BlackBerry Persona Mobile
Administration Guide
2020-11-19Z
| | 2
Persona Mobile software requirements............................................................. |
4 |
Using the BlackBerry Persona Analytics Portal................................................. |
6 |
Steps to configure and use Persona Mobile...................................................... |
7 |
Enable Persona Mobile in your UEM domain...................................................................................................... |
7 |
Assign the BlackBerry Persona administrator role to an administrator............................................................. |
8 |
Specify how long Persona Mobile retains data................................................................................................... |
8 |
Customize the risk engines................................................................................................................................... |
9 |
Create user groups to define security standards for different risk levels....................................................... |
10 |
Create a BlackBerry Dynamics override profile................................................................................................. |
10 |
Add trusted or untrusted IP addresses.............................................................................................................. |
11 |
Define geozones................................................................................................................................................... |
11 |
Create a BlackBerry Persona policy................................................................................................................... |
12 |
Rank BlackBerry Persona policies........................................................................................................... |
14 |
Resolving conflicting assignments and precedence rules.................................................................... |
14 |
Assign a BlackBerry Persona policy to users and groups................................................................................ |
15 |
Create a BlackBerry Enterprise Identity authentication policy.......................................................................... |
16 |
Change the operating mode................................................................................................................................ |
17 |
Guidelines for developing risk models.................................................................................................... |
17 |
View user and event statistics........................................................................ |
19 |
Developing apps that leverage BlackBerry Persona......................................... |
20 |
Legal notice.................................................................................................... |
21 |
| | iii
Requirement |
Description |
|
|
BlackBerry UEM |
BlackBerry Persona Mobile is supported in: |
|
• BlackBerry UEM Cloud |
|
• BlackBerry UEM version 12.13 |
|
You must purchase BlackBerry Persona licenses to enable the service for |
|
users. Contact your BlackBerry representative or complete a contact form for |
|
more information. |
|
After BlackBerry applies the licenses, see Enable Persona Mobile in your UEM |
|
domain. |
|
For more information about configuring and managing UEM, see the |
|
BlackBerry UEM documentation. |
|
|
BlackBerry Persona |
After BlackBerry Persona licenses are added for your organization, you will |
entitlement |
receive a BlackBerry Persona entitlement. The entitlement information that |
|
you will see in the management console is: |
|
• App name: BlackBerry Persona entitlement |
|
• BlackBerry Dynamics entitlement ID: |
|
com.blackberry.entitlement.geoanalytics |
|
You must assign this entitlement to BlackBerry Dynamics app users so that |
|
Persona can receive and process behavioral and location data from the |
|
apps. You can assign the entitlement to all users, specific user groups, or |
|
specific user accounts based on your organization's needs. After assigning |
|
the entitlement, it may take up to 24 hours for the accounts and data to be |
|
ready. |
|
|
Enforcing BlackBerry 2FA |
If you want to use BlackBerry Enterprise Identity authentication profiles to |
authentication |
enforce BlackBerry 2FA authentication, you must enable BlackBerry 2FA for |
|
users' devices. For more information, see Steps to manage BlackBerry 2FA in |
|
BlackBerry UEM in the BlackBerry 2FA Administration content. |
|
|
| Persona Mobile software requirements | 4
|
Requirement |
Description |
|
|
|
|
|
|
|
|
BlackBerry Dynamics apps |
Use the following versions of BlackBerry Dynamics apps to ensure that the |
|
|
|
with the BlackBerry Analytics |
apps have the required versions of the BlackBerry Dynamics SDK and the |
|
|
|
SDK |
BlackBerry Analytics SDK: |
|
|
|
|
• BlackBerry Work version 3.2 or later |
|
|
|
|
• BlackBerry Tasks version 3.2 or later |
|
|
|
|
• BlackBerry Notes version 3.2 or later |
|
|
|
|
• BlackBerry Connect version 3.2 or later |
|
|
|
|
• BlackBerry Access version 3.1 or later |
|
|
|
|
• BlackBerry UEM Client for iOS (latest) |
|
|
|
|
• BlackBerry UEM Client for Android (latest) |
|
|
|
|
For more information about adding and distributing BlackBerry Dynamics apps |
|
|
|
|
in a UEM domain, see Managing BlackBerry Dynamics apps. |
|
|
|
|
Note: Within the settings of each BlackBerry Dynamics app, users can enable |
|
|
|
|
or disable Persona (by default, it is enabled). If it is disabled, Protect cannot |
|
|
|
|
collect data and events from the app. Encourage users to enable this setting |
|
|
|
|
to ensure that Persona can build and use an accurate risk model. |
|
|
|
|
|
|
|
|
Device connections to the |
For optimal performance, BlackBerry recommends permitting a direct |
||
|
Persona services |
connection between devices and the Persona services. In the BlackBerry |
||
|
|
Dynamics connectivity profiles that are assigned to users, in the App server |
||
|
|
section, add the BlackBerry Persona entitlement. Add the following app |
||
|
|
servers: |
||
|
|
• |
receiver.analytics.blackberry.com |
|
|
|
• |
discovery.bis.blackberry.com |
|
|
|
• |
scoring.bissanalytics.blackberry.com |
|
|
|
• |
service.bis.blackberry.com |
|
|
|
• |
actor.ca1.bis.blackberry.com |
For each app server, specify port 443, primary priority, and a direct connection.
Alternatively, you can manage device connections to the services using other configuration options available in the BlackBerry Dynamics connectivity profile. For more information, see Create a BlackBerry Dynamics connectivity profile in the UEM Administration content.
| Persona Mobile software requirements | 5
You configure and manage BlackBerry Persona using a browser-based console known as the BlackBerry Persona Analytics Portal. Persona administrators can use one of the following methods to access the portal:
•Browse to https://personaanalytics.blackberry.com/<Organization_SRP_ID>
•In the UEM management console, on the menu bar, click BlackBerry Persona > Analytics.
You use the UEM management console to enable BlackBerry Persona and to assign Persona administrator roles to users. You perform all other configuration and management tasks in the portal.
By default, privacy mode is enabled in the portal to mask exact information about user locations
from administrators. While enabled, the portal displays general location information for users and events instead of precise information such as a street address. Similarly, map views are zoomed out to provide accurate but nonintrusive location information. An administrator with the Persona Administrator role can disable (or re-enable) privacy mode in Settings > General settings > Privacy mode (this action is written to the log file). Administrators with the Persona Analytics Administrator role cannot change the privacy mode.
| Using the BlackBerry Persona Analytics Portal | 6
The tasks in this section must be completed by a UEM administrator with the Security Administrator role.
Step Action
Enable Persona Mobile in your UEM domain.
Assign the BlackBerry Persona administrator role to an administrator.
Optional customization:
•Specify how long Persona Mobile retains data
•Customize the risk engines
Create UEM user groups that you will associate with risk levels.
Optional: Define geozones to enforce security standards for specific locations.
Create a BlackBerry Persona policy.
Assign a BlackBerry Persona policy to users and groups.
Create a BlackBerry Enterprise Identity authentication policy to set the authentication requirements for different risk levels. Assign the policy to users and groups.
Change the operating mode.
View user and event statistics.
Before you begin:
•Contact your BlackBerry representative to purchase Persona Mobile licenses. After BlackBerry adds the licenses for your organization, complete the steps below.
•If you decide to use BlackBerry Persona in trial mode before you purchase licenses, follow the instructions provided by BlackBerry to enable the feature in a new or existing UEM instance. If you set up a new UEM instance, see the UEM documentation for installation and configuration instructions. After your trial period ends, you can purchase and add BlackBerry Persona licenses to the UEM domain.
| Steps to configure and use Persona Mobile | 7