Home

Block e-mail configuration on IOS

%3CLINGO-SUB%20id%3D%22lingo-sub-166774%22%20slang%3D%22en-US%22%3EBlock%20e-mail%20configuration%20on%20IOS%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-166774%22%20slang%3D%22en-US%22%3E%3CP%3EI%20started%20configuring%20in%20my%20environment%20a%20group%20of%20policies%20to%20block%20users%20to%20use%20e-mail%20account%20in%20apps%20that%20are%20only%20authorized%20for%20me.%3C%2FP%3E%0A%3CP%3EIt%20worked%20as%20well%20on%20Android%20Devices%20but%20in%20IOS%20devices%20it's%20not%20working%20properly.%3C%2FP%3E%0A%3CP%3EThe%20user%20try%20to%20configure%20your%20e-mail%20in%20the%20native%20mail%20and%20receive%20a%20message%20that%20need%20to%20use%20outlook.%3C%2FP%3E%0A%3CP%3EAfter%20install%20outlook%20the%20user%20receive%20a%20message%20that%20he%20needs%20to%20enroll%20the%20device%20to%20access%20your%20accout.%3C%2FP%3E%0A%3CP%3EBut%20after%20enroll%20the%20device%20and%20configure%20your%20account%20on%20outlook%2C%20the%20user%20tried%20configure%20your%20account%20on%20gmail%20app%20and%20he%20got%20it%20same%20using%20the%20conditional%20access%20rule%20saying%20that%20he%20only%20could%20use%20e-mail%20account%20on%20outlook.%3C%2FP%3E%0A%3CP%3Ewhy%20the%20condicional%20access%20don't%20block%20the%20configuration%20in%20gmail%20app%20like%20worked%20with%20the%20native%20app%3F%3C%2FP%3E%0A%3CP%3E%3CSPAN%3EAll%20users%20are%20in%20exchange%20online%20and%20the%20option%20in%26nbsp%3Bmy%20conditional%20access%26nbsp%3B%22require%20approved%20client%20app%22%20already%20is%26nbsp%3Bflagged.%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-166774%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EIntune%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-184079%22%20slang%3D%22en-US%22%3ERe%3A%20Block%20e-mail%20configuration%20on%20IOS%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-184079%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Ewithout%20any%20tests%20done%20I%20think%20Gmail%20app%20uses%20legacy%20auth%20and%20not%20modern%20auth%20to%20authenticate%20and%20therefore%20does%20not%20use%20Conditional%20Access.%3C%2FP%3E%3CP%3ETo%20block%20legacy%20auth%20for%20applications%20you%20can%20follow%20this%20and%20use%20ADFS%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EBlock%20apps%20that%20do%20not%20use%20modern%20authentication%20(ADAL)%3C%2FP%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fintune%2Fapp-modern-authentication-block%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fintune%2Fapp-modern-authentication-block%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Eor%20wait%20for%20native%20implementation%20to%20block%20legacy%20auth%20into%20Conditional%20Access%2C%20its%20titled%20as%20%22Coming%20soon%22%3A%3C%2FP%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fblogs.msdn.microsoft.com%2Fsamueld%2F2017%2F06%2F13%2Fchoosing-the-right-sign-in-option-to-connect-to-azure-ad-office-365%2F%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fblogs.msdn.microsoft.com%2Fsamueld%2F2017%2F06%2F13%2Fchoosing-the-right-sign-in-option-to-connect-to-azure-ad-office-365%2F%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CTABLE%20border%3D%221%22%3E%3CTBODY%3E%3CTR%3E%3CTD%3E%3CSTRONG%3EBlock%20legacy%20protocols%3C%2FSTRONG%3E%3C%2FTD%3E%3CTD%3EComing%20Soon%20(Premium)%3C%2FTD%3E%3C%2FTR%3E%3C%2FTBODY%3E%3C%2FTABLE%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-177999%22%20slang%3D%22en-US%22%3ERe%3A%20Block%20e-mail%20configuration%20on%20IOS%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-177999%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Tom%2C%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EWe%20already%20tried%20it%20here%2C%20but%20I%20still%20can%20configure%20my%20company%20account%20in%20the%20Gmail%20app%20on%20IOS.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-177778%22%20slang%3D%22en-US%22%3ERe%3A%20Block%20e-mail%20configuration%20on%20IOS%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-177778%22%20slang%3D%22en-US%22%3E%3CP%3EOne%20thing%20that%20you%20can%20do%20is%20disable%20IMAP%2FPOP%20from%20exchange%20online%20and%20prevent%20any%20devices%20from%20connecting%20with%20IMAP.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-170275%22%20slang%3D%22en-US%22%3ERe%3A%20Block%20e-mail%20configuration%20on%20IOS%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-170275%22%20slang%3D%22en-US%22%3EHi%20Paulo%3CBR%20%2F%3E%3CBR%20%2F%3EYup%2C%20all%20looks%20good%20to%20me.%20I've%20got%20the%20same%20settings%20(except%20we%20allow%20users%20to%20access%20email%20without%20enrollment%20so%20devices%20don't%20need%20to%20be%20marked%20as%20compliant%20for%20us).%3CBR%20%2F%3E%3CBR%20%2F%3EAfter%20further%20investigation%2C%20it%20appears%20that%20Gmail%20is%20using%20IMAP%20to%20access%20Exchange%20Online%2C%20which%20would%20explain%20why%20this%20policy%20doesn't%20pick%20it%20up.%3CBR%20%2F%3E%3CBR%20%2F%3EAt%20that%20point%20I'm%20not%20sure%20what%20can%20be%20done.%20I'm%20waiting%20to%20hear%20back%20from%20Premier%20Support%20on%20the%20issue%20to%20see%20what%20the%20official%20advice%20is.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-170148%22%20slang%3D%22en-US%22%3ERe%3A%20Block%20e-mail%20configuration%20on%20IOS%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-170148%22%20slang%3D%22en-US%22%3E%3CP%3EFollow%20my%20settings%3A%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20624px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F30074i1C39769A8A3C2918%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%221.JPG%22%20title%3D%221.JPG%22%20%2F%3E%3C%2FSPAN%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20613px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F30075iA819A7BD2D6D488E%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%222.JPG%22%20title%3D%222.JPG%22%20%2F%3E%3C%2FSPAN%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20929px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F30076iE255D26B0FE82274%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%223.JPG%22%20title%3D%223.JPG%22%20%2F%3E%3C%2FSPAN%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20932px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F30077i8B8DA5369684C999%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%224.JPG%22%20title%3D%224.JPG%22%20%2F%3E%3C%2FSPAN%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20614px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F30078i2B225D873AAE1C61%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%225.JPG%22%20title%3D%225.JPG%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-170130%22%20slang%3D%22en-US%22%3ERe%3A%20Block%20e-mail%20configuration%20on%20IOS%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-170130%22%20slang%3D%22en-US%22%3EHi%20Paulo.%20Can%20you%20post%20what%20settings%20you%20configured%3F%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-170129%22%20slang%3D%22en-US%22%3ERe%3A%20Block%20e-mail%20configuration%20on%20IOS%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-170129%22%20slang%3D%22en-US%22%3E%3CP%3EHy%20Daniel%2C%3C%2FP%3E%3CP%3EI%20tried%20to%20create%20the%20second%20CA%20rule%20but%20I%20receive%20a%20message%3A%3C%2FP%3E%3CP%3E%3CIMG%20alt%3D%22%22%20src%3D%22https%3A%2F%2Fimage.ibb.co%2Fg4OS07%2FMessage.jpg%22%20style%3D%22font-size%3A0.75em%3B%22%20%2F%3E%3C%2FP%3E%3CP%3EWhat%20could%20be%20%3F%20the%20message%20don't%20have%20any%20link%20to%20explain%20why%20the%20configuration%20is%20not%20supported.%3C%2FP%3E%3CP%3EThanks!%3C%2FP%3E%3CBR%20%2F%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-170089%22%20slang%3D%22en-US%22%3ERe%3A%20Block%20e-mail%20configuration%20on%20IOS%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-170089%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Paulo%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3EEdit%3A%20As%20I%20was%20typing%20this%20I've%20just%20tested%20this%20on%20my%20device%20and%20it%20seems%20that%20Gmail%20app%20on%20iOS%20does%20indeed%20allow%20users%20to%20set%20up%20their%20Office%20365%20mail%2C%20even%20if%20Conditional%20access%20requires%20the%20use%20of%20an%20approved%20app%20AND%20blocks%20ActiveSync%20connections.%20I'm%20going%20to%20raise%20this%20with%20Premier%20Support%20to%20investigate.%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EYou%20want%20to%20take%20a%20look%20here%20and%20make%20sure%20your%20conditional%20access%20policies%20are%20set%20up%20correctly%3A%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fintune%2Fexchange-online-protect%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fintune%2Fexchange-online-protect%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EEssentially%2C%20you%20need%20to%20set%20up%20one%20Conditional%20Access%20policy%20that%20forced%20iOS%20and%20Android%20users%20to%20use%20approved%20apps%20only%20(i.e.%20Outlook).%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThen%20set%20up%20a%20second%20Conditional%20Access%20policy%20that%20blocks%20the%20use%20of%20Activesync%20on%20iOS%20and%20Android%20for%20accessing%20Exchange%20Online.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ESo%20long%20as%20you%20ensure%20that%20ActiveSync%20connections%20are%20blocked%2C%20then%20it%20should%20prevent%20the%20Gmail%20app%20on%20iOS%20devices%20from%20being%20used.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-168913%22%20slang%3D%22en-US%22%3ERe%3A%20Block%20e-mail%20configuration%20on%20IOS%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-168913%22%20slang%3D%22en-US%22%3E%3CP%3ENobody%20%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E
Deleted
Not applicable

I started configuring in my environment a group of policies to block users to use e-mail account in apps that are only authorized for me.

It worked as well on Android Devices but in IOS devices it's not working properly.

The user try to configure your e-mail in the native mail and receive a message that need to use outlook.

After install outlook the user receive a message that he needs to enroll the device to access your accout.

But after enroll the device and configure your account on outlook, the user tried configure your account on gmail app and he got it same using the conditional access rule saying that he only could use e-mail account on outlook.

why the condicional access don't block the configuration in gmail app like worked with the native app?

All users are in exchange online and the option in my conditional access "require approved client app" already is flagged.

9 Replies

Nobody ?

Hi Paulo

 

Edit: As I was typing this I've just tested this on my device and it seems that Gmail app on iOS does indeed allow users to set up their Office 365 mail, even if Conditional access requires the use of an approved app AND blocks ActiveSync connections. I'm going to raise this with Premier Support to investigate.

 

You want to take a look here and make sure your conditional access policies are set up correctly: https://docs.microsoft.com/en-us/intune/exchange-online-protect

 

Essentially, you need to set up one Conditional Access policy that forced iOS and Android users to use approved apps only (i.e. Outlook).

 

Then set up a second Conditional Access policy that blocks the use of Activesync on iOS and Android for accessing Exchange Online.

 

So long as you ensure that ActiveSync connections are blocked, then it should prevent the Gmail app on iOS devices from being used.

Hy Daniel,

I tried to create the second CA rule but I receive a message:

What could be ? the message don't have any link to explain why the configuration is not supported.

Thanks!


Hi Paulo. Can you post what settings you configured?

Follow my settings:

1.JPG2.JPG3.JPG4.JPG5.JPG

Hi Paulo

Yup, all looks good to me. I've got the same settings (except we allow users to access email without enrollment so devices don't need to be marked as compliant for us).

After further investigation, it appears that Gmail is using IMAP to access Exchange Online, which would explain why this policy doesn't pick it up.

At that point I'm not sure what can be done. I'm waiting to hear back from Premier Support on the issue to see what the official advice is.

One thing that you can do is disable IMAP/POP from exchange online and prevent any devices from connecting with IMAP. 

Hi Tom,

 

We already tried it here, but I still can configure my company account in the Gmail app on IOS.

 

Hi,

 

without any tests done I think Gmail app uses legacy auth and not modern auth to authenticate and therefore does not use Conditional Access.

To block legacy auth for applications you can follow this and use ADFS:

 

Block apps that do not use modern authentication (ADAL)

https://docs.microsoft.com/en-us/intune/app-modern-authentication-block

 

or wait for native implementation to block legacy auth into Conditional Access, its titled as "Coming soon":

https://blogs.msdn.microsoft.com/samueld/2017/06/13/choosing-the-right-sign-in-option-to-connect-to-...

 

Block legacy protocolsComing Soon (Premium)
Related Conversations
Extentions Synchronization
Deleted in Discussions on
3 Replies
Tabs and Dark Mode
cjc2112 in Discussions on
38 Replies
flashing a white screen while open new tab
Deleted in Discussions on
14 Replies
Stable version of Edge insider browser
HotCakeX in Discussions on
35 Replies
Security Community Webinars
Valon_Kolica in Security, Privacy & Compliance on
13 Replies