Migration to BlackBerry Business Cloud Services (BBCS) of Office 365 Fails for Some Domains

BACKGROUND

We are migrating on-premises BlackBerry Enterprise Server/BES 5 (i.e. legacy BlackBerry devices with OS 7 or below) and Exchange servers of an enterprise with multiple domains to Exchange Online and BlackBerry Business Cloud Services/BBCS (a free component within Office 365).

They use a single Office 365 tenant contoso.com as the User Principal Name (UPN) which manages everything, including all of their email domains (contoso.com, fabrikam.com, tailspin.com, woodgrovebank.com) which they use as primary SMTP/email address for different users.

PROBLEM

We are having a problem migrating BES 5 to BBCS for some of the domains (tailspin.com, woodgrovebank.com) where Blackberry Enterprise Activation would fail with any of the below messages shown on the legacy BlackBerry devices:

• The server is not responding. Please contact yout System Administrator.
• The BlackBerry Enterprise Server has not responded to your activation request. An error may have occurred.

On BBCS web interface, we can see that the accounts that fail show the state as “Initializing” (which should have been “No PIN” or “Running”), and mailbox agent state as “Trying to connect” (which should have been “Working”):

ADDITIONAL INFORMATION / CLUES

The domains where Enterprise Activation succeeds (contoso.com, fabrikam.com) have the following characteristics:

• They are in the SAN (Subject Alternative Name) certificate.
• Their autodiscover DNS records (autodiscover.contoso.com, autodiscover.fabrikam.com) are A records which points to the IP address of their on-premises mail gateway directly.

The domains where Enterprise Activation fails (tailspin.com, woodgrovebank.com) have the following characteristics:

• They are not in the SAN (Subject Alternative Name) certificate.
• Their autodiscover DNS records (autodiscover.tailspin.com, autodiscover.woodgrovebank.com) are CNAME records pointing to autodiscover-r.contoso.com which points to their on-premises mail gateway.

For reference, below is a list of domain names in the SAN certificate: Subject Alternative Name

DNS Name=autodiscover.contoso.com
DNS Name=contoso.com
DNS Name=autodiscover.fabrikam.com
DNS Name=fabrikam.com

In other words, there is no problem activating BBCS user accounts where primary SMTP is contoso.com or fabrikam.com; the problem only occurs to those accounts where primary SMTP address is tailspin.com or woodgrovebank.com which uses CNAME and is not included in the SAN certificate.

NOTES

• For domains that fail BlackBerry Enterprise Activation (tailspin.com, woodgrovebank.com), there is no other issue with them, i.e. they have no issue with desktop Outlook, other mobile email clients, or even newer BlackBerry OS 10 devices which supports Exchange ActiveSync. In other words, Outlook Autodiscover and Exchange Activesync Autodiscover work for all domain names (except Enterprise Activation of legacy BlackBerry OS 7 or below.)
• We do not consider including all domains in the SAN certificate because there is a large number of domains (not only tailspin.com, woodgrovebank.com). The cost would be too high.
• We found this BlackBerry KB (http://support.blackberry.com/kb/articleDetail?ArticleNumber=000033185) which seems to describe a similar issue, but the KB is for BES (BlackBerry Enterprise Server) instead of BBCS (BlackBerry Business Cloud Services).
• This is a hybrid/co-existence Office 365 deployment.
• All domain names above are fictional.

Any solutions/workarounds/suggestions would be appreciated.