Endpoint Security Complete

In our environment the MDM solution enrolls EAS policies to the mobile devices.

BUT

We have no control which mobile devices uses EAS accounts without being managed by MDM.

Is it possible to control the EAS funciton with Mobile Management (like Proxy/Sentry Server) instead of rolling out just EAS policies?

Thanks

Maybe I misunderstood your question but a device not managed by Mobile Management does not receive the EAS policies. Further could an unmanaged device not use these settings because it does not receive it.

Yes, thats true, the device does not receive a policy.

But a user can easily manual create a mail account on the device to sync to eas.

He sees all the information in the mailaccount from the policy on a managed device (exchange server address, username, domain)

So he has all the information to create an acccount be himself. without knowing of mobile management the this other device sync the company mails

Is this a security leak? How do you solve this?

Hello Christoph,

The only thing you could get from the policy that way is the server name and the email.
We do not have options available to hide any policy on mobile devices.

Best thing to do:
Configure your Exchange server to accept request from authenticated MDM services only.

MacBrinky

Could you please elaborate on your recomendation

Best thing to do:
Configure your Exchange server to accept request from authenticated MDM services only.

Are you talking about EAS blocking with Exchange 2010?

thanks Daron

Enable your Exchange Server to authenticate only with devices that contain a specific SSL Certificate, in this case, the ones that you are enrolling your devices to the MDM Server with.

See the Implementation Guide at: http://www.symantec.com/docs/DOC3493

Visit a Microsoft Site that discusses Exchange and SSL Certificates:

http://technet.microsoft.com/en-us/library/cc164345(v=EXCHG.80).aspx

There should be plenty of sites that will help you set this up further, if needed.

Regards.

Hello dwebmdm,

This will only work for iOS and Android devices:
You can limit Exchange ActiveSync (EAS) access to only authorized devices. You can block unauthorized devices with either:

Thanks

MacBrinky

thanks for the replies.

I think the Exchange 2010 blocking would better for us, just need to upgrade our Exchange CAS server from 2007 to 2010 which we should do anyway.

Rscovel.

While your method would work we are in the middle of migrating users over. So unless I implemented the cert change after the users already had the SMM agent and EAS profile w/cert I would probably interupt service for many users. Also once they has the cert would they not be able to reconfigure their EAS settings manually even if they removed the agent? (since they have the cert now)

I know there are no perfect solutions in IT, just thinking out loud.

appreciated. Daron