Running Office365 Exchange for a corporation, I am unable to enforce any policy on Mac Mail when it's using an active sync connection. It actually does not show up as a device (I even looked at this through PowerShell) and thus no filter/policy can be applied to it and essentially gives the device full access to the account. I consider this a huge security flaw when you're trying to enforce active sync policies. Has anyone seen this issue before?

As a side note: Windows 8 Mail and Windows 7.1 Phone Mail both are incompatible with Office 365 policies that include limiting the amount of past emails or calendar items, and Outlook 2013 seems to be completely incompatible with Office 365 Exchange accounts, regardless of policy.

How can I prevent Mac Mail from connecting via Exchange ActiveSync while still allowing my other devices?


Apparently Mac Mail uses both Active Sync and EWS to connect to exchange; because of this it will not show up as a device on the management side. Disabling EWS prevents Mac Mail from connecting while still allowing Active Sync devices to connect.


Linking my answer to a related question:

blocking Apple's Mail.app and EWS without breaking AutoDiscover

Long story short, you can turn off EWS entirely for a user or the entire organiation, or you can block certain EWS User Agents (which can be spoofed, etc.) to allow only the applications you want.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.