How to fix personal outlook access when device is managed by suremdm for office mail access

Question

How to fix personal outlook access when device is managed by suremdm for office mail access

Manoj Deshwal 0

we are using sure mdm for mail access on mobile devices. now the situation is when we enable active sync for mdm users ,after that he can login his mail on to personal outlook app as well,how we can restrict this. if that user is not mnaged with suremdm then his mail cannot be accessed on personal outlook app. this is only happening when we enable device and active sync for enrolling mdm on mobile. so please suggest any policy by whcih we can disable personal outlook access when device is managed by suremdm app for mail access.

Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2026-05-29T13:33:28.0333333+00:00
Hey Manoj, it sounds like you want to let your SureMDM–enrolled devices sync mail but block personal Outlook on those same devices. Here are two approaches you can try:

Use Azure AD Conditional Access (if your SureMDM enrollment is tied into Azure AD) • Create a Conditional Access policy in the Azure portal targeting your MDM‐enrolled user group • Under “Cloud apps” choose Exchange Online • Under “Client apps” select “Mobile apps and desktop clients” and specifically “Exchange ActiveSync” • Under “Conditions > Device state” include only “Compliant” (or whatever your SureMDM compliance state is) • Under “Access controls > Grant” choose “Block access” for non-compliant clients Result: only devices marked compliant by SureMDM can use Exchange ActiveSync—and you can scope it so that only the Intune-wrapped Outlook app (an approved client) is allowed, blocking the native/personal Outlook app.

Use Exchange ActiveSync Device Access Rules If you’re not tied into Azure AD for device compliance, you can block Outlook mobile at the Exchange layer: a. Connect to Exchange Online PowerShell b. Run Get-ActiveSyncDeviceAccessRule | Where {$.Characteristic ‐eq ‘DeviceType’ ‐and $.QueryString ‐match ‘Outlook’} to see how Outlook mobile reports its DeviceType (e.g. “OutlookIOS” or “OutlookAndroid”). c. Create (or modify) a rule to Block that device type: New-ActiveSyncDeviceAccessRule ‐QueryString ‘OutlookAndroid’ ‐Characteristic DeviceType ‐AccessLevel Block (or Set-ActiveSyncDeviceAccessRule if the rule already exists) d. You can scope rules to user mailboxes, device access combinations, etc. Result: any ActiveSync session identifying as Outlook mobile is blocked, regardless of MDM state.

Pick the path that fits your environment. If you’re fully on SureMDM (and not Intune), go with Device Access Rules. If you have Azure AD integration, Conditional Access gives you more flexibility (e.g. allow only the Intune-wrapped Outlook app, enforce app-PIN, etc.).

Follow-up questions

Are your SureMDM-enrolled devices registered as “Compliant” in Azure AD?

Which DeviceType does Outlook mobile report when you inspect your ActiveSync logs?

Do you already have any Exchange ActiveSync Device Access Rules in place?

Is it acceptable to block all Outlook mobile clients, or do you need to allow the Intune-protected Outlook app only?

References

• Get started with conditional access in Microsoft Entra ID

https://docs.microsoft.com/azure/active-directory/active-directory-conditional-access-azure-portal-get-started

• Troubleshoot ActiveSync with Exchange Server (Device Access Rules)

https://learn.microsoft.com/troubleshoot/exchange/client-connectivity/troubleshoot-activesync-with-exchange-server

Note: This content was drafted with the help of an AI system. Please verify the information before relying on it for decision-making.
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2026-06-01T17:32:35.08+00:00

Hello @Manoj Deshwal

Following up to see if the above provided information was helpful. If you have any further queries do let us know.

1 answer

Your answer

Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2026-06-01T17:32:35.08+00:00

Hello @Manoj Deshwal

Following up to see if the above provided information was helpful. If you have any further queries do let us know.

Answer 1

To prevent users from adding the same corporate mailbox to a personal Outlook app while still allowing access through a managed MDM profile, use server-side controls that distinguish allowed vs. blocked clients instead of relying only on generic ActiveSync enablement.

From the provided context, the supported controls are:

Use Exchange ActiveSync device access rules to allow only Outlook for iOS and Android (managed scenario) Configure Exchange (on-premises or Exchange Online) so that:
- Default ActiveSync access is blocked.
- Only Outlook for iOS and Android is allowed as a client.
Example (Exchange Online / Exchange Server):
```
   Set-ActiveSyncOrganizationSettings -DefaultAccessLevel Block
   
   New-ActiveSyncDeviceAccessRule -Characteristic DeviceModel -QueryString "Outlook for iOS and Android" -AccessLevel Allow
```
This blocks other Exchange ActiveSync native apps and only allows Outlook for iOS and Android as a client. Combined with MDM, this ensures that only the managed Outlook instance can connect.
Block or allow specific mobile apps by device model/type/user agent If the goal is to block Outlook for iOS and Android in some scenarios (for example, unmanaged devices) while allowing other clients, use New-ActiveSyncDeviceAccessRule with the Outlook identifiers:
- DeviceModel: "Outlook for iOS and Android"
- DeviceType: "Outlook"
- UserAgent: "Outlook-iOS-Android/1.0"
Example to block Outlook for iOS and Android entirely:
```
   New-ActiveSyncDeviceAccessRule -Characteristic DeviceType -QueryString "Outlook" -AccessLevel Block
```
or
```
   New-ActiveSyncDeviceAccessRule -Characteristic DeviceModel -QueryString "Outlook for iOS and Android" -AccessLevel Block
```
These rules block Outlook for iOS and Android across iOS and Android platforms. In a mixed scenario, combine these rules with Conditional Access or other policies (not detailed in the context) to differentiate managed vs. unmanaged devices.
Prefer device-type/model rules over device IDs The context explicitly warns that device IDs can change and cause unexpected blocking/unblocking. Therefore, use rules based on DeviceType or DeviceModel rather than per-device IDs when controlling mobile access.
If using Exchange Online with OAuth-capable clients For more granular control of Outlook for iOS and Android and other OAuth-capable EAS clients, use Microsoft Entra Conditional Access policies targeting specific mobile platforms (iOS/Android) and choose whether to allow or block access. The context describes:
- A policy that allows Outlook for iOS and Android on specific platforms and blocks other OAuth-capable EAS clients.
- A policy that blocks Outlook for iOS and Android on specific platforms.
These Conditional Access policies can be combined with MDM enrollment requirements (outside the provided context) so that only devices that meet management conditions can access Exchange.
MDM interoperability limitation Outlook for iOS and Android only supports Microsoft Intune as an MDM profile provider. If the mail server requires a different MDM profile, Outlook cannot connect. This means that for strict separation of managed vs. personal Outlook, Microsoft Intune is the supported MDM path; third-party MDMs like SureMDM cannot integrate directly with Outlook’s MDM profile enforcement. If the server requires a non-Intune MDM profile, Outlook for iOS and Android will not connect at all.

In summary, to stop personal Outlook access while allowing managed access:

Enforce ActiveSync organization settings with default block.
Allow only Outlook for iOS and Android (or specific device types/models) via New-ActiveSyncDeviceAccessRule.
Use Conditional Access (where available) to require device management for Exchange access.
Be aware that Outlook for iOS and Android only supports Microsoft Intune as an MDM profile; third-party MDM cannot be used as an Outlook MDM profile control.

References: