Upcoming Exchange Device Access and Conditional Access changes with Outlook mobile

Upcoming Exchange Device Access and Conditional Access changes with Outlook mobile

Recently, Microsoft discovered that certain Azure Active Directory Conditional Access policies prevented Exchange Online device access rules from being applied to Outlook for iOS and Android.

For example, customers with a conditional access policy that required Multi-factor authentication (MFA) resulted in Exchange Online not processing device access rules for Outlook for iOS and Android.

Beginning in August 2020, Microsoft will roll out changes in Exchange Online to ensure that only certain Conditional Access policies bypass Exchange’s device access rules. Specifically, only Conditional Access policies configured with the following grant access controls will prevent Exchange device access rules being applied to Outlook for iOS and Android:

• Require device to be marked as compliant
• Require approved client app
• Require app protection policy

Key Points:

• Timing: Beginning of August
• Action: Review and assess organizational impact

How this will affect your organization:

If you are utilizing Conditional Access policies that do not leverage the above grant access controls and have configured the mobile device access level within Exchange Online to either block or quarantine devices, users using Outlook for iOS and Android will be blocked or quarantined by Exchange Online after this change is implemented.

By default, the mobile device access level in Exchange Online is set to allow.

If you are using Conditional Access policies with the above grant access controls, your users will not be affected.

What you need to do to prepare:

Organizations have a few different options to prepare for this change:

1. Implement Microsoft Endpoint Manager and one of the above grant access controls. For more information, see Leveraging Enterprise Mobility + Security suite to protect corporate data with Outlook for iOS and Android.
2. Create an Exchange Online device access rule that allows Outlook for iOS and Android. For more information, see Block all email apps except Outlook for iOS and Android.
3. Manually add the user’s Outlook for iOS and Android Device ID to the user’s ActiveSyncAllowedDeviceIDs property. To obtain the Device ID, use Get-MobileDeviceStatistics. To add the Device ID to the user’s ActiveSyncAllowedDeviceIDs property, see Set-CASMailbox.
4. Change the default access level to Allow. For more information, see Set-ActiveSyncOrganizationSettings. This change allows all mobile devices, regardless of type, to connect.
5. Alternatively, organizations can retain their default mobile device access level and wait for this change to take place and manually allow each device as they are quarantined/blocked.

Important: Because Outlook for iOS and Android’s device IDs are not governed by any physical device ID, the ID can change without notice. When this happens, it can cause unintended consequences when device IDs are used for managing user devices, as existing ‘allowed’ devices may be unexpectedly blocked or quarantined by Exchange. Therefore, Microsoft recommends administrators only set mobile device access policies for Outlook for iOS and Android that allow/block devices based on device type or device model.

Source

https://techcommunity.microsoft.com/t5/exchange-team-blog/upcoming-exchange-online-device-access-and-conditional-access/ba-p/1464261