# Mobile Access

> The baseline that configures the default mobile device mailbox policy for Exchange Online.

Mobile Access has one baseline: the tenant's Default Mobile Device Mailbox Policy. Exchange Online applies it over Exchange ActiveSync to any mailbox without a more specific policy, which in most tenants Octiga manages means every mailbox.

## Why it matters

A phone's built-in mail app is one of the most common ways people reach company email, and phones are easy to lose. Without a mailbox policy behind it, ActiveSync syncs mail, contacts and calendar to a device with no passcode, no encryption, and no way to wipe it remotely if it's lost or stolen. Because this is the tenant's *default* policy, setting it once protects every phone that connects from then on, not only the ones someone remembered to configure by hand.

## How Microsoft evaluates it

A mobile device mailbox policy is an Exchange Online object with its own settings: whether a password is required, minimum password length and complexity, device and storage-card encryption, inactivity lock timeout, and whether non-provisionable devices (ones that can't enforce every setting) can connect at all. It applies to a mailbox when a device tries to connect over Exchange ActiveSync. Every tenant has one default policy, assigned automatically to any mailbox without its own; a device is evaluated against it, and against Exchange's separate mobile device access rules, each time it checks in. ([Microsoft Learn: Mobile device mailbox policies in Exchange Online](https://learn.microsoft.com/exchange/clients-and-mobile-in-exchange-online/exchange-activesync/mobile-device-mailbox-policies))

## What end users experience

The first time a user connects their phone's mail app to a mailbox this policy covers, they're asked to set a device passcode (or meet whatever else the policy requires) before sync completes. It's part of setting up the connection, not a separate warning. A device that can't meet the policy, or is disallowed as non-provisionable, can't connect at all rather than connecting with less protection. A device that already meets the policy sees no change when it's applied or tightened; the prompt appears only for a newly connecting device, or one that no longer meets a stricter requirement.

| Baseline                                                                                                             | Scope  | Licence |
| -------------------------------------------------------------------------------------------------------------------- | ------ | ------- |
| [Default Mobile Device Mailbox Policy](https://docs.octiga.io/baselines/mobile-access/mobile-device-mailbox-policy/) | Tenant | —       |