Issues getting an Android-based BlackBerry Key 2 access

Question

I have a user with a BlackBerry Key2 running Android 8.1 (like all later BlackBerries use). This is an unmanaged device. He has no problem using the device on other O365 servers, but trying to get his email account to be accessible on his device. We are not trying to turn this into a managed device. After working through getting the BlackBerry Hub+ app enabled and assigned to him in Azure, he received the following message via email on his laptop. Help?

Subject: Your mobile device has been denied access to the server because of server policies.

Your device won't be able to synchronize with the server via Exchange ActiveSync because of an access policy defined on the server.

Information about your device:
Device model: Android
Device type: Android
Device ID: androidc######### [numbers removed for security]
Device OS: Android
Device user agent: Android-BBF100-2/8.1.0
Device IMEI:
Exchange ActiveSync version: 16.0
Device access state: Blocked
Device access state reason: Global

Answer 1

Hi @David Miller ,

After that was taken care of, the thread here outlines the issue. The phone was still blocked via some policy. It didn't show up as a quarantined phone, but adding "Android" to the device access rules page in the Exchange admin area solved the problem.

Great to know that you've already thought of a solution and really appreciate it for your sharing!
By the way, since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others.". and according to the scenario introduced here: Answering your own questions on Microsoft Q&A, I would make a brief summary of this thread:
[Issues getting an Android-based BlackBerry Key 2 access]

Issue Symptom:
I have a user with a BlackBerry Key2 running Android 8.1 (like all later BlackBerries use). This is an unmanaged device. He has no problem using the device on other O365 servers, but trying to get his email account to be accessible on his device. We are not trying to turn this into a managed device. After working through getting the BlackBerry Hub+ app enabled and assigned to him in Azure, he received the following message via email on his laptop. Help?
Subject: Your mobile device has been denied access to the server because of server policies.
Your device won't be able to synchronize with the server via Exchange ActiveSync because of an access policy defined on the server.
Information about your device:
Device model: Android
Device type: Android
Device ID: androidc######### [numbers removed for security]
Device OS: Android
Device user agent: Android-BBF100-2/8.1.0
Device IMEI:
Exchange ActiveSync version: 16.0
Device access state: Blocked
Device access state reason: Global

The Solution:
The solution was to have the BlackBerry on site and have the user try to add the O365 account into the Hub. The user ends up being prompted for an Azure admin to log in. doing this made the BlackBerry Hub+ appear in the users Azure app area. Going there to then assign that app to that user fixes the first step.
After that was taken care of, the thread here outlines the issue. The phone was still blocked via some policy. It didn't show up as a quarantined phone, but adding "Android" to the device access rules page in the Exchange admin area solved the problem.

---

You could click the "Accept Answer" button for this summary to close this thread, and this can make it easier for other community member's to see the useful information when reading this thread. Thanks!

Answer 2

Hi @David Miller ，
Are you using the Exchange online?
If so, you can check if the mobile device is quarantined in the Mobile device access list in the Classic EAC:
https://outlook.office365.com/ecp/?p=ActiveSyncAccess&form=eac
There you will see a list of quarantined devices and you can change the default policy.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 3

The solution to this problem is scattered across a number of different MSFT sites, so I'll briefly recap here how we solved it to help anyone else who runs into this.

The BlackBerry "Key" versions (Key 1 and Key 2) are Android-based phones who continue to make use of the BlackBerry Hub application to coordinate all inbound messages across several different platforms.

The issue was an inability to get a Key 2 connected to O365 email despite it working fine for multiple other similar O365 installations. In the other instances, under the user's Azure area there was a BlackBerry Hub+ app available. However, sometime in the last 6-8 weeks this app was no longer obtainable via a search inside the Azure app areas.

The solution was to have the BlackBerry on site and have the user try to add the O365 account into the Hub. The user ends up being prompted for an Azure admin to log in. doing this made the BlackBerry Hub+ appear in the users Azure app area. Going there to then assign that app to that user fixes the first step.

After that was taken care of, the thread here outlines the issue. The phone was still blocked via some policy. It didn't show up as a quarantined phone, but adding "Android" to the device access rules page in the Exchange admin area solved the problem.

David