[ridmaur]

Hi there,

Is support for MFA in the works? And I don't mean through using app passwords, but really like native support: i.e. you go through the multi factor authentication process that your Office 365 configuration supports when setting up an Exchange account. My current organisation does not open up the use of app passwords on Office 365 and as a result I cannot use the Hub and have to reside to MS Outlook client on Android.

Alpha instructions start here with this:

Okay guys, I've asked around and I'm allowed to let you guys try it out and give us feedback.
However, there are a few caveats:
1) This is Alpha Level.
2) There is no support.
3) There are issues.
4) It will break in the future - this is a limited time test.
5) It is complex to set up -- again, no support if it doesn't work, and this is not the final flow.

With that said, I welcome your feedback if it works for you or not.

This should work with either the current release version or the current beta version of BlackBerry Hub+ Services.

Instructions to come in another post.

[LiamQ]

It's supported now. We're still working on the admin guide though.

[ridmaur]

It's supported now. We're still working on the admin guide though.

Thanks, as from what release of the BB Hub?

[LiamQ]

Thanks, as from what release of the BB Hub?

BlackBerry Hub+ Services 1.6.1.50954.

[kdunzin]

is there a Guide? I have 1.6.1.51155 and this is still not working; note our O365 Admin will not enable app password, so i was hoping this would be handled native.

[TI_Master]

Is there any information on how to set this up yet? Anywhere?

[estarno]

BlackBerry Hub+ Services 1.6.1.50954.

Definitely is NOT supported. I've been trying on 1.6.1.5115 and it does not work.

[ridmaur]

I have been trying official current release as well as latest beta. Both do not offer 2FA. @LiamQ: Can you please update us on the status?

[LiamQ]

I have been trying official current release as well as latest beta. Both do not offer 2FA. @LiamQ: Can you please update us on the status?

We're reviewing the admin guide for this.

[ridmaur]

We're reviewing the admin guide for this.

Thanks, but I am not sure I understand the comment. Will the function roll out after you’ve finalised the admin guide or what?

I bought a Key2 on the premise this would be supported. This is a major showstopper for me (and I guess I am not alone) for using the Hub so I hope this will be fixed rather sooner than later.

[LiamQ]

The functionality is present but needs configuration from the server admin. We're working on the admin guide.

[ridmaur]

The functionality is present but needs configuration from the server admin. We're working on the admin guide.

I don't think I can convince my IT department to make some changes specifically for Hub to work with 2FA. If I configure Outlook in Android or iOS or Apple Mail on iOS and I specify my corporate email address I do see a screen like below. If I provide credentials I will get another screen prompting me for a code received through SMS or an app. This is a one time configuration. Once finished the email client does its work.
I would expect the Hub to work exactly the same. Am I correct in that assumption?

[ridmaur]

@ LiamQ: I would appreciate any update whether the MFA integration will work the way I illustrated above. If not I will most likely sell my Key2 as losing the integration of my work mail into the Hub makes the device way less interesting for me.

[LiamQ]

The screenshot shows Okta. Sorry, but Okta isn't supported currently in Hub.

[Dunt Dunt Dunt]

I had to switch over to the Outlook App, which is growing on me.

[ridmaur]

The screenshot shows Okta. Sorry, but Okta isn't supported currently in Hub.

I know but are there plans to support this or can we request to have this supported.

[Chuck Finley69]

I know but are there plans to support this or can we request to have this supported.

Perhaps costs too much?

[ridmaur]

Perhaps costs too much?

Doubt that. There are macOS apps like Airmail that support this kind of MFA.

If you want to be serious about being a device and app for business users then you should support these enterprise authentication requirements is my humble opinion.

[estarno]

Doubt that. There are macOS apps like Airmail that support this kind of MFA.

If you want to be serious about being a device and app for business users then you should support these enterprise authentication requirements is my humble opinion.

I’ve given them that same feedback since they came out with the KeyOne. Returned my KEY2 and KeyOne because of it. It’s hilarious they market themselves as productivity/business/enterprise/professional users and don’t support 2FA. Almost every corporation requires it nowadays. They probably can’t figure out how to support it because the whole BlackBerry Mobile thing is really a skeleton crew of developers and marketers.

Sadly iPhones are the only tool of choice for corporate users these days. Other android phones too that have email clients that handle 2FA too I guess. Would like to get back on a BlackBerry but it’s amateur hour here with no enterprise level support.

[max-bb]

We support Microsoft's ADAL authentication service, which is the standard way to sign into modern Exchange/Office365 setups ("Modern Auth"), but it currently requires an admin to grant Hub access and provide client identifiers.

[Dunt Dunt Dunt]

I’ve given them that same feedback since they came out with the KeyOne. Returned my KEY2 and KeyOne because of it. It’s hilarious they market themselves as productivity/business/enterprise/professional users and don’t support 2FA. Almost every corporation requires it nowadays. They probably can’t figure out how to support it because the whole BlackBerry Mobile thing is really a skeleton crew of developers and marketers.

Sadly iPhones are the only tool of choice for corporate users these days. Other android phones too that have email clients that handle 2FA too I guess. Would like to get back on a BlackBerry but it’s amateur hour here with no enterprise level support.

PRIV and DTEK users had the issue too... but it wasn't a common as it is now. Back then it was more an issue of other UEM not supporting BlackBerry Android devices...

[ridmaur]

We support Microsoft's ADAL authentication service, which is the standard way to sign into modern Exchange/Office365 setups ("Modern Auth"), but it currently requires an admin to grant Hub access and provide client identifiers.

Because of security reasons corporate companies like the one I am working for require tighter access protocols above standard ones to access any corporate service. Like said before, clients like Airmail do support this. I can't really understand why a company like BlackBerry, embracing security as part of their Android offering, neglect something like OKTA MFA.

[max-bb]

If Okta is integrated with ADAL, it may work with your admin's consent. But also check your PMs.

[bb10adopter111]

Doubt that. There are macOS apps like Airmail that support this kind of MFA.

If you want to be serious about being a device and app for business users then you should support these enterprise authentication requirements is my humble opinion.

Going forward, no MFA, no enterprise business. It's going to be a "hard" requirement for most serious businesses. I expect BlackBerry will support it for the major players.

Posted with my trusty Z10

[ridmaur]

If Okta is integrated with ADAL, it may work with your admin's consent. But also check your PMs.

I don't understand this comment. Like said, other clients like Airmail do support this out of the box without our admins having to do anything. So why can't BlackBerry Hub?