Exchange Protection Integration II: Exchange Online with Basic Authentication

Create Service Account

• Navigate to Azure Active Directory
• Select Users
• Click + New User
• Enter a User name
  • e.g. silverback_exchange@imagoverum.com
• Enter a Name
  • e.g. Silverback Service
• Select let me create the password
• Enter a password
  • e.g. Pa$$w0rd
• Add the account to Groups and roles (optional)
• Click Create

Login and Update Password 

• Open a new inkognito window
• Open portal.azure.com
• Enter as username silverback_exchange@imagoverum.com
• Click Next
• Enter your previously created password
• Click Sign In
• Update your password
• Click Sign in
• Your service account is ready to use

Create new Role and grant access

• Select Roles
• Click Admin roles
• Select Add role group
• Enter a Name: e.g. Exchange Protection
• Enter a description (optional)
• Click Next
• Select the following permissions 
  • Mail Recipients
  • Organization Client Access
• Click Next
• Assign now your previously created service account
• Click Next
• Confirm with Add role Group
• Click Done

Create Device Mailbox Policy

• Navigate to Mobile
• Select Mobile device mailbox policies
• Click + New
• Enter a name for the profile
  • e.g.  Silverback Exchange Protection Policy
• Enable This is the default policy
• Press Next
• Press Create
• Press Save

Set Execution Policy

• Run PowerShell with administrative privileges
• Run the following command line to check your Status
  • get-executionpolicy
• If the answer is RemoteSigned you are ready
• If the answer is something else, please run the following command line
  • set-executionpolicy RemoteSigned
  • Confirm with Yes

Set Authentication

• Run the following command to get authentication info
  • winrm get winrm/config/client/auth
• If the value Basic=true is not set run the following command
  • winrm set winrm/config/client/auth @{Basic="true"}

Service Account Validation

• Run the following command

$UserCredential = Get-Credential

• Enter your Service Account, e.g. silverback_exchange@imagoverum.com
• Enter your updated password, e.g. Pa$$w0rd
• Click OK
• Create a new Session:

$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $UserCredential -Authentication Basic -AllowRedirection

• Import now the session with

Import-PSSession $Session -DisableNameChecking 

• To check functionality adjust and run the following command

get-casmailbox -Identity "tim.tober@imagoverum.com"

Additional commands  

• Check the following commands to get familiar with the handling

Get-ActiveSyncOrganizationSettings | ft DefaultAccessLevel

Get-MailboxStatistics -Identity username | fl

Get-MobileDeviceStatistics -Mailbox username

Get-CASMailbox -Identity username | fl *ActiveSync*

Get-CASMailbox -Identity username | select {$_.ActiveSyncAllowedDeviceIDs}

Get-CASMailbox -Identity username | select {$_.ActiveSyncBlockedDeviceIDs}

Get-MobileDevice | select UserDisplayName,DeviceID,DeviceType,DeviceUserAgent,DeviceModel,Name

Get-MobileDevice -Filter {DeviceAccessState -eq 'Quarantined'}

Get-MobileDevice -Mailbox username -Filter {DeviceAccessState -eq 'Quarantined'}

Set-CASMailbox -Identity username –ActiveSyncAllowedDeviceIDs DeviceID

| Export-CSV C:\file.csv

• To close the session execute the following command

 Remove-PSSession $Session

Configure Exchange Protection

• Login as an Administrator
• Navigate to Admin
• Navigate to Exchange Protection
• Enable Exchange Protection
• Select as Server Version Exchange Online
• Enter the following Server Address
  • e.g. https://outlook.office365.com/powershell-liveid/
• Enter as Username your Service Account
  • e.g. silverback_exchange@imagoverum.com
• Enter the corresponding Service Account Password
  • e.g. Pa$$w0rd
• Enter your previously created Device Mailbox Policy
  • e.g. Silverback Exchange Protection Policy
• Change Auth. Mechanism to Basic
• Click Save
• Confirm with Yes

Cloud Connector

• Logout as Administrator 
• Login as Settings Administrator
• Navigate to Cloud Connector
• Enable Exchange Protection Service
• Decrease the Exchange Task Interval (mins) to e.g. 1 Minute
• Press Save
• Confirm with OK
• Restart all Silverback and Cloud Connector services

Check for managed devices  

• Enroll a device and assign an Exchange Active Profile 
• Follow the configuration on your device as usual
• Check if you have access to emails, calendar and contacts
• Your newly enrolled device should now be whitelisted automatically
  • Navigate back to your Exchange Admin Center
  • Check that the device is not in quarantined state

Check for restricted devices  

• Use a different unenrolled device
• On the device, add your Exchange ActiveSync account manually 
  • For iOS and iPadOS devices,
    • Open Settings 
    • Navigate to Passwords & Accounts
    • Tab Add Account
    • Select Microsoft Exchange
    • Finish your configuration
  • For Android and Samsung devices
    • Open Gmail 
    • Tab on your current account
    • Choose Add another account
    • Select Exchange and Office 365
    • Finish your configuration
• Your unenrolled device should now be quarantined automatically
  • Navigate back to your Exchange Admin Center
  • Check that the device is in quarantined state