# Default Mobile Device Mailbox Policy > Controls the default ActiveSync mobile device policy applied to mailboxes, managing security requirements for devices that sync email via Exchange. Controls the default ActiveSync mobile device policy applied to mailboxes, managing security requirements for devices that sync email via Exchange. ## Settings this baseline controls | Setting | What it does | | ------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Previous passwords remembered | Number of previous passwords that cannot be reused. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-mobiledevicemailboxpolicy?view=exchange-ps) | | Days until password expires | Number of days before a password expires. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-mobiledevicemailboxpolicy?view=exchange-ps) | | Minimum complex characters | Minimum number of complex characters required in a password. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-mobiledevicemailboxpolicy?view=exchange-ps) | | Minimum password length | Minimum password length required. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-mobiledevicemailboxpolicy?view=exchange-ps) | | Minutes before device locks | Maximum minutes of inactivity before the device locks. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-mobiledevicemailboxpolicy?view=exchange-ps) | | Device encryption required | Specifies whether device encryption is required. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-mobiledevicemailboxpolicy?view=exchange-ps) | | Device encryption enabled | Specifies whether device encryption is enabled. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-mobiledevicemailboxpolicy?view=exchange-ps) | | Alphanumeric password required | Specifies whether an alphanumeric password is required. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-mobiledevicemailboxpolicy?view=exchange-ps) | **2 more settings** | Setting | What it does | | ------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Simple passwords allowed | Specifies whether simple passwords are allowed. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-mobiledevicemailboxpolicy?view=exchange-ps) | | Device password required | Specifies whether a device password is required. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-mobiledevicemailboxpolicy?view=exchange-ps) | [Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/) — Add, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme. ## Configure it This baseline sets Exchange Online's **default** mobile device mailbox policy for the whole tenant: the policy every mailbox gets over ActiveSync unless it's been assigned a different one. 1. **Add the baseline to the tenant** ([Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/)), or deploy it to many tenants at once as part of a scheme ([Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)). 2. Leave **Device password required** on, with **Simple passwords allowed** off, **Minimum password length** at `4`, **Minimum complex characters** at `1`, and **Previous passwords remembered** at `5`. **Alphanumeric password required** stays off, so a numeric device PIN that meets the other rules is enough. 3. Leave **Days until password expires** and **Minutes before device locks** set to `Unlimited`, so the baseline doesn't force a password change or an inactivity lock. 4. Leave **Device encryption required** and **Device encryption enabled** on, so a device can only sync once it's encrypted. 5. This baseline targets the tenant's existing **default** policy; Octiga doesn't create a new one. Every Exchange Online tenant ships with a default policy, so there's nothing to set up first. 6. Save. Turn on **Auto-remediation** and Octiga writes these values back to the default policy automatically if it's changed in Microsoft 365. > **Caution:** Because this is the **default** policy, tightening it can affect every mobile device in the > tenant that doesn't have its own policy assigned. Check for devices that would fail these > requirements before enforcing. ## Check it worked **Passing** means the tenant's default mobile device mailbox policy has all of the values above. You can see most of them in the Exchange admin centre, under **Mobile → Mobile Device Mailbox Policies**; open the policy marked as the default. A user whose device already meets the requirements notices nothing; one who doesn't is prompted to set a device password or enable encryption the next time their device checks in, and is blocked from syncing until they do. ## Standards this addresses ### CIS - **v8 4.1** — CIS Controls v8 Safeguard 4.1 - **v8 3.6** — CIS Controls v8 Safeguard 3.6 ### NIST - **PR.DS-1** — NIST CSF 2.0 PR.DS-1 - **SC-28** — NIST SP 800-53 SC-28 - **CM-6** — NIST SP 800-53 CM-6 ### ISO 27001 - **A.8.13** — ISO/IEC 27001:2022 Annex A.8.13 - **A.8.22** — ISO/IEC 27001:2022 Annex A.8.22 ### GDPR - **Article 32** — GDPR Article 32 **Doing this for every tenant?** Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time. [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)