block mobile access exchange online

Question

so we have some users that have figured out how to add company email (exchange online) to their personal mobile devices) These Devices are not being managed by Intune so we really dont have any control over them as far as remote wipe capability or application control. How can we block this from happening ?. Can we also Allow this functionality for a select group of users?
Thanks,

Answer 1

NO this does not work .
This blocks ActiveSync for everyone

Answer 2

Block by requiring the devices to be compliant
https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/outlook-for-ios-and-android/secure-outlook-for-ios-and-android

Answer 3

we are not using conditional access in this tenant . we are using security defaults.
i believe conditional access is required for this approach ?

Answer 4

fair enough . i though there may be some way to block ActiveSync on a per user basis like such with exchange on-prem.

Microsoft Outlook for iOS and Android uses ActiveSync correct?
If i disabled Activesync for a specific users mailbox would that not block them from adding exchange mailbox on the phone ?

Answer 5

You can block Outlook Mobile specifically:

set-casmailbox <user> -OutlookMobileEnabled $false  

https://learn.microsoft.com/en-us/powershell/module/exchange/set-casmailbox?view=exchange-ps

You can also block ActiveSync of course

or block by device or use rules:
https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/outlook-for-ios-and-android/secure-outlook-for-ios-and-android#option-1-block-all-email-apps-except-outlook-for-ios-and-android

https://learn.microsoft.com/en-us/powershell/module/exchange/new-activesyncdeviceaccessrule?view=exchange-ps