Hello All -
New to this group, and I hope you can help me sort this out....
We have multiple divisions in our company, each with their own help-desks. We have users from all of these divisions on one BES server. I would like to be able to set it up so that help-desk staff from division 1 can manage their users, and not be able to see or access users from division 2 (hopefully that makes sense).
Would that be done with a combination of custom roles and/or groups?

Yo can make this by different groups and assign to them different groups of users (in access policy). Right now I don't remember how this option name is.

You can create a group for each division and assign the BlackBerry users to their respective group. You will have to create custom roles and restrict each role to their respective group. In your custom roles, go to the User and Device tab and for the different privileges, specify which group the role has access to.

The one quirk you may see is if you allow the role to add users to the BES, if you specify that the role can only view specific groups, that role won't be able to assign the user to a group when adding the user to the BES. An error displays when this occurs. The user is still added to the BES but because the user wasn't assigned to a group, the admin won't be able to see and manage the user. Someone with Enterprise Admin privileges will have to go into the BAS and assign the user to the group.

Hope this makes sense to you.