Applies to: Exchange Server 2013
Topic Last Modified: 2012-10-05
Exchange ActiveSync is a client protocol that lets you synchronize a mobile device with your Exchange mailbox. Exchange ActiveSync is enabled by default when you install Microsoft Exchange 2013.
Overview of Exchange ActiveSync
Exchange ActiveSync is a Microsoft Exchange synchronization protocol that's optimized to work together with high-latency and low-bandwidth networks. The protocol, based on HTTP and XML, lets mobile phones access an organization's information on a server that's running Microsoft Exchange. Exchange ActiveSync enables mobile phone users to access their email, calendar, contacts, and tasks, and to continue to access this information while they're working offline.
|Windows Phone 7 mobile phones support only a subset of all Exchange ActiveSync mailbox policy settings. For a complete list, see Windows Phone 7 Synchronization.|
Features in Exchange ActiveSync
Exchange ActiveSync provides the following:
- Support for HTML messages
- Support for follow-up flags
- Conversation grouping of email messages
- Ability to synchronize or not synchronize an entire
- Synchronization of Short Message Service (SMS) messages with a
user's Exchange mailbox
- Support for viewing message reply status
- Support for fast message retrieval
- Meeting attendee information
- Enhanced Exchange Search
- PIN reset
- Enhanced device security through password policies
- Autodiscover for over-the-air provisioning
- Support for setting automatic replies when users are away, on
vacation, or out of the office
- Support for task synchronization
- Direct Push
- Support for availability information for contacts
Managing Exchange ActiveSync
By default, Exchange ActiveSync is enabled. All users who have an Exchange mailbox can synchronize their mobile device with the Microsoft Exchange server.
You can perform the following Exchange ActiveSync tasks:
- Enable and disable Exchange ActiveSync for users
- Set policies such as minimum password length, device locking,
and maximum failed password attempts
- Initiate a remote wipe to clear all data from a lost or stolen
- Run a variety of reports for viewing or exporting into a
variety of formats
- Control which types of mobile devices can synchronize with your
organization through device access rules
Security in Exchange ActiveSync
You can configure Exchange ActiveSync to use Secure Sockets Layer (SSL) encryption for communications between the Exchange server and the mobile device. Certificate-based authentication works with a self-signed certificate, a certificate from an existing public key infrastructure, or a third-party commercial certificate. You can use certificate-based authentication together with other security features, such as local device wipe and a device password, so the mobile device functions like a smart card. The private key and certificate for client authentication are stored in memory on the mobile phone. If an unauthorized user tries to bypass the mobile device password, all user data is purged. This includes the certificate and private key. For more security, you can deploy RSA SecurID two-factor authentication on the Exchange server.
Managing mobile device access in Exchange ActiveSync
You can control which mobile devices can synchronize. You do this by monitoring new mobile devices as they connect to your organization or by setting up rules that determine which types of mobile devices are allowed to connect. Regardless of the method you choose to specify which mobile devices can synchronize, you can approve or deny access for any specific mobile device for a specific user at any time
Device security features in Exchange ActiveSync
In addition to the ability to configure security options for communications between the Exchange server and your mobile devices, Exchange ActiveSync offers the following features to enhance the security of mobile devices:
- Remote wipe If a mobile device is lost,
stolen, or otherwise compromised, you can issue a remote wipe
command from the Exchange Server computer or from any Web browser
by using Outlook Web App. This command erases all data from the
- Device password policies Exchange
ActiveSync lets you configure several options for device passwords.
These options include the following:
- Minimum password length
(characters) This option specifies the length
of the password for the mobile device. The default length is
4 characters, but as many as 18 can be included.
- Minimum number of character sets Use
this text box to specify the complexity of the alphanumeric
password and force users to use a number of different sets of
characters from among the following: lowercase letters, uppercase
letters, symbols, and numbers.
- Require alphanumeric password This
option determines password strength. You can enforce the usage of a
character or symbol in the password in addition to numbers.
- Inactivity time (seconds) This option
determines how long the mobile device must be inactive before the
user is prompted for a password to unlock the mobile device.
- Enforce password history Select this
check box to force the mobile phone to prevent the user from
reusing their previous passwords. The number that you set
determines the number of past passwords that the user won't be
allowed to reuse.
- Enable password recovery Select this
check box to enable password recovery for the mobile device. Users
can use Outlook Web App to look up their recovery password and
unlock their mobile device. Administrators can use the Exchange
Administration Center to look up a user's recovery password.
- Wipe device after failed
(attempts) This option lets you specify
whether you want the phone's memory to be wiped after multiple
failed password attempts.
- Minimum password length (characters) This option specifies the length of the password for the mobile device. The default length is 4 characters, but as many as 18 can be included.
- Device encryption policies There are a
number of mobile device encryption policies that you can enforce
for a group of users. These policies include the following:
- Require encryption on device Select
this check box to require encryption on the mobile device. This
increases security by encrypting all information on the mobile
- Require encryption on storage
cards Select this check box to require
encryption on the mobile device’s removable storage card. This
increases security by encrypting all information on the storage
cards for the mobile device.
- Require encryption on device Select this check box to require encryption on the mobile device. This increases security by encrypting all information on the mobile device.
Windows Phone 7 synchronization
If you have Windows Phone 7 mobile devices in your organization, these devices will experience synchronization problems if certain Mobile Device mailbox policy properties are configured. To allow Windows Phone 7 mobile phones to synchronize with an Exchange mailbox, either set the AllowNonProvisionableDevices property to true or configure only the following Mobile Device mailbox policy properties: