Active Sync

📱 Mirket ActiveSync MFA Integration for Microsoft Exchange

Mirket ActiveSync MFA agent brings Multi-Factor Authentication to the Exchange ActiveSync layer, enabling an additional security layer for mobile device access. This ensures that newly syncing devices go through a user-approved MFA flow before being granted access.

---

📦 Agent Download & Installation

🧭 Where to Download

The agent can be downloaded from the Mirket Portal:

Path: Configuration → Active Sync → Manage → Full Setup

🛠 Installation Steps

1. Download and unzip the package.

2. Open the extracted folder MirketActiveSync.

3. Edit the config.json file and fill in:

   • accountId

   • apiKey These values can be retrieved from the Mirket Admin Portal.

4. Save and close the file.

5. Run the install.bat script as Administrator to complete the installation.

After installation, a Windows service named:

MirketActiveSyncAgentService

will be created.

---

👤 Service Account Configuration

1. Open Services on the Exchange server.

2. Locate and double-click MirketActiveSyncAgentService.

3. Go to the Log On tab.

4. Enter credentials of a user who has permission to run Exchange Management Shell.

5. Click OK.

6. Start or Restart the service to activate the agent.

---

📲 Exchange Quarantine Settings for New Devices

To ensure that all newly connecting devices go into quarantine by default (and thus go through the Mirket MFA flow), run the following command in Exchange Management Shell:

Safely Changing ActiveSync DefaultAccessLevel to “Quarantine”

⚠️ Important Warning

Before changing the DefaultAccessLevel to Quarantine, make sure all existing devices are explicitly set to “Allowed (Individual)”. Otherwise, any devices currently inheriting the default policy (Global or Inherited devices) will immediately fall into quarantine once the default policy is changed.

---

1) Check the current default behavior

Get-ActiveSyncOrganizationSettings | fl DefaultAccessLevel

---

2) Mark all existing devices as “Allowed (Individual)”

The following script retrieves each user’s mailbox, gets their connected device IDs, and adds them to their personal Allowed Device List (without removing existing entries).

# Get all mailboxes, use identity as string
$users = Get-Mailbox -ResultSize Unlimited | Select-Object Alias,PrimarySmtpAddress,DistinguishedName

foreach ($u in $users) {
    # Use mailbox identity as string (PrimarySmtpAddress is the most reliable)
    $mbxId = $u.PrimarySmtpAddress.ToString()

    try {
        # Retrieve device IDs, skip empty ones, and make unique
        $ids = Get-MobileDevice -Mailbox $mbxId -ErrorAction Stop |
               Where-Object { $_.DeviceID } |
               Select-Object -ExpandProperty DeviceID |
               Sort-Object -Unique

        if ($ids -and $ids.Count -gt 0) {
            # To append to the existing list (without removing current entries):
            Set-CASMailbox -Identity $mbxId -ActiveSyncAllowedDeviceIDs @{Add=$ids}

            Write-Host "OK: Added $($ids.Count) devices for $mbxId."
        } else {
            Write-Host "Skip: No devices found for $mbxId."
        }
    }
    catch {
        Write-Warning "Fail: $mbxId -> $($_.Exception.Message)"
    }
}

Optional verification: randomly check a few users

Get-CASMailbox -Identity [email protected] | fl ActiveSyncAllowedDeviceIDs

---

3) Change the default behavior to “Quarantine”

Once all existing devices are whitelisted, run:

Set-ActiveSyncOrganizationSettings -DefaultAccessLevel Quarantine

Verify the change:

Get-ActiveSyncOrganizationSettings | fl DefaultAccessLevel

---

4) Expected behavior

• Existing devices: Remain allowed because they are explicitly set as “Individual Allowed”.

• Newly connecting devices: Are automatically quarantined and await admin approval.

✅ Note: Mirket does not interfere with existing devices — only newly detected devices are affected.

🔄 5. How It Works

Once installed and configured:

• The agent monitors quarantined device events on the Exchange server.

• When a new device enters quarantine, its details (including Display Name) are sent to the Mirket Portal.

• Device-to-user matching is done using Display Name, so this must be consistent with what’s used in Mirket.

---

🔔 6. Device Approval Workflow

✅ If Mirket Push is Enabled (default: disabled):

• When a matching user is found, a Push Notification is sent to the user.

• If the user approves, the agent automatically removes the device from quarantine.

• Approval takes effect within 10–15 seconds.

🛠 Admin Options:

1. In the Mirket Admin Portal → Configuration → Active Sync, admins can:

   • View quarantined devices

   • Manually approve and remove devices from quarantine

2. Users can also:

   • Log into the User Portal

   • Navigate to Settings → Devices

   • View and manually approve their quarantined devices

---

🔍 7. Viewing Quarantined Devices (PowerShell)

To list recently quarantined devices:

Get-MobileDevice -Filter {DeviceAccessState -eq "Quarantined"}

🔗 The DisplayName must match what’s used in the Mirket Portal for proper user association.

---

✅ Summary

Component	Description
Agent Location	Installed on the Exchange Server
Service Name	MirketActiveSyncAgentService
Quarantine Required?	Yes – enforced via Set-ActiveSyncOrganizationSettings
User Matching	By Display Name
Approval Methods	Push Notification, Admin Approval, User Portal