In earlier versions of Exchange ActiveSync, HTML-formatted e-mail was rendered as plain text on the mobile client. When a mobile device was used to reply to or forward e-mail, the whole e-mail message was converted to plain text. Exchange 2007 lets users receive, read, reply to, or forward e-mail, and keeps the HTML formatting intact.

Exchange 2007 ActiveSync lets you flag an e-mail message for follow up directly on your mobile device, exactly as if you handled the message in Microsoft Office Outlook. You can also mark a flagged message as completed. If you are using Office Outlook 2007, any items that are flagged on your mobile device will also appear in the Outlook 2007 To-Do bar.

To minimize bandwidth and save space on your mobile device, Exchange ActiveSync downloads only a part of large messages. If you want to retrieve a whole message, you do not have to wait for the next complete synchronization. You can download the rest of the message immediately.

Exchange 2007 ActiveSync synchronizes information about attendee availability to your mobile device. When you view a meeting on your mobile device, you can view the attendee status for all Microsoft Exchange users. You can also view global address list information about any attendee that you select.

By default, only three days' worth of e-mail is synchronized to your mobile device. Exchange ActiveSync lets you search for older e-mail messages that are no longer stored on your device. You can enter a search term and select a date range, search all items in a specific folder, or search all folders. When a matching item is found, that item is downloaded to your device.

You can access documents remotely from your mobile device by using Exchange 2007 and the latest Windows Mobile client. If you receive an e-mail message that contains a link to a supported document type, such as Microsoft Word or Microsoft Excel, on a Windows SharePoint Services or Windows file share path, you can follow the link and access the document.

You can configure Exchange 2007 to require that a device password be entered on mobile devices after a period of inactivity. If you forget your device password, you can unlock your device by using a device recovery password.

You can enhance the security of a Windows Mobile device by configuring additional password requirement settings, such as password history tracking, password expiration, and by prohibiting passwords that are too simple. These settings let you prevent users from creating simple passwords, such as 1234, and prevent users from keeping those simple passwords for an indefinite length of time.

You can now configure and set your Out of Office status directly from your mobile device. Exchange ActiveSync retrieves your current Out of Office settings from the Microsoft Exchange server and lets you change your Out of Office status and your Out of Office auto-reply message.

In addition to supporting the synchronization of e-mail, contacts, and calendar items, Exchange ActiveSync supports synchronization of Tasks items.

The following figure illustrates a typical Exchange 2007 topology that is configured for Direct Push. This figure assumes that you have the Client Access server role and the Mailbox server role installed on two separate Exchange Server computers. You can also install both server roles on the same physical Exchange 2007 computer.

Direct Push Network Design

Direct Push operates in the following way:

1. A mobile device that is configured to synchronize with an Exchange 2007 server issues an HTTPS request to the server. This request is known as a ping. The request tells the server to notify the device if any items change in any folder that is configured to synchronize in the next 15 minutes. Otherwise, the server should return an HTTP 200 OK message. The mobile device will then stand by. The 15-minute time span is known as a heartbeat interval.
   
2. If no items change in 15 minutes, the server returns a response of HTTP 200 OK. The mobile device receives this response, resumes activity (known as waking up), and issues its request again. This restarts the process.
   
3. If any items change or new items are received within the 15-minute heartbeat interval, the server sends a response that informs the mobile device that there is a new or changed item and the name of the folder in which the new or changed item resides. After the mobile device receives this response, it issues a synchronization request for the folder that has the new or changed items. When synchronization is complete, the mobile device issues a new ping request and the whole process starts over.
   

Direct Push depends on network conditions that support a long-standing HTTPS request. If the carrier network for the mobile device or the firewall does not support long-standing HTTPS requests, the HTTPS request is stopped. The following steps describe how Direct Push operates when a mobile device's carrier network has a time-out value of 13 minutes.

1. A mobile device issues an HTTPS request to the server. The request tells the server to notify the device if any items change in any folder that is configured to synchronize in the next 15 minutes. Otherwise, the server should return an HTTP 200 OK message. The mobile device then stands by.
   
2. If the server does not respond after 15 minutes, the mobile device wakes up and concludes that the connection to the server was timed out by the network. The device reissues the HTTPS request. However, this time, the device uses a heartbeat interval of 8 minutes.
   
3. After 8 minutes, the server sends an HTTP 200 OK message. The device then tries to gain a longer connection by issuing a new HTTPS request to the server that has a heartbeat interval of 12 minutes.
   
4. After 4 minutes, a new e-mail message is received and the server responds by sending an HTTPS request that tells the device to synchronize. The device synchronizes and reissues the HTTPS request that has a heartbeat of 12 minutes.
   
5. After 12 minutes, if there are no new or changed items, the server responds by sending an HTTP 200 OK message. The device wakes up and concludes that network conditions will support a heartbeat interval of 12 minutes. The device then tries to gain a longer connection by reissuing an HTTPS request that has a heartbeat interval of 16 minutes.
   
6. After 16 minutes, no response is received from the server. The device wakes up and concludes that network conditions cannot support a heartbeat interval of 16 minutes. Because this failure occurred directly after the device tried to increase the heartbeat interval, it concludes that the heartbeat interval has reached its maximum limit. The device then issues an HTTPS request that has a heartbeat interval of 12 minutes because this was the last successful heartbeat interval.
   

The mobile device tries to use the longest heartbeat interval that the network supports. This extends battery life on the device and reduces the data that is transferred over the network. Mobile carriers can specify a maximum, minimum, and initial heartbeat value in the registry settings for the mobile device.

For more information about Direct Push and how to synchronize mobile devices with Exchange 2007, see the following topics:

• How to Configure Mobile Devices to Synchronize with Exchange Server
  
• Understanding Mobile Devices
  
• Understanding Mobile Device Connectivity
  

There are three primary types of authentication you can choose for Exchange ActiveSync: Basic authentication, certificate-based authentication, and token-based authentication. When you install the Client Access server role on a computer that is running Exchange 2007, Exchange ActiveSync is configured to use Basic authentication with SSL. To establish the SSL connection, certificate-based authentication requires that the mobile device have a valid client certificate that was created for user authentication. In addition, the mobile device must have a copy of the trusted root certificate from the server. If you choose token-based authentication, you must work with the token vendor for configuration.

Basic authentication is the simplest method of authentication. With Basic authentication, the server requests that the client submit a user name and a password. That user name and password are sent in clear text over the Internet to the server. The server verifies that the supplied user name and password are valid and then grants access to the client. By default, this kind of authentication is enabled for Exchange ActiveSync. However, we recommend that you disable Basic authentication unless you are also deploying SSL. When you use Basic authentication over SSL, the user name and password are still sent in plain text. But the communication channel is encrypted.

Certificate-based authentication uses a digital certificate to verify an identity. Certificate-based authentication provides a second set of credentials, in addition to the user name and password, which prove the identity of the user who is trying to access the mailbox resources that are stored on the Exchange 2007 server. A digital certificate consists of two components: the private key that is stored on the device and the public key that is installed on the server. If you configure Exchange 2007 to require certificate-based authentication for Exchange ActiveSync, only devices that meet the following criteria can synchronize with Exchange 2007:

• The device has a valid client certificate that was created for user authentication.
  
• The device has a trusted root certificate for the server to which they are connecting to establish the SSL connection.
  

Deploying certificate-based authentication prevents users who have only a user name and password from synchronizing with Exchange 2007. As an additional level of security, the client certificate for authentication can be installed only when the device is connected to a domain-joined computer through either Desktop ActiveSync 4.5 or a later version in Microsoft Windows XP or the Windows Mobile Device Center in Microsoft Windows Vista.

A token-based authentication system is a two-factor authentication system. Two-factor authentication is based on a piece of information the user knows, such as their password, and an external device that is usually in the form of a credit card or a key fob that a user can carry with them. Each device has a unique serial number. In addition to hardware tokens, some vendors offer software-based tokens that can run on mobile devices.

Tokens work by displaying a unique number, typically six digits long, that changes every 60 seconds. When a token is issued to a user, it is synchronized with the server software. To authenticate, the user enters their user name, password, and the number that is currently displayed on the token. Some token-based authentication systems also require the user to enter a PIN.

Token-based authentication is a strong form of authentication. The disadvantage to token-based authentication is that you must install authentication server software and deploy the authentication software on every user's computer or mobile device. There is also the risk that the user can lose the external device. This can be financially costly because you would have to replace lost external devices. However, the device is useless to a third party without the original user's authentication information.

There are several companies that issue token-based authentication systems. One company is RSA. Their product, SecurID, comes in a variety of forms that includes a key fob and a credit card. A one-time authentication code is issued through the token. Each authentication code is valid for 60 seconds. Most tokens also have an expiration indicator on the device, for example, a series of dots that disappear as the length of time that the code has left decreases. This helps prevent a user from entering the correct code, only to have it expire before the authentication process is completed. After authentication has finished, the user does not have to authenticate with a new code unless they are logged off, either by choice or because the device times out because of inactivity. For more information about how to configure a token-based authentication system, see the documentation for the particular system.

For more information about how to configure authentication for Exchange ActiveSync, see the following topics:

• How to Configure Basic Authentication for Exchange ActiveSync
  
• How to Configure Certificate-Based Authentication for Exchange ActiveSync
  
• How to Install Root Certification Authority Certificates on a Windows Mobile-based Device
  
• Managing Exchange ActiveSync Security
  

The following table describes several of the benefits of using ISA Server 2006 or IAG 2007 to protect client communications through Exchange ActiveSync.

ISA Server 2006 and IAG 2007 features for Exchange ActiveSync

Feature	Description
Exchange server locations are hidden	When you publish an application through ISA Server or IAG, you are protecting the server from direct external access because the name and IP address of the server cannot be viewed by the user. The user accesses the ISA Server computer or the IAG computer. These computers then forward the request to the server according to the conditions of the server publishing rule.
SSL Bridging and Inspection	SSL bridging protects against attacks that are hidden in SSL-encrypted connections. For SSL-enabled Web applications, after ISA Server receives the client's request, ISA Server decrypts it, inspects it, and ends the SSL connection with the client computer. The Web publishing rules determine how ISA Server communicates the request for the object to the published Web server. If the secure Web publishing rule is configured to forward the request by using Secure HTTP (HTTPS), ISA Server initiates a new SSL connection with the published server. Because the ISA Server computer is now an SSL client, it requires the published Web server to respond with a server-side certificate.

For more information visit the Microsoft Forefront Edge Security and Access Web site.

Mobile devices can store sensitive corporate data and provide access to many corporate resources. If a device is lost or stolen, that data can be compromised. Through Exchange ActiveSync policies, you can add a password requirement to your mobile devices. This requires that users enter a password to access their device. We recommend that, in addition to requiring a device password, you configure your devices to automatically prompt for a password after a period of inactivity. The combination of a device password and inactivity locking provides more security for your corporate data.

In addition to these features, Exchange 2007 provides remote device wipe. You can issue a remote wipe command from the Exchange Management Shell. Users can issue their own remote wipe commands from the Outlook Web Access user interface.

The remote device wipe feature also includes a confirmation function that writes a timestamp in the sync state data of the user's mailbox. This timestamp is displayed in Outlook Web Access and in the user's mobile device properties dialog box in the Exchange Management Console.

Local device wipe is the mechanism by which a device wipes itself without the request coming from the server. If your organization has implemented Exchange ActiveSync policies that specify a maximum number of password attempts and that maximum is exceeded, the device will perform a local device wipe. The result of a local device wipe is the same as that of a remote device wipe. The device is returned to its factory default condition. When a device performs a local device wipe, no confirmation is sent to the Exchange server.

To perform the following procedures, the account you use must be delegated the Exchange Server Administrator role and membership in the local Administrators group on the target server.

For more information about permissions, delegating roles, and the rights that are required to administer Exchange 2007, see Permission Considerations.

To use the Exchange Management Console to configure authentication for Exchange ActiveSync

1. In the Exchange Management Console, expand Server Configuration, and then click Client Access.

2. In the result pane, click the Exchange ActiveSync tab.

3. Select the Microsoft-Server-ActiveSync virtual directory.

4. In the action pane, under Microsoft-Server-ActiveSync, click Properties.

5. Click the Authentication tab.

6. Select or clear the Basic authentication (password is sent in clear text) check box.

7. Click Apply to save your changes or click OK to save your changes and close the Microsoft-Server-ActiveSync properties dialog box.

To use the Exchange Management Shell to configure authentication for Exchange ActiveSync

• Run the one of the following commands:

  Set-ActiveSyncVirtualDirectory -Identity :"ExchSrvr\Microsoft-Server-ActiveSync (Default Web Site)" -BasicAuthEnabled:$true 
  Set-ActiveSyncVirtualDirectory -Identity :"ExchSrvr\Microsoft-Server-ActiveSync (Default Web Site)" -BasicAuthEnabled:$false

For more information about syntax and parameters, see Set-ActiveSyncVirtualDirectory.

To perform the following procedures, the account you use must be delegated the Exchange View-Only Administrator role and membership in the local Administrators group on the target server.

For more information about permissions, delegating roles, and the rights that are required to administer Exchange 2007, see Permission Considerations.

To use Internet Information Services (IIS) Manager to configure authentication on the Exchange ActiveSync virtual directory

1. In Internet Information Services (IIS) Manager, select the Microsoft-Server-ActiveSync virtual directory, and then click Properties.

2. On the Directory Security tab, in Secure Communications, click Edit.

3. In Secure Communications, select Basic Authentication or Windows Authentication.

4. Click OK to apply your changes.

For more information about Exchange ActiveSync security, see:

• Managing Exchange ActiveSync Security
  
• How to Configure SSL for Exchange ActiveSync
  

To perform this procedure, the account you use must be delegated the Exchange Recipient Administrator role.

For more information about permissions, delegating roles, and the rights that are required to administer Exchange 2007, see Permission Considerations.

To use the Exchange Management Console to create an Exchange ActiveSync mailbox policy

1. In the console tree, expand the Organization Configuration node, and then click Client Access.

2. In the action pane, click New ActiveSync mailbox policy.

3. On the New ActiveSync Mailbox Policy wizard page, enter a name in the Mailbox policy name box.

4. Select one or more of the optional check boxes.

5. Click New to finish creating your mailbox policy.

6. Click Finish to close the New ActiveSync Mailbox Policy Wizard.

To use the Exchange Management Shell to create an Exchange ActiveSync mailbox policy

• Run the following command:

  New-ActiveSyncMaiboxPolicy -Name PolicyName -DevicePasswordEnabled:$false -AlphanumericDevicePasswordRequired:$false -MaxInactivityTimeDeviceLock:'unlimited' -MinDevicePasswordLength:$null -PasswordReciveryEnabled:$false -DeviceEncryptionEnabled:$false -AttachmentsEnabled:$true

  Note:
  This command creates a new mailbox policy that has the default settings. For more information about how to change the default settings on an Exchange ActiveSync mailbox policy, see How to Modify Exchange ActiveSync Mailbox Policy Settings.

For more information about syntax and parameters, see Get-ActiveSyncMailboxPolicy.

After you create an Exchange ActiveSync mailbox policy, you can add users to that Exchange ActiveSync mailbox policy. By default, users are not assigned to an Exchange ActiveSync mailbox policy. You can add a user to only one Exchange ActiveSync mailbox policy at a time. If you add a user to an Exchange ActiveSync mailbox policy and that user is a member of another Exchange ActiveSync mailbox policy, that user is removed from the original Exchange ActiveSync mailbox policy and added to the new Exchange ActiveSync mailbox policy. You can add users individually or add a filtered group of users to an Exchange ActiveSync mailbox policy.

To perform this procedure, the account you use must be delegated the Exchange Recipient Administrator role.

For more information about permissions, delegating roles, and the rights that are required to administer Exchange 2007, see Permission Considerations.

In addition, before you perform the following procedures, make sure that you have created an Exchange ActiveSync mailbox policy. For more information about how to create an Exchange ActiveSync mailbox policy, see How to Create an Exchange ActiveSync Mailbox Policy.

To use the Exchange Management Console to add users to an Exchange ActiveSync mailbox policy

1. In the console tree, expand the Recipient Configuration node, and then click Mailbox.

2. In the work pane, right-click the user who you want to assign to a policy, and then click Properties.

3. In the user's Properties dialog box, click Mailbox Features.

4. Click ActiveSync, and then click Properties.

5. Select the Apply an ActiveSync mailbox policy check box.

6. Click Browse to view the Select Exchange ActiveSync Mailbox Policy dialog box.

7. Select an available policy, and then click OK three times to apply your changes.

   Note:
   You can add multiple users to a policy at the same time. However, that task must be performed by using the Exchange Management Shell.

To use the Exchange Management Shell to add users to an Exchange ActiveSync mailbox policy

• Run the following command:

  Set-CASMailbox UserName -ActiveSyncMailboxPolicy(Get-ActiveSyncMailboxPolicy "Policy Name").Identity

To use the Exchange Management Shell to add all users to an Exchange ActiveSync mailbox policy

• Run the following command:

  Get-Mailbox | Set-CASMailbox -ActiveSyncMailboxPolicy(Get-ActiveSyncMailboxPolicy "Policy Name").Identity

To use the Exchange Management Shell to add a filtered list of users to an Exchange ActiveSync mailbox policy

• Run the following command:

  Get-Mailbox | where { $_.CustomAttribute1 -match "Manager"
   } | Set-CASMailbox -activesyncmailboxpolicy(Get-ActiveSyncMailboxPolicy "Policy Name").Identity

  Note:
  You can substitute CustomAttribute1 for any of the properties on the Get-Mailbox object. To view the full list, type: Get-Mailbox username |fl

For more information about syntax and parameters, see Set-CASMailbox, Get-ActiveSyncMailboxPolicy, and Get-Mailbox.

For more information about mobile mailbox policies, see the following topics:

• Managing Exchange ActiveSync with Policies
  
• Understanding Exchange ActiveSync Mailbox Policies
  
• How to Add Users to an Exchange ActiveSync Mailbox Policy
  

To perform this procedure, the account you use must be delegated the Exchange Recipient Administrator role.

For more information about permissions, delegating roles, and the rights that are required to administer Exchange 2007, see Permission Considerations.

To use the Exchange Management Console to configure access to Windows SharePoint Services document libraries and Windows file shares

1. Open the Exchange Management Console.

2. Under Server Configuration, select Client Access.

3. Select Exchange ActiveSync.

4. In the action pane, under Microsoft-Server-ActiveSync, click Properties.

5. Click the Remote File Servers tab.

6. Click the Block button to add host names of sites that clients are prohibited from accessing.

7. Click the Allow button to add host names of document libraries and shares that clients are permitted to access.

8. Use the list in the Unknown Servers section to specify the default action that should be taken when a client tries to access a file from a server that is not entered in either the Allow List or Block List.

9. Click the Configure button to enter the domain suffixes that should be treated as internal.

   Note:
   If you specify that a domain suffix should be treated as internal, the Exchange ActiveSync client will access the content by using the intranet connection instead of an Internet connection.

To use the Exchange Management Shell to configure access to Windows SharePoint Services document libraries and Windows file shares

• Run the following command to add two sites to the Block list and one to the Allow list, specify an internal domain suffix, and configure the default action to take when a client tries to access a file from a server that is not entered in the Allow or Block lists:

  Set-ActiveSyncVirtualDirectory -Identity:"ServerName\Microsoft-Server-ActiveSync (Default Web Site)" -RemoteDocumentsBlockedServers:"ServerName1,ServerName2" -RemoteDocumentsAllowedServers:"ServerName3" - RemoteDocumentsInternalDomainSuffixList:"DomainSuffix" -RemoteDocumentsActionForUnknownServers:"Block"

For more information about syntax and parameters, see Set-ActiveSyncVirtualDirectory.

To perform the procedures in this section, confirm the following:

• You have reviewed the manufacturer's documentation for the mobile device that you want to configure.
  
• Exchange ActiveSync is enabled on the Exchange 2007 computer that has the Client Access server role installed.
  

To configure a mobile device to use Exchange ActiveSync

1. On the mobile device, from the home screen, click Start, and then click ActiveSync.

2. Click Menu, and then click Configure Server.

3. Enter the server address. This is the same as your Microsoft Office Outlook Web Access server address.

4. If you have configured Exchange ActiveSync to require Secure Sockets Layer (SSL), select the This server requires an encrypted (SSL) connection check box.

5. Click Next.

6. Enter your user name, password, and domain.

7. Select the Save password check box.

8. Click Next.

9. Select the check box next to each type of information that you want to synchronize with the server, and then click Finish.

To perform this procedure, the account you use must be delegated the Exchange Organization Administrator role.

For more information about permissions, delegating roles, and the rights that are required to administer Exchange 2007, see Permission Considerations.

To use the Exchange Management Console to modify the properties on an Exchange ActiveSync virtual directory

1. In the Exchange Management Console, click Server Configuration, and then click Client Access.

2. In the work pane, click the Exchange ActiveSync tab.

3. In the action pane, under Microsoft-Server-ActiveSync, click Properties.

4. Modify the InternalURL and ExternalURL properties, and then click OK to apply your changes.

To use the Exchange Management Shell to modify the properties on an Exchange ActiveSync virtual directory

• Run the following command:

  Set-ActiveSyncVirtualDirectory -Identity "Server Name\Microsoft-Server-ActiveSync (Default Web Site)" -ExternalURL www.contoso.com/Microsoft-Server-ActiveSync -InternalURL $Null

To perform this procedure, the account you use must be delegated the Exchange Organization Administrator role.

For more information about permissions, delegating roles, and the rights that are required to administer Exchange 2007, see Permission Considerations.

Also, before you perform these procedures, confirm that you have enabled Exchange ActiveSync on the Exchange 2007 server that has the Client Access server role installed.

To enable or disable Exchange ActiveSync for a user by using the Exchange Management Console

1. Open the Exchange Management Console.

2. Under Recipient Configuration, select Mailbox.

3. Select Properties from the action pane or right-click the user's mailbox, and then click Properties.

4. Click the Mailbox Features tab.

5. Select Exchange ActiveSync and then click Disable or Enable.

6. Click OK.

To disable Exchange ActiveSync for a user by using the Exchange Management Shell

• Run one of the following commands:

  Set-CASMailbox -Identity<SMTP Address of user> -ActiveSyncEnabled $false
  Set-CASMailbox -Identity<SMTP Address of user> -ActiveSyncEnabled $true

For more information about syntax and parameters, see Set-CASMailbox.

To perform the following procedure, the account you use must be delegated the Exchange Recipient Administrator role and membership in the local Administrators group for the target server.

For more information about permissions, delegating roles, and the rights that are required to administer Exchange 2007, see Permission Considerations.

Also, before you perform this procedure, make sure that Exchange ActiveSync is enabled for the user.

To use the Exchange Management Shell to disable a device for Exchange ActiveSync

• To prevent a device from synchronizing with Microsoft Exchange, you must remove its device ID from the ActiveSyncAllowedDeviceIDs parameter list. To do this, run the following command:

  Set-CASMailbox -Identity: "EmailAlias" -ActiveSyncAllowedDeviceIDs: "<DeviceID_1>","<DeviceID_2>"

  Note:
  There is no built-in functionality for retrieving the device ID before the user synchronizes with the Exchange server. After the user has synchronized the device with the Exchange server, you can run the following command to retrieve the device ID:

  Get-ActiveSyncDeviceStatistics -Mailbox:"<EmailAlias>" |fl DeviceID 

For more information about syntax and parameters, see Set-CASMailbox.