Outlook for iOS/Android bypasses Exchange ActiveSync quarantine for additional devices

Omid 20 Reputation points
2026-06-30T17:19:58.99+00:00

Environment

Exchange Server 2019

Exchange ActiveSync enabled

Default ActiveSync access level: Quarantine

No ActiveSync Device Access Rules configured

Outlook for iOS and Android

Issue Description

We have observed a change in Outlook Mobile behavior during the last few months.

Our Exchange ActiveSync policy is configured with:

DefaultAccessLevel = Quarantine

No Allow/Block Device Access Rules

Administrator approval is required for every new mobile device.

Testing results are as follows:

Native ActiveSync clients (Samsung Mail and other EAS clients):

Every newly added device is quarantined correctly.

A new MobileDevice object is created.

Administrator approval is required.

Outlook for iOS and Android:

The first Outlook device for a mailbox is quarantined correctly.

After administrator approval, additional Outlook installations on different phones for the same mailbox are able to synchronize immediately.

No new MobileDevice object is created.

No quarantine notification is generated.

The additional device does not appear in Get-MobileDevice or Get-MobileDeviceStatistics.

We have also confirmed from IIS logs that Outlook Mobile connects through Microsoft cloud infrastructure (for example source IP 40.104.x.x with User-Agent Outlook-iOS-Android/1.0).

This behavior is only observed with Outlook Mobile.

Native Exchange ActiveSync clients continue to respect the Quarantine policy for every new device.

Question

Is this an expected design change in recent Outlook Mobile versions, or is this a known issue/regression?

Exchange | Exchange Server | Management
Exchange | Exchange Server | Management

The administration and maintenance of Microsoft Exchange Server to ensure secure, reliable, and efficient email and collaboration services across an organization.

0 comments No comments

Answer accepted by question author
Hin-V 16,830 Reputation points Microsoft External Staff Moderator
2026-06-30T20:12:38.18+00:00

Hi @Omid

Thank you for reaching out. 

From my research, this appears to be expected behavior by design, not a regression. Outlook for iOS and Android does not behave like a traditional Exchange ActiveSync (EAS) client. Instead of each mobile device connecting directly to Exchange with its own unique device ID, Outlook Mobile uses a Microsoft cloud-based service layer and modern APIs (REST/Graph) as part of its architecture. 

Because of this design, the connection you see (source IP 40.104.x.x) comes from Microsoft cloud infrastructure, not directly from each physical device. Multiple Outlook Mobile installations for the same mailbox can reuse a shared backend service connection or identity rather than creating separate EAS device partnerships.  Therefore, after the first device is approved, additional Outlook Mobile installs may not create new MobileDevice objects, may not trigger quarantine, and will not appear in Get-MobileDevice or Get-MobileDeviceStatistics, as observed in your testing. 

In contrast, native mail apps (such as iOS Mail or Samsung Mail) use true per-device EAS connections, so each device is able to generate a unique DeviceID, is quarantined independently, and appears in Exchange as expected. 

Microsoft documentation also notes architectural differences where Outlook Mobile can use a cloud-backed cache or centralized connection, meaning that multiple devices may not map one-to-one with visible device entries on the Exchange server. 

image

You can refer via: Outlook for iOS and Android | Microsoft Learn 

Please note that this summary is based on my own findings and may not fully address your concerns. To help you reach your goal more effectively, I recommend engaging with [GitHub Community Forum] for a deeper technical dive or to connect with individuals who have relevant experience and expertise. Some approaches may behave differently or be restricted depending on your specific environment and configuration. These forums include many experienced developers and Microsoft specialists who can assist with troubleshooting and guidance.   

Apologies for redirecting you to the related development team support. As moderators in this community, we do not have access to your specific tenant configuration, and my testing environment is limited. Therefore, my guidance is based on available Microsoft documentation and resources. That said, I’ll do my best to provide additional insight where possible.   

I hope this helps. 

If you have any additional concerns, feel free to comment below. I would be more than happy to assist. 


Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread. 

Was this answer helpful?

1 person found this answer helpful.

0 additional answers

Sort by: Oldest

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.