Deprecating EAS support for Outlook for iOS & Android

Early this year, Microsoft completed the migration of Office 365 connections for Outlook for iOS & Android from our legacy, Amazon Web Services-based architecture (which uses EAS to sync mailbox data) to our new, Office 365-based architecture which uses REST to sync data. This means that Office 365 mailbox data is now fully delivered through Microsoft services that provide a strong commitment to security, privacy and compliance. REST also provides advanced features and capabilities to the Outlook app.

There is a very small subset of customers who are blocking REST access in their Office 365 tenants (either intentionally or unintentionally). To date, when REST is blocked, and the Outlook app is unable to connect to the Office 365 mailbox, the app falls back to the older, AWS-based architecture to continue email access. However, Microsoft is planning to fully disable the older AWS-based architecture on June 1^st, 2017.

If you are blocking REST access today, you will need to unblock it by June 1^st so that Outlook for iOS & Android can properly use REST to connect to Office 365. If REST access is properly enabled by June 1st, any users currently falling back to the older AWS-architecture using EAS will be migrated smoothly and automatically to REST. In limited cases, the user may see their inbox refresh with rare occurrence of needing to re-authenticate. The user will also now have access to several new features in the app which are enabled by REST.

If policies are configured to restrict REST access to messaging data, users will lose Outlook mail access when the AWS-based architecture is disabled on June 1^st.

The below information explains how REST access can be managed in an Office 365 tenant. If you are using Outlook for iOS & Android today, please check to ensure these controls are not blocking REST before June 1^st, 2017.

Note: The EAS protocol is not impacted by these changes. EAS can still used by other mobile email apps to sync mailbox information with Office 365. 

Managing REST access in your Office 365 tenant

The information below can also be found on TechNet. See “Enabling Outlook for iOS & Android in Exchange Online”.

EWS application policies

An EWS application policy can control whether or not applications are allowed to leverage the REST API. Note that when you configure an EWS application policy that only allows specific applications access to your messaging environment, you must add the user-agent string for Outlook for iOS & Android to the EWS allow list.

The following example shows how to add the user-agent strings to the EWS allow list:

Set-OrganizationConfig -EwsAllowList @{Add="Outlook-iOS/*","Outlook-Android/*"}

For more information, see How to: Control access to EWS in Exchange.

Enabling/Disabling EWS in your Office 365 tenant

In the event that you are not using an EWS application policy, but are controlling access to EWS, ensure that EWS is not disabled for your organization or the individual users you want using Outlook:

1. Example: Set-OrganizationConfig -EwsEnabled:$true
2. Example: Set-CASMailbox <mailbox> -EWSEnabled:$true

Client access rules

Client access rules are like transport rules for client connections to your Exchange Online environment. Conditions and exceptions are applied to each connection attempt based on the properties of the user or the properties of the client connection.

Because client access rules affect only the management of the protocol session that the client is utilizing, you will need to ensure that the REST API is allowed access (this is done with a client access rule). Otherwise, Outlook for iOS & Android users will not be able to connect and access their mailboxes.

The following example shows how to allow the REST API access:

New-ClientAccessRule -Action AllowAccess -Name AllowREST -AnyOfProtocols REST

Note that you can't use the AnyOfClientIPAddressesOrRanges parameter to manage Outlook for iOS & Android. This is due to the Office 365-based architecture that is leveraged by Outlook for iOS & Android.

Additional resources:

• New-ClientAccessRule
• Set-ClientAccessRule