How can I prevent Mac Mail from connecting via Exchange ActiveSync while still allowing my other devices?

Question

Running Office365 Exchange for a corporation, I am unable to enforce any policy on Mac Mail when it's using an active sync connection. It actually does not show up as a device (I even looked at this through PowerShell) and thus no filter/policy can be applied to it and essentially gives the device full access to the account. I consider this a huge security flaw when you're trying to enforce active sync policies. Has anyone seen this issue before?

As a side note: Windows 8 Mail and Windows 7.1 Phone Mail both are incompatible with Office 365 policies that include limiting the amount of past emails or calendar items, and Outlook 2013 seems to be completely incompatible with Office 365 Exchange accounts, regardless of policy.

score 3 · Accepted Answer · answered Nov 07 '12 at 21:15

3

Apparently Mac Mail uses both Active Sync and EWS to connect to exchange; because of this it will not show up as a device on the management side. Disabling EWS prevents Mac Mail from connecting while still allowing Active Sync devices to connect.

answered Nov 07 '12 at 21:15

scape

365
1
3
17

score 0 · Answer 2 · answered Apr 17 '17 at 19:35

Linking my answer to a related question:

blocking Apple's Mail.app and EWS without breaking AutoDiscover

Long story short, you can turn off EWS entirely for a user or the entire organiation, or you can block certain EWS User Agents (which can be spoofed, etc.) to allow only the applications you want.

How can I prevent Mac Mail from connecting via Exchange ActiveSync while still allowing my other devices?

2 Answers2