{"id":345,"date":"2019-04-29T14:19:22","date_gmt":"2019-04-29T14:19:22","guid":{"rendered":"http:\/\/172.23.1.43\/?p=345"},"modified":"2022-06-07T22:26:13","modified_gmt":"2022-06-07T22:26:13","slug":"mdm-eas-profile-and-activesync-policies","status":"publish","type":"post","link":"https:\/\/blog.n-dol.org\/2019\/04\/29\/mdm-eas-profile-and-activesync-policies\/","title":{"rendered":"MDM, EAS Profile and ActiveSync Policies"},"content":{"rendered":"\n<p>Back in the past to secure mobile devices, ActiveSync allow to apply some policies around passcode and other security settings.<\/p>\n\n\n\n<p>While we can deploy EAS profile on the Windows Mail client, it will behave the same way as an EAS client even if the profile is installed by a MDM server.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter\"><img decoding=\"async\" width=\"1024\" height=\"102\" src=\"http:\/\/172.23.1.43\/wp-content\/uploads\/2019\/04\/doenst-meet-security-requirement.jpg\" alt=\"doenst-meet-security-requirement\" class=\"wp-image-347\" srcset=\"https:\/\/blog.n-dol.org\/wp-content\/uploads\/2019\/04\/doenst-meet-security-requirement.jpg 1024w, https:\/\/blog.n-dol.org\/wp-content\/uploads\/2019\/04\/doenst-meet-security-requirement-300x30.jpg 300w, https:\/\/blog.n-dol.org\/wp-content\/uploads\/2019\/04\/doenst-meet-security-requirement-768x77.jpg 768w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<!--more-->\n\n\n\n<p>The layer displaying this behavior is the Exchange Active Sync Policy Manager Broker which is in charge of applying Active Sync policies.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter\"><img decoding=\"async\" width=\"456\" height=\"316\" src=\"http:\/\/172.23.1.43\/wp-content\/uploads\/2019\/04\/uac-exchange-active-sync-policy-manager-broker.jpg\" alt=\"UAC-Exchange-Active-Sync-Policy-Manager-Broker\" class=\"wp-image-348\" srcset=\"https:\/\/blog.n-dol.org\/wp-content\/uploads\/2019\/04\/uac-exchange-active-sync-policy-manager-broker.jpg 456w, https:\/\/blog.n-dol.org\/wp-content\/uploads\/2019\/04\/uac-exchange-active-sync-policy-manager-broker-300x208.jpg 300w\" sizes=\"(max-width: 456px) 100vw, 456px\" \/><\/figure><\/div>\n\n\n\n<p>Upon MDM profile removal the Windows Mail will ask for user consent which if he&#8217;s click on No will leave the account in the applications. The MDM server won&#8217;t have any say on this and won&#8217;t be able to remove it.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter\"><img decoding=\"async\" width=\"680\" height=\"238\" src=\"http:\/\/172.23.1.43\/wp-content\/uploads\/2019\/04\/consent.jpg\" alt=\"consent\" class=\"wp-image-346\" srcset=\"https:\/\/blog.n-dol.org\/wp-content\/uploads\/2019\/04\/consent.jpg 680w, https:\/\/blog.n-dol.org\/wp-content\/uploads\/2019\/04\/consent-300x105.jpg 300w\" sizes=\"(max-width: 680px) 100vw, 680px\" \/><\/figure><\/div>\n\n\n\n<p>To resume the workflow :<\/p>\n\n\n\n<ol><li>MDM Enrollment<\/li><li>EAS Email profile applied<\/li><li>User connect to Exchange account<\/li><li>Exchange Active Sync policies are applied<\/li><li>Upon removal a consent is required as EAS manage some part of the application.<\/li><\/ol>\n\n\n\n<p>The workaround is to secure ActiveSync with <a href=\"https:\/\/docs.vmware.com\/en\/VMware-Workspace-ONE-UEM\/1903\/WS1_MEM_Guide\/GUID-AWT-MIGRATIONOFEMAILS.html\">Secure Email Gateway (Proxy or PowerShell)<\/a> and then remove any ActiveSync policy, which are the issue here.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Back in the past to secure mobile devices, ActiveSync allow to apply some policies around passcode and other security settings.&hellip;<\/p>\n","protected":false},"author":5614970,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[2157457,14014,38600,672890795],"tags":[],"_links":{"self":[{"href":"https:\/\/blog.n-dol.org\/wp-json\/wp\/v2\/posts\/345"}],"collection":[{"href":"https:\/\/blog.n-dol.org\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.n-dol.org\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.n-dol.org\/wp-json\/wp\/v2\/users\/5614970"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.n-dol.org\/wp-json\/wp\/v2\/comments?post=345"}],"version-history":[{"count":3,"href":"https:\/\/blog.n-dol.org\/wp-json\/wp\/v2\/posts\/345\/revisions"}],"predecessor-version":[{"id":831,"href":"https:\/\/blog.n-dol.org\/wp-json\/wp\/v2\/posts\/345\/revisions\/831"}],"wp:attachment":[{"href":"https:\/\/blog.n-dol.org\/wp-json\/wp\/v2\/media?parent=345"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.n-dol.org\/wp-json\/wp\/v2\/categories?post=345"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.n-dol.org\/wp-json\/wp\/v2\/tags?post=345"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}