New Exchange ActiveSync Policies in Exchange 2007 SP1

I love science fiction, and I grew up on a steady diet of both classic SF novels and '70s SF movies and shows. I therefore haven't been that surprised to see powerful handheld computers becoming more and more common over the last few years; anyone who's familiar with Star Trek's communicators or Space: 1999's commlocks won't find the technical potential of these devices all that surprising.

However much fun these shows were to watch, though, they were mighty short on technical details. For example, I don't think I ever saw a character say, "Hey, do I have to install a DST update on this thing?" or "Mr. Spock, be sure that we've installed Service Pack 2 on all the tricorders before we beam down." In addition, no one ever worried about any of the common problems mobile device deployments face today, such as enforcing organizational security policies, enabling remote wipe for lost or stolen devices, and so on.

Enter Exchange ActiveSync (EAS), Microsoft's solution to these problems. As you probably know, EAS is actually a protocol that's implemented in two places: on the Exchange server and on a mobile device. In Exchange Server 2007, each mailbox can be associated with exactly one EAS policy. There's a default policy that applies to mailboxes that don't have explicit policies set. The policy associated with a mailbox defines which EAS options apply to devices that synchronize with that mailbox. In Exchange 2007 SP1, Microsoft added more than 30 new options to EAS, which initially had about 9 or 10; in other words, SP1 added more new options than the total number of options available before. These options offer many interesting possibilities, including the ability to turn off external connections through Wi-Fi and Bluetooth; options that restrict the use of POP and IMAP email; settings for controlling whether attachments and HTML messages can be used on the device; and improved password length, strength, and complexity options.

These new settings are described in the Microsoft article "Understanding Exchange ActiveSync Mailbox Policies." There are a couple of subtle points to note when reading the description, though. The first is that some policy options require the purchase of an Exchange Enterprise CAL. For example, the Allow Camera and Allow text messaging options are licensed only for Enterprise CAL mailboxes. Remember, the Enterprise CAL is an additive CAL that you purchase in addition to the Exchange Standard CAL; it offers a ton of other features as well as these EAS enhancements. If you've already purchased the Enterprise CAL for your users, consider the changes a freebie. Microsoft is evidently hoping that the new options will attract organizations that have so far held off on Enterprise CAL purchases.

The second point about these new EAS options is a little trickier. Remember that EAS is a two-part protocol: The server can send out any policy it wants, but implementation is up to the client. Depending on which clients you use, you might see radically different behavior. For example, Windows Mobile 6.0 supports several policy settings that Windows Mobile 5.0 doesn't. Third parties who have licensed EAS, such as Sony Ericsson and Palm, are free to implement as many, or as few, of the policy control mechanisms as they like. In practical terms, what this means is that even though you upgrade to Exchange 2007 SP1 and purchase Enterprise CALs for the mailboxes for which you want to use these new policy settings, the devices you have might not support them!

This situation goes back to the larger problem that Microsoft's Mobile Communication Business faces: Mobile device vendors don't have much incentive to make it easy for end users to upgrade their device software. Most vendors would rather sell you a new phone than take the time and effort necessary to certify software upgrades for existing devices. Accordingly, if you want to take advantage of these new EAS features, be sure that the devices you purchase will support the features you're most interested in.

Speaking of interest: What does Apple's new MacBook Air have in common with Exchange? Read next week's UPDATE to find out!