Source
r/Intune•
Compkriss

Blackberry UEM Access App replacement with Intune

Good morning,

Just wondering if anyone on here has moved from the Blackberry UEM applications to Intune and if so how did you tackle the Access app?

For those that aren't familiar with it the Access app is a browser that allows intranet access. As the UEM service is an on-prem one it creates a tunnel to that via the Blackberry infrastructure to access the internal facing network.

We'll be moving to Intune in the near future and this is really the only big gap I can see between the two. My initial thoughts are to deploy Edge with a per app VPN policy then secure the connection with ACLs internally to the organizations intranet sites.

Has anyone else come across this before?

Thanks!

Posted Oct 30, 2020, 1:35 PM UTC

16
jasonsandysVerified Microsoft Employee•

There are two main options here provide by Microsoft:

- Azure App Proxy: https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/application-proxy

- Microsoft Tunnel: https://docs.microsoft.com/en-us/mem/intune/protect/microsoft-tunnel-overview

1
CompkrissOP•

Thank you! The MS Tunnel looks pretty much like what I was thinking of, just with a Cisco ASA VPN appliance that we already have in place. The app proxy looks interesting though, looks like I have some reading to do.

1
jwckauman•

Can I ask why you are switching to Intune for intranet access? is it because you are hoping you won't need BlackBerry UEM anymore? Does UEM offer any other services to your company? We use UEM primarily for BlackBerry Work, so users can securely use email on their mobile device. It creates a secure container on the user's mobile device that we can remotely wipe without wiping the entire phone. Are y'all using anything like that as well?

1
CompkrissOP•

We’re moving away from UEM completely to Intune. Intranet access using BB Access was just one of the features we used.

We’re moving as the Outlook client is far better (from a user perspective) than BB Work, couple that with Teams and the SharePoint client and it’s a really easy decision.

1
jwckauman•

One of the requirements that UEM satisfied was an "encrypted container" on the mobile device that is restricted to the Work app, and nothing else can touch it. AND when the user leaves the company, we can wipe the container without wiping the phone or breaking anything else on the phone.

Are those achievable with Outlook, Exchange Server (on-prem) & Intune?

1
Kr0ss•

InTune as a MDM/MAM isn't fully sandboxed like UEM, but I wouldn't let that stop you. The application controls that you can implement result in very similar end solution (i.e. no copy-paste, no saving to 3rd party storage, minimum security requirements, etc.).

1