Skip to content
exonaut

mobileDeviceMailboxPolicies

Mobile Device Policies. ActiveSync policies setting PIN, encryption, and wipe rules on devices. The mobileDeviceMailboxPolicies entity set lives under /exchange/v1.0/mobileDeviceMailboxPolicies in the Devices & mobile category.

Fact Value
Path /exchange/v1.0/mobileDeviceMailboxPolicies
Category Devices & mobile
Tier Tier 9, Hybrid and organization
Read role Device.Read.All (Community)
Write role Device.ReadWrite.All (Pro)
Backing cmdlets Get-MobileDeviceMailboxPolicy, Set-MobileDeviceMailboxPolicy, New-MobileDeviceMailboxPolicy, Remove-MobileDeviceMailboxPolicy

Routes

Section titled “Routes”
Method Path Synopsis Role Plan
GET /exchange/v1.0/mobileDeviceMailboxPolicies List mobileDeviceMailboxPolicies entries. Device.Read Community
POST /exchange/v1.0/mobileDeviceMailboxPolicies Create a new mobileDeviceMailboxPolicies entry. Body keys map 1:1 to New-MobileDeviceMailboxPolicy params (camelCased). Required: name. Returns 201 + Location + the freshly-fetched policy. Device.ReadWrite Pro
GET /exchange/v1.0/mobileDeviceMailboxPolicies/{key} Get a single mobileDeviceMailboxPolicies entry by Identity (Name or GUID). Device.Read Community
PATCH /exchange/v1.0/mobileDeviceMailboxPolicies/{key} Partial update of the mobileDeviceMailboxPolicies at /mobileDeviceMailboxPolicies/{key}. Body keys map 1:1 to Set-MobileDeviceMailboxPolicy params. Use name to rename. Returns 200 + the post-Set policy. Device.ReadWrite Pro
DELETE /exchange/v1.0/mobileDeviceMailboxPolicies/{key} Remove the mobileDeviceMailboxPolicies at /mobileDeviceMailboxPolicies/{key}. Returns 204. The system Default policy cannot be removed - cmdlet rejects with a tenant-side error. Device.ReadWrite Pro

GET /exchange/v1.0/mobileDeviceMailboxPolicies

Section titled “GET /exchange/v1.0/mobileDeviceMailboxPolicies”

List mobileDeviceMailboxPolicies entries.

Backing cmdlet: Get-MobileDeviceMailboxPolicy. Role: Device.Read (Community).

List all mobile device mailbox policies

Section titled “List all mobile device mailbox policies”

List the tenant’s ActiveSync mobile device mailbox policies. Each tenant ships with one ‘Default’ policy; admins can create additional named policies and assign them to specific mailboxes via Set-CASMailbox -ActiveSyncMailboxPolicy.

GET /exchange/v1.0/mobileDeviceMailboxPolicies HTTP/1.1
Authorization: Bearer {token}
HTTP/1.1 200 OK


{
  "@odata.context": "https://api.contoso.com/exchange/v1.0/$metadata#mobileDeviceMailboxPolicies",
  "value": [
    {
      "Id": "Default",
      "Name": "Default",
      "Identity": "Default",
      "IsDefault": true,
      "IsValid": true,
      "PasswordEnabled": false,
      "AllowSimplePassword": true,
      "AllowCamera": true,
      "AllowWiFi": true,
      "AllowBluetooth": true,
      "AllowConsumerEmail": true,
      "AllowHTMLEmail": true,
      "AttachmentsEnabled": true,
      "IrmEnabled": false,
      "WhenCreated": "2024-01-01T00:00:00Z"
    }
  ]
}

Related: GET /exchange/v1.0/mobileDeviceMailboxPolicies/{key}, POST /exchange/v1.0/mobileDeviceMailboxPolicies, PATCH /exchange/v1.0/mobileDeviceMailboxPolicies/{key}, DELETE /exchange/v1.0/mobileDeviceMailboxPolicies/{key}

POST /exchange/v1.0/mobileDeviceMailboxPolicies

Section titled “POST /exchange/v1.0/mobileDeviceMailboxPolicies”

Create a new mobileDeviceMailboxPolicies entry. Body keys map 1:1 to New-MobileDeviceMailboxPolicy params (camelCased). Required: name. Returns 201 + Location + the freshly-fetched policy.

Newly created policies start unassigned - call PATCH on individual mailboxes (via Set-CASMailbox -ActiveSyncMailboxPolicy <name>) to attach them. The full Wiki SYNTAX has ~55 device-feature params; the API exposes the ~30 most-used (password policy, encryption, common device toggles, email content, SMIME, IRM). Legacy Windows-Phone-era params (AllowIrDA, etc.) are intentionally omitted as low-value for modern cloud tenants.

Backing cmdlet: New-MobileDeviceMailboxPolicy. Role: Device.ReadWrite (Pro).

Parameter In Type Required Description
name body yes
allowApplePushNotifications body
allowBluetooth body
allowBrowser body
allowCamera body
allowConsumerEmail body
allowDesktopSync body
allowExternalDeviceManagement body
allowGooglePushNotifications body
allowHTMLEmail body
allowInternetSharing body
allowMicrosoftPushNotifications body
allowNonProvisionableDevices body
allowPOPIMAPEmail body
allowRemoteDesktop body
allowSimplePassword body
allowSMIMEEncryptionAlgorithmNegotiation body
allowSMIMESoftCerts body
allowStorageCard body
allowTextMessaging body
allowUnsignedApplications body
allowUnsignedInstallationPackages body
allowWiFi body
alphanumericPasswordRequired body
approvedApplicationList body
attachmentsEnabled body
deviceEncryptionEnabled body
devicePolicyRefreshInterval body
irmEnabled body
isDefault body
maxAttachmentSize body
maxCalendarAgeFilter body
maxEmailAgeFilter body
maxEmailBodyTruncationSize body
maxEmailHTMLBodyTruncationSize body
maxInactivityTimeLock body
maxPasswordFailedAttempts body
minPasswordComplexCharacters body
minPasswordLength body
passwordEnabled body
passwordExpiration body
passwordHistory body
passwordRecoveryEnabled body
requireDeviceEncryption body
requireEncryptedSMIMEMessages body
requireEncryptionSMIMEAlgorithm body
requireSignedSMIMEAlgorithm body
requireSignedSMIMEMessages body
requireStorageCardEncryption body
dryRun query bool (switch)

Create mobile device mailbox policy - duplicate (409)

Section titled “Create mobile device mailbox policy - duplicate (409)”

Mobile device mailbox policy create returns 409 when an object of that name already exists. Backed by New-MobileDeviceMailboxPolicy.

POST /exchange/v1.0/mobileDeviceMailboxPolicies HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json


{
  "name": "exonaut-audit-mdm"
}
HTTP/1.1 409 Conflict


{
  "error": {
    "code": "Conflict",
    "message": "Cmdlet 'New-MobileDeviceMailboxPolicy' failed: ||Active Directory operation failed on VI1PR01A17DC001.EURPR01A017.PROD.OUTLOOK.COM. The object 'CN=exonaut-audit-mdm,CN=Mobile Mailbox Policies,CN=Configuration,CN=contoso.onmicrosoft.com,CN=ConfigurationUnits,DC=EURPR01A017,DC=PROD,DC=OUTLOOK,DC=COM' already exists.",
    "target": null,
    "innerError": {
      "cmdlet": "New-MobileDeviceMailboxPolicy"
    }
  },
  "correlationId": "0HNLTJ0Q1D32O:00000001"
}

Create a mobile device mailbox policy

Section titled “Create a mobile device mailbox policy”

Mobile device mailbox policy create. Returns 201 + Location + the freshly-fetched object. Backed by New-MobileDeviceMailboxPolicy.

POST /exchange/v1.0/mobileDeviceMailboxPolicies HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json


{
  "name": "exonaut-audit-mdm"
}
HTTP/1.1 201 Created
Location: /exchange/v1.0/mobileDeviceMailboxPolicies/exonaut-audit-mdm


{
  "@odata.context": "http://localhost:5043/exchange/v1.0/$metadata#mobileDeviceMailboxPolicies/$entity",
  "Id": "exonaut-audit-mdm",
  "Name": "exonaut-audit-mdm",
  "Identity": "exonaut-audit-mdm",
  "IsDefault": false,
  "IsValid": true,
  "PasswordEnabled": false,
  "AlphanumericPasswordRequired": false,
  "AllowSimplePassword": true,
  "MinPasswordLength": null,
  "MinPasswordComplexCharacters": 1,
  "MaxPasswordFailedAttempts": null,
  "MaxInactivityTimeLock": "Unlimited",
  "PasswordExpiration": "Unlimited",
  "PasswordHistory": 0,
  "PasswordRecoveryEnabled": false,
  "DeviceEncryptionEnabled": false,
  "RequireDeviceEncryption": false,
  "RequireStorageCardEncryption": false,
  "AllowCamera": true,
  "AllowBluetooth": "Allow",
  "AllowWiFi": true,
  "AllowStorageCard": true,
  "AllowBrowser": true,
  "AllowDesktopSync": true,
  "AllowInternetSharing": true,
  "AllowRemoteDesktop": true,
  "AllowTextMessaging": true,
  "AllowExternalDeviceManagement": false,
  "AllowNonProvisionableDevices": false,
  "AllowConsumerEmail": true,
  "AllowPOPIMAPEmail": true,
  "AllowHTMLEmail": true,
  "AttachmentsEnabled": true,
  "MaxAttachmentSize": "Unlimited",
  "MaxEmailAgeFilter": "All",
  "MaxCalendarAgeFilter": "All",
  "AllowSMIMESoftCerts": true,
  "RequireSignedSMIMEMessages": false,
  "RequireEncryptedSMIMEMessages": false,
  "IrmEnabled": true,
  "WhenCreated": "2026-05-29T18:45:22+03:00",
  "WhenChanged": "2026-05-29T18:45:22+03:00",
  "AllowApplePushNotifications": true,
  "AllowGooglePushNotifications": true,
  "AllowMicrosoftPushNotifications": true,
  "AllowIrDA": true,
  "AllowMobileOTAUpdate": true,
  "AllowUnsignedApplications": true,
  "AllowUnsignedInstallationPackages": true,
  "AllowSMIMEEncryptionAlgorithmNegotiation": "AllowAnyAlgorithmNegotiation",
  "ApprovedApplicationList": [],
  "UnapprovedInROMApplicationList": [],
  "DevicePolicyRefreshInterval": "Unlimited",
  "MaxEmailBodyTruncationSize": "Unlimited",
  "MaxEmailHTMLBodyTruncationSize": "Unlimited",
  "RequireEncryptionSMIMEAlgorithm": "TripleDES",
  "RequireSignedSMIMEAlgorithm": "SHA1",
  "RequireManualSyncWhenRoaming": false,
  "UNCAccessEnabled": true,
  "WSSAccessEnabled": true,
  "Guid": "ddff0b46-efa0-4c3e-a5e4-182fee6fe827",
  "ExchangeObjectId": "ddff0b46-efa0-4c3e-a5e4-182fee6fe827",
  "DistinguishedName": "CN=exonaut-audit-mdm,CN=Mobile Mailbox Policies,CN=Configuration,CN=contoso.onmicrosoft.com,CN=ConfigurationUnits,DC=EURPR01A017,DC=PROD,DC=OUTLOOK,DC=COM"
}

Related: GET /exchange/v1.0/mobileDeviceMailboxPolicies, DELETE /exchange/v1.0/mobileDeviceMailboxPolicies/{key}

GET /exchange/v1.0/mobileDeviceMailboxPolicies/{key}

Section titled “GET /exchange/v1.0/mobileDeviceMailboxPolicies/{key}”

Get a single mobileDeviceMailboxPolicies entry by Identity (Name or GUID).

Backing cmdlet: Get-MobileDeviceMailboxPolicy. Role: Device.Read (Community).

Get a mobile device mailbox policy by key

Section titled “Get a mobile device mailbox policy by key”

Returns a single mobile device mailbox policy by its Identity (Name or GUID). These policies define the security and feature settings applied to mobile devices that connect via Exchange ActiveSync.

GET /exchange/v1.0/mobileDeviceMailboxPolicies/{key} HTTP/1.1
Authorization: Bearer {token}
HTTP/1.1 200 OK


{
  "@odata.context": "http://localhost:5043/exchange/v1.0/$metadata#mobileDeviceMailboxPolicies/$entity",
  "Id": "Default",
  "Name": "Default",
  "Identity": "Default",
  "IsDefault": true,
  "IsValid": true,
  "PasswordEnabled": false,
  "AlphanumericPasswordRequired": false,
  "AllowSimplePassword": true,
  "MinPasswordLength": null,
  "MinPasswordComplexCharacters": 1,
  "MaxPasswordFailedAttempts": null,
  "MaxInactivityTimeLock": "Unlimited",
  "PasswordExpiration": "Unlimited",
  "PasswordHistory": 0,
  "PasswordRecoveryEnabled": false,
  "DeviceEncryptionEnabled": false,
  "RequireDeviceEncryption": false,
  "RequireStorageCardEncryption": false,
  "AllowCamera": true,
  "AllowBluetooth": "Allow",
  "AllowWiFi": true,
  "AllowStorageCard": true,
  "AllowBrowser": true,
  "AllowDesktopSync": true,
  "AllowInternetSharing": true,
  "AllowRemoteDesktop": true,
  "AllowTextMessaging": true,
  "AllowExternalDeviceManagement": false,
  "AllowNonProvisionableDevices": true,
  "AllowConsumerEmail": true,
  "AllowPOPIMAPEmail": true,
  "AllowHTMLEmail": true,
  "AttachmentsEnabled": true,
  "MaxAttachmentSize": "Unlimited",
  "MaxEmailAgeFilter": "All",
  "MaxCalendarAgeFilter": "All",
  "AllowSMIMESoftCerts": true,
  "RequireSignedSMIMEMessages": false,
  "RequireEncryptedSMIMEMessages": false,
  "IrmEnabled": true,
  "WhenCreated": "2026-03-30T17:01:52+03:00",
  "WhenChanged": "2026-03-30T17:01:54+03:00",
  "AllowApplePushNotifications": true,
  "AllowGooglePushNotifications": true,
  "AllowMicrosoftPushNotifications": true,
  "AllowIrDA": true,
  "AllowMobileOTAUpdate": true,
  "AllowUnsignedApplications": true,
  "AllowUnsignedInstallationPackages": true,
  "AllowSMIMEEncryptionAlgorithmNegotiation": "AllowAnyAlgorithmNegotiation",
  "ApprovedApplicationList": [],
  "UnapprovedInROMApplicationList": [],
  "DevicePolicyRefreshInterval": "Unlimited",
  "MaxEmailBodyTruncationSize": "Unlimited",
  "MaxEmailHTMLBodyTruncationSize": "Unlimited",
  "RequireEncryptionSMIMEAlgorithm": "TripleDES",
  "RequireSignedSMIMEAlgorithm": "SHA1",
  "RequireManualSyncWhenRoaming": false,
  "UNCAccessEnabled": true,
  "WSSAccessEnabled": true,
  "Guid": "78421b1c-078e-4bd7-b72c-750f7adf807c",
  "ExchangeObjectId": "fde54127-4ee2-4d55-97f1-d4cc0badfc33",
  "DistinguishedName": "CN=Default,CN=Mobile Mailbox Policies,CN=Configuration,CN=contoso.onmicrosoft.com,CN=ConfigurationUnits,DC=EURPR01A017,DC=PROD,DC=OUTLOOK,DC=COM"
}

Related: GET /exchange/v1.0/mobileDeviceMailboxPolicies

PATCH /exchange/v1.0/mobileDeviceMailboxPolicies/{key}

Section titled “PATCH /exchange/v1.0/mobileDeviceMailboxPolicies/{key}”

Partial update of the mobileDeviceMailboxPolicies at /mobileDeviceMailboxPolicies/{key}. Body keys map 1:1 to Set-MobileDeviceMailboxPolicy params. Use name to rename. Returns 200 + the post-Set policy.

Changes to a policy take effect on the next ActiveSync re-sync of each mailbox using it - typically within minutes. Setting isDefault: true on a different policy demotes the previous default (only one default per tenant).

Backing cmdlet: Set-MobileDeviceMailboxPolicy. Role: Device.ReadWrite (Pro).

Parameter In Type Required Description
allowApplePushNotifications body
allowBluetooth body
allowBrowser body
allowCamera body
allowConsumerEmail body
allowDesktopSync body
allowExternalDeviceManagement body
allowGooglePushNotifications body
allowHTMLEmail body
allowInternetSharing body
allowMicrosoftPushNotifications body
allowNonProvisionableDevices body
allowPOPIMAPEmail body
allowRemoteDesktop body
allowSimplePassword body
allowSMIMEEncryptionAlgorithmNegotiation body
allowSMIMESoftCerts body
allowStorageCard body
allowTextMessaging body
allowUnsignedApplications body
allowUnsignedInstallationPackages body
allowWiFi body
alphanumericPasswordRequired body
approvedApplicationList body
attachmentsEnabled body
deviceEncryptionEnabled body
devicePolicyRefreshInterval body
irmEnabled body
isDefault body
maxAttachmentSize body
maxCalendarAgeFilter body
maxEmailAgeFilter body
maxEmailBodyTruncationSize body
maxEmailHTMLBodyTruncationSize body
maxInactivityTimeLock body
maxPasswordFailedAttempts body
minPasswordComplexCharacters body
minPasswordLength body
name body
passwordEnabled body
passwordExpiration body
passwordHistory body
passwordRecoveryEnabled body
requireDeviceEncryption body
requireEncryptedSMIMEMessages body
requireEncryptionSMIMEAlgorithm body
requireSignedSMIMEAlgorithm body
requireSignedSMIMEMessages body
requireStorageCardEncryption body
dryRun query bool (switch)

Update a mobile device mailbox policy

Section titled “Update a mobile device mailbox policy”

Partial update of an ActiveSync mobile device mailbox policy via Set-MobileDeviceMailboxPolicy. Body keys map 1:1 to the cmdlet’s parameters (camelCased); only the supplied fields are changed.

PATCH /exchange/v1.0/mobileDeviceMailboxPolicies/{key} HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json


{
  "passwordEnabled": true,
  "minPasswordLength": 6,
  "maxInactivityTimeLock": "00:05:00"
}
HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8


{
  "Identity": "exonaut-sample-mobileDeviceMailboxPolicies",
  "Name": "exonaut-sample-mobileDeviceMailboxPolicies",
  "PasswordEnabled": true,
  "MinPasswordLength": 6,
  "MaxInactivityTimeLock": "00:05:00",
  "IsDefault": false
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Related: GET /exchange/v1.0/mobileDeviceMailboxPolicies

DELETE /exchange/v1.0/mobileDeviceMailboxPolicies/{key}

Section titled “DELETE /exchange/v1.0/mobileDeviceMailboxPolicies/{key}”

Remove the mobileDeviceMailboxPolicies at /mobileDeviceMailboxPolicies/{key}. Returns 204. The system Default policy cannot be removed - cmdlet rejects with a tenant-side error.

Backing cmdlet: Remove-MobileDeviceMailboxPolicy. Role: Device.ReadWrite (Pro).

Parameter In Type Required Description
force query bool (switch) Hide warning or confirmation messages. Maps -Force on Remove-MobileDeviceMailboxPolicy.
dryRun query bool (switch)

Delete a mobile device mailbox policy

Section titled “Delete a mobile device mailbox policy”

Removes the mobile device mailbox policy by Identity. Returns 204. Backed by Remove-MobileDeviceMailboxPolicy.

DELETE /exchange/v1.0/mobileDeviceMailboxPolicies/{key} HTTP/1.1
Authorization: Bearer {token}
HTTP/1.1 204 No Content

Related: POST /exchange/v1.0/mobileDeviceMailboxPolicies

?dryRun=true previews of any write stay on Community.