ActiveSync device access in Exchange Online: quarantine, access rules and blocked devices

Native mail apps on phones and tablets connect to Exchange Online with Exchange ActiveSync (EAS), and by default every user can sync any device. When you need control (quarantine new devices, block an old model, or let one executive's tablet through), Exchange Online gives you three layers. In this post I'll walk through each layer in Exchange Online PowerShell, show how to release a quarantined device and how to verify, and explain where Conditional Access takes over.

How it works#

Every new device partnership gets an access state of Allowed, Blocked or Quarantined. Exchange decides it from three layers:

The default is Allow. If you change it to Block or Quarantine, Microsoft documents that all existing connected devices are affected immediately, unless a device access rule or an individual allow or block entry covers them. That single fact decides the order of the steps below. Separately, mobile device mailbox policies set device requirements such as a password and encryption, and Set-CASMailbox -ActiveSyncEnabled turns EAS on or off for a user. In the Exchange admin center, these settings are under Mobile. I'll use PowerShell here because it's precise and easy to repeat.

Step-by-step#

1. Take an inventory first#

Connect-ExchangeOnline

# What connects today: client type, model, version and current state
Get-MobileDevice -ResultSize Unlimited |
    Select-Object UserDisplayName, DeviceId, DeviceType, DeviceModel, ClientType, ClientVersion, DeviceAccessState |
    Export-Csv .\MobileDevices.csv -NoTypeInformation

# Devices below EAS 16.1, which Exchange Online no longer accepts
Get-MobileDevice -ResultSize Unlimited |
    Where-Object { ($_.ClientType -eq 'EAS' -or $_.ClientType -match 'ActiveSync') -and $_.ClientVersion -and
        ([version]$_.ClientVersion -lt [version]'16.1') } |
    Select-Object UserDisplayName, DeviceModel, ClientVersion

Use the exported values when you write rules. A rule's query string has to match the device's reported value exactly.

2. Create device access rules for what you expect#

# Allow every device that reports itself as an iPhone
New-ActiveSyncDeviceAccessRule -QueryString "iPhone" -Characteristic DeviceType -AccessLevel Allow

# Block one model (copy the exact DeviceModel value from your inventory)
New-ActiveSyncDeviceAccessRule -QueryString "<DeviceModel value>" -Characteristic DeviceModel -AccessLevel Block

Get-ActiveSyncDeviceAccessRule | Format-Table Name, Characteristic, QueryString, AccessLevel

The -Characteristic parameter accepts DeviceType, DeviceModel, DeviceOS, UserAgent and XMSWLHeader.

3. Set the organization default and the notifications#

Set-ActiveSyncOrganizationSettings -DefaultAccessLevel Quarantine `
    -AdminMailRecipients mobileadmins@contoso.com `
    -UserMailInsert "Your device is waiting for approval. Contact the service desk if you need access."

AdminMailRecipients are the administrators who are notified about quarantined devices. UserMailInsert is a footer of up to 256 characters in the message the user gets when a quarantined device can't sync. Quarantine suits most organizations better than Block, because users get a clear message and admins see the request.

4. Release, allow or block individual devices#

# Find quarantined devices
Get-MobileDevice -ResultSize Unlimited | Where-Object DeviceAccessState -eq 'Quarantined' |
    Format-Table UserDisplayName, DeviceId, DeviceModel, FirstSyncTime

# Release one device for one user, or block it
Set-CASMailbox -Identity adele@contoso.com -ActiveSyncAllowedDeviceIDs @{Add="<DeviceId>"}
Set-CASMailbox -Identity adele@contoso.com -ActiveSyncBlockedDeviceIDs @{Add="<DeviceId>"}

# Turn off ActiveSync for a mailbox completely
Set-CASMailbox -Identity adele@contoso.com -ActiveSyncEnabled $false

5. Apply a mobile device mailbox policy#

New-MobileDeviceMailboxPolicy -Name "Require PIN" -PasswordEnabled $true -MinPasswordLength 6 -AllowSimplePassword $false
Set-CASMailbox -Identity adele@contoso.com -ActiveSyncMailboxPolicy "Require PIN"

Microsoft points out that the device's operating system and mail app decide which EAS policy features they actually honor, so treat these policies as a baseline, not as device management.

6. Move to the modern controls#

Device access rules match on what a device says about itself. For real control, use Microsoft Entra Conditional Access: target Office 365 Exchange Online, block the Exchange ActiveSync clients client app condition, and require an app protection policy on iOS and Android so users move to Outlook mobile. See App protection policies not applying to Outlook mobile if that step fights back.

Verify#

Get-MobileDevice -Mailbox adele@contoso.com |
    Format-Table DeviceModel, ClientType, ClientVersion, DeviceAccessState, DeviceAccessStateReason

Get-MobileDeviceStatistics -Mailbox adele@contoso.com | Format-Table DeviceModel, LastSuccessSync

• Good looks like: DeviceAccessState is Allowed for approved devices, and LastSuccessSync moves forward after the user refreshes the mail app.
• DeviceAccessStateReason tells you which layer decided: Individual for a per-user entry, DeviceRule for a rule, Global for the organization default.
• Blocked or quarantined devices appear with that state, and the admin recipients get the quarantine notice.

Tips & gotchas#

• Rules before the default. Switching the default to Quarantine without rules in place cuts off every device that doesn't match one, right away.
• Check every client type. Before you change the default, look at the ClientType column in your inventory, so you don't quarantine a client you depend on.
• Device IDs can change. Reinstalling or resetting the mail app can create a new partnership, which goes through the rules again.
• Clean up stale partnerships. Remove-MobileDevice deletes an old partnership; it doesn't wipe anything.
• Old clients. Devices below EAS 16.1 can't connect to Exchange Online any more. Update the device or switch the user to Outlook mobile.
• For Exchange Server, see ActiveSync not syncing on Exchange Server.

References#

• Exchange ActiveSync in Exchange Online (Microsoft Learn)
• Set-ActiveSyncOrganizationSettings (Microsoft Learn)