BlackBerry UEM

Managing iOS devices

Administration

12.16

2022-06-17Z

||2

Contents

Managing iOS and iPadOS devices................................................................... 4

Managing other Apple devices..............................................................................................................................4

Managing apps ondevices..............................................................................14

App behavior on iOS devices with MDM controls activations..........................................................................14

App behavior on iOS devices with User privacy activations.............................................................................18

Activating iOS devices.................................................................................... 21

Activation types: iOS devices..............................................................................................................................21

Creating activation profiles................................................................................................................................. 23

Create an activation profile......................................................................................................................23

Activate an iOS or iPadOS device with the MDM controls activation type...................................................... 24

Activate an iOS or iPadOS device with Apple User Enrollment........................................................................ 25

Managing and monitoring activateddevices................................................... 27

||iii

your users, you can provide mobile access to your organization's information while protecting it from anyone who

should not have access.

Apple introduced iPadOS as a distinct operating system fromstarting with iPadOS version 13.Due to the

extensive similarities between iOS and iPadOS, almost all BlackBerry UEM features and documentation that apply

to iOS also apply to iPadOS.

This guide describes the options you have to manage iOS and iPadOS devices and helps you find the details you

need to take advantage of all available features.

Managing other Apple devices

You can also activate and manage macOS and Apple TV devices inBlackBerry UEM. Apple TV is a digital media

player that can receive data and stream it to a television over an HDMI cable.

• App lock mode profiles

• Device commands

To prevent users from activating Apple TV devices, set the device model restriction in the activation profile to not

allow anyApple TVdevices. For more information on activating macOS and Apple TV devices, see the Device

activation content.

|Managing iOS and iPadOS devices|4

fully managing the device.

Unmanaged and partially

managed devices

(devices that are

You can activate a device on BlackBerry UEM to provide secure access to work

resources without fully managing the device. This option is often used for BYOD

devices.

access work email and your work intranet.

Partially managed

deviceswith a work

profile

You can activate a device on BlackBerry UEM to provide secure access to work

resources within a work profile. This option is often used for BYOD devices.

With this activation type, a separate work space is created on the device for work

apps and the native Notes, iCloud Drive, Mail (attachments and full email bodies),

Calendar (attachments), and iCloud Keychain apps.

Managed devices

(devices that are

managed by BlackBerry

You can activate a deviceto be fully manged by BlackBerry UEM. This option is

often used for corporate-owned devices.

using BlackBerry Dynamics apps, such as BlackBerry Work and BlackBerry Access.You can choose to allow some

of the following device management features:

• Access to SIM card and device hardware information:Allow BlackBerry UEM access to SIM card and device

• App management: Allow administrators to install or remove work apps and display a list of installed work apps

• IT policy management: Allow a limited set of IT policy rules to be applied to the device (password policies,

• Email profile management: Allow email profiles to be applied to the device.

This activation type is supported on unsuperviseddevices that run iOS orand iPadOS 13.1 and later.

MDM controls activations provide full support for managing iOS devices, including the following features:

• Enforce password requirements

• Control device capabilities using IT policies (for example, disable the camera or Bluetooth)

• Enforce compliance rules

• Wi-Fi andVPN connection profiles (with proxy)

• Synchronize email, contacts, and calendar with devices

• Send CA and client certificates to devices for authentication and S/MIME

• Manage required and allowed public and internal apps, including BlackBerry Dynamics apps.

• Full support for Apple DEP and VPP

policy is active on a device at any time.

options provided by Apple.As Apple releases new OS updates with new features and configuration options, new

IT policy rules are added to UEM at the next possible opportunity.

available rules in UEM, including the minimum device OS that supports the rule.

• Allowing App Store and iTunes Store purchases, and allowable content ratings for purchases

• Allowing system apps, such as Safari, Siri,and FaceTime

• Allowing use of iCloud

Setting iOS and password requirements

You can choose whether iOS and iPadOS devices must have a password. If you require a password, you can set

the requirements for the password.

Note: iOS and iPadOS devices and some of the device password rules use the term "passcode." Both "password"

and "passcode" have the same meaning.

Password required for

device

Specify whether the user must set a device password.

Allow simple value Specify whether the password can contain repeated or sequential characters, such

complex characters

must contain.

Maximum passcode age Specify the maximum number of days that the password can be used.

Maximum auto-lock Specify the maximum value that a user can set for the auto-lock time, which is the

number of minutes of user inactivity that must elapse before a device locks. If set

to "None," all supported values are available on the device.If the selected value is

outside of the range supported by the device, the device will use the closest value

it supports.

Passcode history Specify the number of previous passwords that a device checks to prevent a user

Public apps

with an optional

disposition

If apps are

already

installedon

devices, the

User is notified

of a change to

the app catalog.

choose whether

apps.

iTunes notifies users

of available updates.

Apps are removed

from the "New/

Updated" list when

the user views the

Apps are

automatically

removedwithout

Apps no longer

appear in the app

Apps are removed

automatically.

|Managing apps ondevices|16

Internal apps

with a required

disposition

On supervised

devices, apps

are installed

the app

devices, user

is prompted to

install apps.If

apps are already

installed, user

is prompted

to allow UEM

to manage the

apps.If the user

cancels the

installation, they

from the app

the "New/

(even if the app

Apps are removed

from the "New/

Updated" list when

app.

Apps are

automatically

removedwithout

Apps no longer

appear in the app

Apps are removed

automatically.

|Managing apps ondevices|17

Internal apps

with an optional

disposition

If apps are

already

installedon

devices, the

Apps are

removed from

the "New/

Updated" list

when the user

views the details

(even if the app

is not installed),

or when the user

Apps are removed

from the "New/

Updated" list when

app.

Apps are

automatically

removed

activated with MDM

Apps are removed

automatically.

see Add the work app catalog to the BlackBerry Dynamics Launcher.

When you activate iOS and iPadOS devices with User privacy, you can choose whether to allow app management.

If you allow app management, app behavior for User privacy activations is the same as for MDM controls

activations. If you don't allow app management fordevices activated with User privacy, the following behavior

occurs:

|Managing apps ondevices|18

Apps are removed

from the "New/

Updated" list when

the user updates the

app. (can take up to

one hour)

For devices that

don't have access

to iTunes, users

Apps no longer

appear in the app

catalog.

with an optional

disposition

of available updates.

Apps are removed

from the "New/

device.

Apps no longer

appear in the app

device.

|Managing apps ondevices|19

Internal apps

with a required

disposition

Apps are removed

from the "New/

Updated" list when

app.

Apps remain on the

device.

Apps no longer

appear in the app

catalog.

Apps remain on the

device.

Internal apps

with an optional

disposition

Apps are removed

from the "New/

Updated" list when

the user updates the

app.

Apps remain on the

device.

Apps no longer

Apps remain on the

device.

|Managing apps ondevices|20

Configurator 2 in the Administration content

You can also enrolldevices in the Apple Device Enrollment Program and assign enrollment configurations to

as "Enable supervised mode," that are assigned to the devices during MDM enrollment. For more information, see

Activating iOS devices that are enrolled in DEP in the Administration content.

If devices are notenrolled in DEP, you can still prevent unsupervised devices from being activated using settings

in the activation profile.

Activation types: iOS devices

MDM controls This activation type provides basic device management using device controls

made available by iOS and iPadOS. A separate work space is not installed on the

device and there is no added security for work data.

You can control the device using commands and IT policies. During activation,

To specify whether BlackBerry UEM can limit activation by device ID, select Allow

User privacy You can use the User privacy activation type to provide basic control of devices

while making sure that users' personal data remains private. With this activation

type, no separate container is installed on the device, and no added security

for work data is provided. Devices activated with User privacy are activated on

BlackBerry UEM and can use services such as Find my Phone and Root Detection,

Note: For SIM-based licensing, you must select "Allow access to SIM card and

device hardware information to enable SIM-based licensing" in the activation

manage on the device based on the needs of your organization. You can choose

any of the following:

• Allow Email profile management: This option specifies whether to apply the

• Allow VPN profile management: This option specifies whether to apply the

User privacy - User

enrollment

You can use the User privacy - User enrollment activation type for iOS and iPadOS

devices to make sure that user data is kept private and separated from work data.

This activation type is supported on unsupervised iPhone and iPad devices that

run iOS and iPadOS 13.1 and later.

Device registration for

BlackBerry 2FA only

This activation type supports the BlackBerry 2FA solution for devices that

BlackBerry UEM does not manage. This activation type does not provide any

device management or controls, but allows devices to use the BlackBerry 2FA

feature. To use this activation type, you must also assign the BlackBerry 2FA

profile to users.

When a device is activated, you can view limited device information in the

management console, and you can deactivate the device using a command.

Creating activation profiles

over the personal data on a device that a user owns and brings to work.

The assigned activation profile applies only to devices the user activates after you assign the profile. Devices that

are already activated are not automatically updated to match the new or updated activation profile.

1. On the menu bar, click Policies and Profiles.

2. Click Policy > Activation.

4. Type a name and description for the profile.

7. Optionally, select an organization notice in the Assign organization notice drop-down list.If you assign an

8. In the Device types that users can activate section, select the device OS types that users can activate. Device

9. Perform the following actions for each device type included in the activation profile:

WERE FORESEEN OR UNFORESEEN, AND EVEN IF BLACKBERRY HAS BEEN ADVISED OF THE POSSIBILITY OF

THE LIMITATIONS, EXCLUSIONS, AND DISCLAIMERS HEREIN SHALL APPLY: (A) IRRESPECTIVE OF THE NATURE

CONTRACT, NEGLIGENCE, TORT, STRICT LIABILITY OR ANY OTHER LEGAL THEORY AND SHALL SURVIVE A

FUNDAMENTAL BREACH OR BREACHES OR THE FAILURE OF THE ESSENTIAL PURPOSE OF THIS AGREEMENT

OR OF ANY REMEDY CONTAINED HEREIN; AND (B) TO BLACKBERRY AND ITS AFFILIATED COMPANIES, THEIR

SUCCESSORS, ASSIGNS, AGENTS, SUPPLIERS (INCLUDING AIRTIME SERVICE PROVIDERS), AUTHORIZED

EMPLOYEE, AGENT, DISTRIBUTOR, SUPPLIER, INDEPENDENT CONTRACTOR OF BLACKBERRY OR ANY

AFFILIATES OF BLACKBERRY HAVE ANY LIABILITY ARISING FROM OR RELATED TO THE DOCUMENTATION.

providers might not offer Internet browsing functionality with a subscription to the BlackBerry

®

Internet Service.

Check with your service provider for availability, roaming arrangements, service plans and features. Installation

or use of Third Party Products and Services with BlackBerry's products and services may require one or more

other agreement with BlackBerry.

The terms of use of any BlackBerry product or service are set out in a separate license or other agreement with

BlackBerry applicable thereto. NOTHING IN THIS DOCUMENTATION IS INTENDED TO SUPERSEDE ANY EXPRESS

WRITTEN AGREEMENTS OR WARRANTIES PROVIDED BY BLACKBERRY FOR PORTIONS OF ANY BLACKBERRY

PRODUCT OR SERVICE OTHER THAN THIS DOCUMENTATION.

BlackBerry Enterprise Software incorporates certain third-party software. The license and copyright information

associated with this software is available at http://worldwide.blackberry.com/legal/thirdpartysoftware.jsp.

BlackBerry Limited

2200 University Avenue East

Waterloo, Ontario

Canada N2K 0A7

|Legal notice|32