP traffic to and from the personal space on ios devices through a proxy server behind your organization s firewall. Supported for ios devices that run ios 6.0 or later and are supervised using Apple Configurator Allows devices that use certificate-based authentication to trust network or server certificates in your organization's environment Allows you to provide client certificates to users' devices using SCEP or a shared certificate Allows you to assign a client certificate to an individual user account and send the certificate file to the user's devices Allows you to set conditions that require or restrict apps and restrict jailbroken or rooted devices Allows you to specify how a device is managed after a user activates it. The profile applies only to the next device that a user activates, and not to any currently activated devices. Allows you to direct all HTTP traffic for the work browser on supported ios and Android devices through a proxy server behind your organization s firewall Using variables You can use variables and custom variables to replace user account attributes and other attributes in the activation template and in profiles. Note: You cannot use variables in the template for the device compliance notification. 22

23 Setting up device controls The following table lists the variables that are available to use in the Universal Service. Variable %DisplayName% %User Address% %UserName% %ActivationExpirationFinish% %ActivationPassword% %BSCAddress% %SRPID% %BSCAddress%/%SRPID%/ca %EnterpriseAppStoreURL% %SSLCertCommon% %SSLCertSHA% %Custom1%, %Custom2%, %Custom3%, %Custom4%, %Custom5% User's display name User's address User's username Date and time when the activation password expires Activation password that you created for the user Server address of the BlackBerry Secure Connect Service Unique SRP identifier for each BlackBerry Enterprise Service 10 instance Internal web address where users can download the SSL certificate for the Communication Module Internal web address where users with ios devices that are activated with user privacy, can download work apps. Common Name of the SSL certificate for the Communication Module Fingerprint of the SSL certificate for the Communication Module You can use up to five different variables for user attributes that you define. For security reasons, you should not use a custom variable for a password. Related information Update the template for the activation message, 65 Use custom variables Use custom variables to define your own user attributes in addition to the standard user attributes such as display name, contact , and work phone number. You can use custom variables in the same way that you use other variables in the activation template or when you create profiles. Note: For security reasons, you should not use a custom variable for a password. For example, for local users, a user's ActiveSync username might not be the same as their local account username, so you can use a custom variable to represent the ActiveSync username. In this example, Custom variable 1 is defined as the ActiveSync username. 1. Search for a user account. 2. In the search results, click the name of a user account. 3. Click the edit icon. 23

24 Setting up device controls 4. Expand Custom Variables. 5. In the Custom variable 1 field, type the user's ActiveSync username. Click Save. 6. When you create a Microsoft ActiveSync profile, type %Custom1% in the username field. Sending certificates to devices A certificate is a digital document that binds the identity and public key of a certificate subject. Each certificate has a corresponding private key that is stored separately. A CA signs the certificate to verify that it can be trusted. A device can use certificates to: Authenticate using SSL/TLS when it connects to web pages that use HTTPS Authenticate with a work messaging server Authenticate with a work Wi-Fi network or VPN Encrypt and sign messages using S/MIME protection Many certificates that are used for different purposes can be stored on a device. You can use certificate profiles to send client certificates and CA certificates to devices. Setting up encrypted using S/MIME You can extend security for ios and Android device users by permitting users to send and receive S/MIME-protected messages. You cannot force users to use S/MIME. There are two types of S/MIME protection available: S/MIME for the native ios app. You enable this type of S/MIME in a Microsoft ActiveSync profile. S/MIME for the ios and Android apps in the work space. You enable this type of S/MIME in a work space IT policy. To use either type of S/MIME, a user must enable S/MIME on the device and specify whether to encrypt, sign, or encrypt and sign s. Users must store their private keys and a certificate for each recipient that they want to send an encrypted message to on their devices. Users can store a key and certificates by importing the files from an message. Create a CA certificate profile You can use CA certificate profiles to distribute CA certificates to devices if the devices use certificate-based authentication to connect to a network or server in your organization s environment. When a device has the certificate for the CA that signed a server certificate, the device recognizes and trusts the server certificate. The CA certificate has a.cer,.crt, or.der file name extension. 24

25 Setting up device controls Note: You cannot send CA certificates to devices that are activated with the "Work and Personal - User Privacy" activation type. 1. On the menu bar, click Library. 2. In the CA certificate pane, click the + icon. 3. In the Certificate name field, type a name for the CA certificate profile. Each CA certificate profile must have a unique name. Some names (for example, ca_1) are reserved by default. 4. In the Certificate description field, type a description for the CA certificate profile. 5. In the Certificate file field, click Browse to specify the location of the certificate file. 6. Click Save. Related information Assign a profile to a group, 56 Assign a profile to a user account, 60 Create a client certificate profile for SCEP You can use a client certificate profile for SCEP to specify how devices obtain certificates from your organization's CA. SCEP is a protocol that is used to automate the submission of certificate requests to a SCEP service and issue client certificates to supported devices. s use the certificates to authenticate with your organization's servers. Android devices do not support SCEP. Before you begin: If you want the Universal Service to use a dynamic password obtained from an external SCEP service, configure the external SCEP settings. For instructions, see Configure the external SCEP settings. 1. On the menu bar, click Library. 2. In the Shared certificate pane, click the + icon. 3. In the Certificate name field, type a name for the profile. 4. In the Certificate description field, type a description for the profile. 5. In the Certificate source drop-down list, click SCEP. 6. If the certificates need a subject alternative name, perform the following actions: a. In the Alternative subject name type drop-down list, click the appropriate type. b. In the Alternative representation of the certificate subject field, type the subject alternative name. The value must be an address, the DNS name of the CA server, or the fully qualified URL of the server. c. In the NT principal name for certificate generation field, type the user principal name. 7. If your CA uses HTTP instead of HTTPS, in the Fingerprint for enrolling a SCEP certificate field, paste the CA certificate fingerprint. s use the fingerprint to confirm the identity of the CA during the enrollment process. 25

26 Setting up device controls 8. If you want to permit users to use the certificate for digital signatures, select the Use the generated certificate for digital signatures check box. 9. If you want to permit users to use the certificate for encryption, select the Use the generated certificate for key encipherment check box. 10. In the Key size for certificate generation field, type the key size. The default value is If necessary for your organization's SCEP configuration, in the Subject field, type CN=<common_name>,O=<domain_name>. 12. If you want to permit devices to retry the server connection if the first attempt fails, perform the following actions: a. Select the Retry SCEP connection check box. b. In the Number of times SCEP connection should be retried field, type the type the number of times that devices can try to connect. c. In the Time in seconds before the SCEP connection should be retried field, type number of seconds that devices should wait between each attempt. 13. If you want to proxy SCEP requests from devices through the Universal Service, select the Proxy SCEP requests through the Universal Service check box. 14. In the SCEP server configuration type drop-down list, perform one of the following actions: If you want the system to use the external SCEP settings that you configured, click External. If you want to specify the SCEP settings, click Defined. 15. If you selected Defined in step 14, perform the following actions: a. In the CA-IDENT attribute of the SCEP configuration field, type the name of the CA. b. In the Pre-shared secret type to use in certificate generation drop-down list, click None or Plain text. If you select Plain text, type the pre-shared secret. c. In the Base URL of the SCEP server field, type the URL of the SCEP server. 16. Click Save. Related information Assign a profile to a group, 56 Assign a profile to a user account, 60 Configure the external SCEP settings You can configure external SCEP settings that allow the Universal Service to request a dynamic password from the SCEP service. The Universal Service injects the password into the client certificate profile for SCEP when it sends the profile to devices. The default service type for the external SCEP is MSCA-NDES. 1. On the menu bar, click Settings. 2. In the External Integration pane, click External SCEP. 26

27 Setting up device controls 3. Select the Enable SCEP check box. 4. In the Authentication type drop-down list, click the appropriate authentication type. 5. If you selected NTLM authentication, in the Domain of the credentials for the external SCEP service field, type the domain of the external SCEP service. 6. In the Username field, type the user name for the external SCEP service. 7. In the Password field, type the password for the external SCEP service. 8. In the URL for generating the challenge secret key of the directory field, type the URL. 9. In the CA-IDENT attribute field, type the CA-IDENT attribute of the external SCEP service. 10. In the URL for enrollment requests of the directory field, type the URL. 11. Click Save. Create a client certificate profile for a shared certificate You can use a client certificate profile for a shared certificate to send the same client certificate to multiple devices. The devices present the client certificate for authentication to a network or server in your organization's environment. You might want to use this profile to distribute certificates when your environment or users' devices do not support SCEP. The client certificate has a.pfx file extension. 1. On the menu bar, click Library. 2. In the Shared certificate pane, click the + icon. 3. In the Certificate name field, type a name for the profile. Each client certificate profile for a shared certificate must have a unique name. Some names (for example, ca_1) are reserved by default. 4. In the Certificate description field, type a description for the profile. 5. In the Certificate source drop-down list, click File. 6. In the Certificate file field, click Browse to specify the location of the certificate file. 7. In the Password field, type a password for the profile. 8. Click Save. Related information Assign a profile to a group, 56 Assign a profile to a user account, 60 27