Default Mobile Device Mailbox Policy

Controls the default ActiveSync mobile device policy applied to mailboxes, managing security requirements for devices that sync email via Exchange.

Settings this baseline controls

Setting	What it does
Previous passwords remembered	Number of previous passwords that cannot be reused. Learn more
Days until password expires	Number of days before a password expires. Learn more
Minimum complex characters	Minimum number of complex characters required in a password. Learn more
Minimum password length	Minimum password length required. Learn more
Minutes before device locks	Maximum minutes of inactivity before the device locks. Learn more
Device encryption required	Specifies whether device encryption is required. Learn more
Device encryption enabled	Specifies whether device encryption is enabled. Learn more
Alphanumeric password required	Specifies whether an alphanumeric password is required. Learn more

2 more settings

Setting	What it does
Simple passwords allowed	Specifies whether simple passwords are allowed. Learn more
Device password required	Specifies whether a device password is required. Learn more

Adding a baselineAdd, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme.→

Configure it

This baseline sets Exchange Online’s default mobile device mailbox policy for the whole tenant: the policy every mailbox gets over ActiveSync unless it’s been assigned a different one.

1. Add the baseline to the tenant (Adding a baseline), or deploy it to many tenants at once as part of a scheme (Deploying a scheme).

2. Leave Device password required on, with Simple passwords allowed off, Minimum password length at 4, Minimum complex characters at 1, and Previous passwords remembered at 5. Alphanumeric password required stays off, so a numeric device PIN that meets the other rules is enough.

3. Leave Days until password expires and Minutes before device locks set to Unlimited, so the baseline doesn’t force a password change or an inactivity lock.

4. Leave Device encryption required and Device encryption enabled on, so a device can only sync once it’s encrypted.

5. This baseline targets the tenant’s existing default policy; Octiga doesn’t create a new one. Every Exchange Online tenant ships with a default policy, so there’s nothing to set up first.

6. Save. Turn on Auto-remediation and Octiga writes these values back to the default policy automatically if it’s changed in Microsoft 365.

Caution

Because this is the default policy, tightening it can affect every mobile device in the tenant that doesn’t have its own policy assigned. Check for devices that would fail these requirements before enforcing.

Check it worked

Passing means the tenant’s default mobile device mailbox policy has all of the values above. You can see most of them in the Exchange admin centre, under Mobile → Mobile Device Mailbox Policies; open the policy marked as the default. A user whose device already meets the requirements notices nothing; one who doesn’t is prompted to set a device password or enable encryption the next time their device checks in, and is blocked from syncing until they do.

Standards this addresses

CISv8 4.1v8 3.6

NISTPR.DS-1SC-28CM-6

ISO 27001A.8.13A.8.22

GDPRArticle 32

Doing this for every tenant?

Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time.

Deploying a scheme→