Exchange Online Questions

[AngryITGuy]

So we have finally migrated our on-premise mailboxes to Exchange online. At present it's just staff users whilst we iron out any issues . I kinda have it set up how I want it now thanks to the help I've found on here and online but I am struggling with a couple of aspects of it.

 

I want to disable Exchange ActiveSync by default for the Tenant and only enable it for a handful of users on demand. The only place I have seen a setting for Exchange Active Sync in the Exchange Admin Centre is in Permissions and then Outlook Web App Policies turning it off here doesn't seem to do anything as new mailboxes sill have it enabled. I have ran a PowerShell command to disable it for all the current mailboxes but this won't work once I start adding students to Exchange. So how is everyone else managing this and is there a global setting I can set either in the Admin Centre or via PowerShell?

 

Secondly I have configured some Mail Flow Rules one to block file extensions and the other for profanity. Using the Exchange Admin Centre you can only add the extensions or words one at a time and i haven't really been able to find and guides online on either how to import multiple items using the Admin Centre or PowerShell. And since i don't fancy typing all the words in one at time as suggested by Microsoft Support I was just wondering how everyone else has tackled this.

 

Thanks

[AngryITGuy]

So I've had no joy with disabling Exchange ActiveSync by default for the tenant but I have had some success with bulk importing words in to Mail Flow Rules. After some digging around on the net I figured out how to do it and just wanted to post the instructions on here for anyone else in the same boat.

 

You need to create a csv file, in my case it was full of file extensions i wanted to block and words I wanted to filter. After that that you need to connect to exchange online and run the following command New-TransportRule "NAME OF NEW RULE" -SubjectOrBodyContainsWords (Get-Content LOCAL LOCATION OF CSV) -RejectMessageReasonText "REJECTION MESSAGE"

[jslate1980]

Probably a daft question but have you read this https://support.microsoft.com/en-gb/kb/2795303. Why don't you just create a daily task sequence that runs Get-Mailbox | Set-CasMailbox -ActiveSyncEnabled $False. And another that adds the individual uses that back in afterwards who need it.

[Tefters]

Curious as to why you would want to turn off ActiveSync in an age where reading and responding to emails on the move saves a lot of time.

I am not aware of a way to turn off ActiveSync on new Mailboxes without turning it off globally unless as mentioned above you script a daily task, alternatively you could just email office 365 support through the message center as it's free!

[AngryITGuy]

Curious as to why you would want to turn off ActiveSync in an age where reading and responding to emails on the move saves a lot of time.

 

There's no argument that it saves time but we also see it as a security risk to have such data on personal devices.

 

As mentioned in my original post we allow ActiveSync for a handful of users who have school issues devices and for everyone else it's blocked.

 

But I have since found that despite having ActiveSync disabled users could still get mail to their personal devices using the Outlook app so we have had to put some rules in place to block that too as there a few alarming articles regarding the security of the app and I'm pretty sure during testing the app also ignored the ActiveSync policies passcode enforcement.

 

I've spoken to Microsoft and there is no way to disable it across the tenant so we are as suggested running some scheduled PowerShell commands to get around it for now.

[Tefters]

Don't get me wrong I'm all for security but Exchange online lets you manage mobile devices quite well in such instances, passcode, wipe etc... The days of locking every nook and cranny and only having access via fixed terminals within the building are slowly starting to dwindle.