Using gatekeeping to control which devices can access Microsoft ActiveSync
You can configure Microsoft Exchange to block devices from using Microsoft ActiveSync unless the devices are explicitly added to an allowed list in Microsoft Exchange. Using gatekeeping in BlackBerry Enterprise Service 10 lets you control which devices are added to the allowed list. When a device is added to the allowed list, a user can access work email and other information on the device.
To use gatekeeping for iOS and Android devices, you need to create a Microsoft ActiveSync configuration in the Universal Device Service. To use gatekeeping for BlackBerry devices, you need to create a Microsoft ActiveSync configuration in the Universal Device Service and you need to turn on gatekeeping in the BlackBerry Device Service.
When a user activates an iOS or Android device, and the device is compliant with your organization's security policies, the Universal Device Service pushes a Microsoft ActiveSync email profile to the device and automatically adds the device to the allowed list in Microsoft Exchange. If the Universal Device Service does not support the type of device, or if the device does not comply with the security policies of your organization, the device is not added to the allowed list in Microsoft Exchange. Instead, the device appears in the Universal Device Service console on the Microsoft Exchange Connections list. You can manually add devices from the Microsoft Exchange Connections list to the allowed list.
When a user activates a BlackBerry device, the device is automatically added to the allowed list in Microsoft Exchange. For existing users, you need to reassign the email profile to manually add the devices to the allowed list. If you remove the email profile from the user account the device is removed from the allowed list.