Exchange 2010 + Android 4.1 = no ActiveSync

[Heintraag]

Read the title that is pretty much how we experience it currently. All new users who choose a new device get Android 4.1 and the native email client on those phones does not get along with the security settings Exchange asks for. The only thing we have activated is the ability to wipe a device remotely and that we ask the user to set a pin number.

Older devices with Android 2.2 for example have no problems. Those are all HTC wildfire devices.

We did a log export on a device which could not setup activesync and did see a mentioning of Foldersetup policy going wrong but got no further with that.

So, has anyone else been able to succesfully link a jellybean phone to exchange 2010 via activesync??

[PaulCunningham]

Interesting. I'll see if I can get one up in my emulator and whether it has the same issue.

[Heintraag]

This a partial log file generated by a samsung galaxy SII when trying to connect to Exchange.

[10:16:43] ExchangeService| Provision confirmation received for PART set
[10:16:43] ExchangeService| !!! EAS ExchangeService, onDestroy
[10:16:47] ExchangeService| !!! EAS ExchangeService, onCreate
[10:16:47] AbstractSyncService| Testing EAS: mobile.yourdomain.nl, user@yourdomain.nl, ssl = 1
[10:16:47] ExchangeService| !!! EAS ExchangeService, onStartCommand, startingUp = false, running = false
[10:16:47] ExchangeService| Reconciling accounts...
[10:16:47] ExchangeService| !!! EAS ExchangeService, stopping self
[10:16:47] AbstractSyncService| Validation (OPTIONS) response: 200
[10:16:47] AbstractSyncService| Server supports versions: 2.0,2.1,2.5,12.0,12.1,14.0,14.1
[10:16:47] AbstractSyncService| Try folder sync
[10:16:51] AbstractSyncService| Testing EAS: mobile.yourdomain.nl, user@yourdomain.nl, ssl = 1
[10:16:51] AbstractSyncService| Validation (OPTIONS) response: 200
[10:16:51] AbstractSyncService| Server supports versions: 2.0,2.1,2.5,12.0,12.1,14.0,14.1
[10:16:52] AbstractSyncService| Try folder sync
[10:16:53] AbstractSyncService| Testing EAS: mobile.yourdomain.nl, user@yourdomain.nl, ssl = 1
[10:16:54] AbstractSyncService| Validation (OPTIONS) response: 200
[10:16:54] AbstractSyncService| Server supports versions: 2.0,2.1,2.5,12.0,12.1,14.0,14.1
[10:16:54] AbstractSyncService| Try folder sync
[10:17:11] EAS Parser| <FolderSync>
[10:17:11] EAS Parser| <FolderStatus>
[10:17:11] EAS Parser| FolderStatus: 142
[10:17:11] EAS Parser| </FolderStatus>
[10:17:11] AbstractSyncService| FolderSync failed: 142 (NotProvisioned)

[PaulCunningham]

[10:17:11] AbstractSyncService| FolderSync failed: 142 (NotProvisioned)

Try (just as a test) allowing non-provisionable devices in your ActiveSync policy. To do this safely perhaps set up a new policy and assign it just to the mailbox you're using for this testing.

Maybe the new Android version, or the phone model itself, is tripping up on that setting.

SDK manager didn't offer me a download for the newest version of Android so I haven't been able to test this in the emulator.

[Heintraag]

I figured you would ask this so we have tested with the non-provisionable devices group and then they do work. Even my custom jelly bean rom now can hook onto exchange and start downloading mail.

But our management wants security as tight as possible so they feel this group is not really an option. What are exactly the risks of having people in the non-provi group? Less secure?

[PaulCunningham]

If you want to do it on a case by case basis for people you trust to secure their phones with a pass code etc, then that is up to you and your management.

Depends how you want to balance security with convenience.

I've worked plenty of places where they would just say no, you can't use that phone because of this issue.

[Heintraag]

So it is a case of do we trust our employees to secure their phone and put them in the non-supported devices group or wait until android fixes the exchange incompatibility issue? Or for us to find a third-party program which can handle the exchange security settings.

Ok. Can do. Thanks Paul!