Prevent iOS Devices from Accessing Email Outside of Outlook

Who This Affects and What It Fixes

This guide is for small businesses using Microsoft 365 Exchange Online without Intune device management. If your employees use iPhones or iPads, those devices may be connecting to company email through native mail apps or other third-party clients that bypass your security controls. By enabling Modern Authentication, blocking legacy protocols like Exchange ActiveSync, and setting up Conditional Access policies, you can ensure that iOS users can only access company email through the Microsoft Outlook app — and you can further restrict what they can do with that data.

Step 1: Enable Modern Authentication and Block Legacy Protocols

1. Enable Modern Authentication for your Exchange Online environment. This requires users to sign in using modern authentication methods such as OAuth 2.0 rather than older, less secure login methods.
2. Disable Exchange ActiveSync (EAS). ActiveSync is an older protocol used by many built-in mobile mail clients. Disabling it prevents those apps from connecting to Exchange Online, where they can often bypass more granular security controls.
3. Confirm that going forward, users must access email only through approved Microsoft applications, specifically the Outlook for iOS and Android app.

Step 2: Configure a Conditional Access Policy

1. Sign in to the Microsoft Entra admin center.
2. Create a new Conditional Access policy and target the Office 365 ExchangeOnline cloud app.
3. Under client apps, select Mobile apps and desktop clients.
4. Under device platforms, select iOS.
5. Under Grant controls, enable both Require approved client app and Require app protection policy. These controls together ensure that only approved, managed apps can access company email and that app protection policies are enforced on those apps.

Step 3: Create and Link an App Protection Policy

1. In the Microsoft Entra admin center, create a new App Protection Policy scoped to iOS.
2. In the policy settings, configure data transfer restrictions. At a minimum, consider blocking Copy and paste, Save As, and Downloaded to device actions to limit how company data can be moved or stored on unmanaged devices.
3. Link this App Protection Policy to the Conditional Access policy you created in Step 2. This ensures the restrictions are enforced whenever a user on an unmanaged iOS device accesses Exchange Online through an approved app such as Outlook.

Need Help Setting This Up?

These configurations touch several layers of your Microsoft 365 environment. If you would like assistance implementing them correctly for your organization, contact the ACS team and we will be glad to help.

Common questions

Why can’t I just block all mobile access to company email?

Blocking all mobile access would prevent employees from using company email on their phones entirely, which is often not practical. The approach in this guide takes a middle path: it blocks unapproved apps and legacy protocols while still allowing access through the Outlook app, where you can control what users can do with company data.

Do my employees need to do anything after these policies are set up?

Yes. Once the Conditional Access policy is in place, any iOS user who tries to access Exchange Online through a native mail client or other unapproved app will be blocked. They will need to install the Microsoft Outlook app and sign in there instead. Users already on Outlook may be prompted to re-authenticate.

Does this setup require Intune or device enrollment?

No. This guide is specifically designed for businesses that do not use Intune. By combining Modern Authentication, blocking Exchange ActiveSync, and enforcing Conditional Access with app protection policies, you can protect Exchange Online email on unmanaged iOS devices without requiring full device enrollment.