Free tools Windows power users keep installed
One-click scans. No signup required.
Yes—Exchange Online, the hosted email service behind Microsoft 365, supports Exchange ActiveSync (EAS). However, Outlook for iOS and Android does not use the traditional ActiveSync synchronization path for Microsoft 365 and Office 365 accounts; Microsoft says it uses its native synchronization technology instead. ActiveSync is a mailbox-access protocol, not a complete mobile-device-management (MDM) system.
That distinction determines whether you should rely on Exchange policies, deploy Intune MDM, protect data with Intune app protection (MAM), or combine those controls with Microsoft Entra Conditional Access.
What “O365” means in this context
“Office 365” remains in older documentation and some subscription names, but Microsoft generally markets the cloud productivity suite as Microsoft 365. The relevant services are different layers:
- Exchange Online: Microsoft’s hosted email, calendar and contacts service. This is where ActiveSync support and mailbox policies apply.
- Outlook for iOS and Android: Microsoft’s mobile mail and calendar app.
- Intune: Microsoft’s device-management and app-protection service.
- Microsoft Entra ID: The identity service that supplies Conditional Access decisions.
Plan contents vary. Do not assume that every Microsoft 365 or Office 365 subscription includes Intune, Entra ID P1 or the same Conditional Access features.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →What Exchange ActiveSync does
Exchange ActiveSync is a protocol that lets compatible mobile clients synchronize mailbox data with Exchange Online, including:
- Calendar items
- Contacts
- Selected mailbox settings
An ActiveSync connection does not prove that a phone is enrolled in MDM. A user can connect Apple Mail, Gmail or another compatible client to Exchange Online through ActiveSync while the device remains unmanaged.
Exchange can apply mobile device mailbox policies—Microsoft’s current name for what older documentation called Exchange ActiveSync policies. Depending on the client, these policies can require a password, require encryption, restrict access and support a wipe command. They remain Exchange-level controls rather than full endpoint management.
How the layers differ
| Layer | Primary job |
|---|---|
| Exchange ActiveSync | Synchronizes mailbox data with compatible mobile clients. |
| Exchange mobile device mailbox policy | Applies selected Exchange-side password, encryption, access and wipe controls. |
| Intune MDM | Enrolls devices, evaluates compliance, applies configurations, deploys apps and maintains inventory. |
| Intune MAM/app protection | Protects corporate data inside supported apps, with or without full device enrollment. |
| Entra Conditional Access | Decides whether access is allowed using identity, app, device, compliance, MFA and related signals. |
Microsoft describes these as complementary management options rather than interchangeable products. See Microsoft’s Outlook mobile management guidance.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Does Outlook for iPhone and Android use ActiveSync?
Not as its primary synchronization protocol for Microsoft 365 accounts. Outlook for iOS and Android supports Exchange Online, but Microsoft says it uses Microsoft’s native synchronization technology for Microsoft 365 and Office 365 accounts. The details are documented in Microsoft’s Outlook mobile overview.
Other mobile clients can still use Exchange ActiveSync, subject to authentication, access rules and Conditional Access. Consequently, installing Outlook does not automatically stop someone from trying Apple Mail or another client. Enforcement must target the client and authentication conditions explicitly.
Outlook mobile can still be affected by Exchange mobile device mailbox policies. That does not change the underlying synchronization architecture; it means Outlook honors supported Exchange-side restrictions.
ActiveSync is not an MDM solution
ActiveSync alone is not a replacement for Intune or another UEM platform. Exchange policies can cover selected mailbox-access requirements, but they do not provide the breadth of device administration expected from MDM.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute| Capability | Exchange/ActiveSync controls | Intune MDM |
|---|---|---|
| Mailbox access restrictions | Yes | Yes, with Conditional Access |
| Full device enrollment | No | Yes |
| Device inventory | Limited device information | Yes |
| Device-wide configuration and security baselines | Limited | Yes |
| Application deployment | No | Yes |
| Compliance-based access decisions | Limited | Strong, through Entra Conditional Access |
| Work-data removal | Supported for Outlook/Exchange data | Device and app options, depending on enrollment |
Outlook’s Exchange Wipe Data command removes the Outlook profile and associated work data. It is not the same as erasing the entire phone; personal photos, apps and other personal content are not implied to be deleted. Microsoft also documents that Outlook does not support Exchange’s “Account Only Remote Wipe Device” command as defined for other clients.
MDM versus MAM: the decision that matters for BYOD
Intune MDM
MDM requires device enrollment and gives the organization authority over device or work-profile settings. It is generally the best fit for corporate-owned, shared or dedicated phones; regulated environments; and policies that require inventory, device-wide configuration and a compliant-device gate.
Rank #3
- Designed for Your Windows and Apple Devices | Install premium Office apps on your Windows laptop, desktop, MacBook or iMac. Works seamlessly across your devices for home, school, or personal productivity.
- Includes Word, Excel, PowerPoint & Outlook | Get premium versions of the essential Office apps that help you work, study, create, and stay organized.
- 1 TB Secure Cloud Storage | Store and access your documents, photos, and files from your Windows, Mac or mobile devices.
- Premium Tools Across Your Devices | Your subscription lets you work across all of your Windows, Mac, iPhone, iPad, and Android devices with apps that sync instantly through the cloud.
- Easy Digital Download with Microsoft Account | Product delivered electronically for quick setup. Sign in with your Microsoft account, redeem your code, and download your apps instantly to your Windows, Mac, iPhone, iPad, and Android devices.
Intune MAM (app protection)
Intune app protection policies protect corporate data inside supported applications, such as Outlook, without requiring full enrollment. They are usually better for personally owned devices, contractors and privacy-sensitive users who need work-data controls without handing the organization management of the entire phone. Microsoft confirms that app protection can work on unenrolled devices and recommends using Conditional Access with it: Intune app protection overview.
MAM is not full-device security. It can restrict actions such as cut, copy, paste and Save As within protected apps, but it does not provide the device inventory and hardware-wide settings that MDM does.
How Microsoft Entra Conditional Access controls mobile access
Conditional Access is the decision layer, not a device-management service. A policy can require:
- Require device to be marked as compliant for enrolled corporate devices.
- Require an approved client app or application protection policy for app-focused designs.
- Require multifactor authentication.
- Specific platforms, users, groups or client-app conditions.
- Blocking unsupported or legacy authentication paths.
Microsoft’s managed-device procedure combines Intune enrollment and compliance with Outlook for Exchange Online access: protect email on enrolled devices. Its unmanaged-device procedure uses Outlook, app protection and app-based Conditional Access without full enrollment: protect email on unmanaged devices.
Microsoft’s Conditional Access documentation says the standalone Require approved client app grant is being retired and that policies using only that grant were to transition by March 2026. New designs should use the current application-protection-policy grant described at Conditional Access grant controls; verify the live tenant documentation before changing production policies.
Rank #4
Three workable deployment models
1. Exchange-only controls
Use mobile device mailbox policies and access rules when you need basic password, encryption, access or wipe requirements, have no Intune licensing, or are applying a temporary control. This is simple, but it is not a compliance platform and offers less granular app-level data protection. Basic Mobility and Security for Microsoft 365 is Microsoft’s simpler built-in management option at no additional charge for eligible environments.
2. Intune MDM plus Conditional Access
Enroll devices in Intune, evaluate compliance and require a compliant device before Exchange Online access. This is the strongest fit for corporate-owned devices, regulated operations and “managed and compliant only” policies.
3. Intune MAM plus Conditional Access
Require Outlook and an app protection policy while allowing the phone to remain unenrolled. This is the usual fit for BYOD and contractors because corporate data is protected without full-device administration.
4. Third-party UEM
A third-party UEM can enroll devices and deploy Outlook. Microsoft notes, however, that Microsoft-specific in-app protections—such as restricting copy, paste or Save As—may still require Microsoft Enterprise Mobility + Security capabilities and Intune-related licensing. Avoid running two full MDM platforms unless there is a documented reason.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to require Outlook and restrict other mail apps
For corporate-owned, managed devices
- Create Intune compliance policies for the iOS and Android platforms you support.
- Assign them first to a pilot group.
- Create a Conditional Access policy targeting Exchange Online and the intended users.
- Require the device to be marked compliant and require the current approved-app or app-protection control appropriate to your design.
- Deploy Outlook and communicate enrollment and remediation steps.
- Exclude emergency-access (break-glass) accounts and test a compliant, noncompliant and unenrolled device before broad rollout.
- Review sign-in logs, then expand the assignment gradually. Keep a documented rollback procedure.
For unmanaged BYOD
- Create an Intune app protection policy for Outlook.
- Set data-transfer rules, such as limiting cut, copy, paste and Save As.
- Create app-based Conditional Access policies requiring Outlook and application protection.
- Block unsupported clients and require MFA where appropriate.
- Test on an unmanaged iPhone and Android phone, including selective app-data removal.
These controls are separate from merely disabling ActiveSync. Microsoft documents methods to allow Outlook while blocking OAuth-capable Exchange ActiveSync clients, and separate controls for clients using basic authentication, in the modern-authentication setup guidance.
Recommended Free Tools
Best Value
Important: blocking ActiveSync does not necessarily block Outlook mobile, because Outlook uses Microsoft’s native synchronization technology. To stop mobile access entirely, or to require Outlook, target the relevant client-app, authentication, app-protection and device-compliance conditions.
Licensing considerations
Conditional Access scenarios described by Microsoft require Entra ID P1. Microsoft lists Entra ID P1 as available standalone and included with products such as Microsoft 365 E3 and Business Premium; see the Entra pricing page. Intune Plan 1 is included in several enterprise suites and Business Premium, with standalone options also available: Intune pricing.
Confirm licensing against your tenant, user population, government or education status, agreement type and current Microsoft terms. A practical buying path is:
- Basic email controls: Exchange policies or Basic Mobility and Security.
- Corporate-owned devices: Intune Plan 1, either standalone or in a suite that includes it.
- BYOD: Intune app protection plus Entra Conditional Access.
- Broad enterprise security and compliance: Evaluate Microsoft 365 E3/E5 or equivalent licensing rather than buying MDM in isolation.
Common failures and how to diagnose them
Outlook is unexpectedly blocked
- Check whether the device is enrolled and compliant.
- Confirm the user has the required Intune and Entra licenses.
- Verify that Outlook is included in the app protection policy.
- Check for conflicting Conditional Access policies or an obsolete approved-client-app grant.
- Review Entra sign-in logs for the exact unmet control.
Microsoft notes that missing Intune licensing, no assigned app protection policy or an app omitted from that policy can prevent access when app protection is required. Hybrid or on-premises Exchange deployments have separate requirements; review the hybrid modern-authentication guidance.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Users bypass Outlook
Deploying Outlook does not uninstall or block Apple Mail, Gmail or other clients. Use client-app conditions and app protection or compliant-device requirements, then test both modern-authentication and legacy-authentication paths.
A wipe is assumed to erase the phone
An Outlook/Exchange Wipe Data action removes Outlook’s profile and work data. A full-device wipe is a separate MDM operation and has different privacy and recovery consequences.
Conditional Access causes a lockout
Use a pilot group, report-only mode where available, sign-in-log review, a break-glass exclusion and a tested rollback. Treat administrators, service accounts and emergency users separately.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
