IBM Security MaaS360

 View Only

  • 1.  Exchange ActiveSync with IOS

    Posted Fri March 08, 2024 10:16 PM

    Hello everyone,

    I'm working with an organization that utilizes Cloud Extender for user authentication, visibility and Exchange ActiveSync. We haven't configured anything within the IOS policy for ActiveSync however we're noticing that many of the IOS devices enrolled are reporting their mailbox as managed by Exchange ActiveSync. There is an ActiveSync policy in the portal but it doesn't contain any of the server information or user settings. Our question is whether simply setting up the ActiveSync policy and the Cloud Extender's default policy with Exchange integrated using Cloud Extender provisions this automatically?

    My thinking is that:

    1. IOS device enrolls and Cloud Extender communicates to the on-prem Exchange that the device is enrolled.
    2. Cloud Extender creates a record of the device but does not have a user to attach to it yet until the user attempts to sign into Exchange.
    3. User of the device signs into the IOS Mail app with their AD/Exchange credentials.
    4. Since the device record was already sent to Exchange via Cloud Extender from MaaS360, the device is authenticated because it's treated as an "existing device" and not an "enrolled device" for AQ.

    That last step is what I presume the key is - as Auto Quarantine is setup and enabled. All enrolled devices are set to quarantine but automatically approve existing devices is not. If the users previously signed in before AQ was setup, even though an ActiveSync configuration wasn't being pushed from the policy, would that account for the devices we're seeing that already have their mailbox managed?



    ------------------------------
    Alonzo Leavitt
    ------------------------------


  • 2.  RE: Exchange ActiveSync with IOS

    Posted Mon March 11, 2024 08:20 AM

    Hi Alonzo

    Without your account ID to hand I can't confirm what I am going to say to you, maybe you can verify this. Please do not reply on a public forum with your account ID. 

    If you go to Settings / Cloud Extender settings you will see the settings configured which might have been modified at time of installation of Cloud Extender. This would determine whether AutoQuarantine was being used on Cloud Extender, or on the Exchange server, or not at all. 

    The devices that report "Mailbox Managed" means that the device actually has 2 records in the MaaS360 platform - an MDM record (enrolled device) and/or an Exchange AS device (coming through Cloud Extender from Exchange). When the platform receives records from activated mail devices, it compares these with existing enrolled devices using specific criteria, and if appropriate merges them so that what you see is actually the result of the merge, where you have an MDM and an Exchange record together. The proof of this would be where in the device in Inventory, you go into the device and can see actions (top-right) for both Device actions (MDM) and Exchange actions. To see any devices where this merge process did not happen you can go to Devices > Exceptions and merge them manually. These occur where the information coming from the Cloud Extender / Exchange integration doesn't provide conclusive evidence to be able to merge the records with confidence. 

    If you need help in terms of whether anything is not actually working correctly please raise a Support ticket and the team will follow up. Alternatively without your account ID - which should not be posted here to respect your privacy - I can answer any more general questions you have. 

    Best regards



    ------------------------------
    Eamonn O'Mahony
    Technical Client Success Manager
    IBM Security
    Dublin, Ireland
    ------------------------------

    Original Message


  • 3.  RE: Exchange ActiveSync with IOS

    IBM Champion
    Posted Mon March 11, 2024 10:09 AM

    Good morning:
    Cloud Extender provides information and records this info for any device connecting to the Exchange environment regardless of enrollment in MaaS360.  There are many reasons this can be valuable, however the most common reason organizations deploy CE is to have the ability at some point to prevent an active sync connection to Exchange if the device is not enrolled in MaaS.  This is a simple config in the MaaS dashboard. AT the most basic level, CE provides oversight of ALL devices using Active Sync to connect to Exchange AD. 

     

    Of note, if your users are allowed to use the Outlook app, MaaS360 will create a separate record for each device connecting to the Exchange environment using the app whether you have CE in place or not.  This is the result of Microsoft using a protocol, somewhat different than the standard Active Sync protocol, for the Outlook app.  MDM's cannot communicate with the Outlook app other than seeing the activity and pushing/managing the app if desired. 

     

    Thanks,

     

    Mitch Lauer

    Sr. Management Consultant

    connecTel  Wireless              

    216-970-6981 | Cell-US           416-801-3127 | Cell-Canada  

    412-339-5775 | Help Desk      412-339-5765 | Direct Dial

     




    Original Message