Organizations using Exchange ActiveSync (EAS) can set up email accounts and enforce basic password policies on Android devices through Gmail.
Set up Exchange accounts with managed configurations
Managed configurations are available in Gmail version 6.4 and later.
Gmail's managed configurations provide a way to set up Exchange accounts on Android devices. As an IT admin, use your enterprise mobility management (EMM) console to configure the following Gmail settings for each user.
Configure mobile device mailbox policies
In 2019, Android 10 introduced changes to the way some Exchange ActiveSync (EAS) password policies are handled. These changes apply to all Android devices. The table below details how Exchange mobile device mailbox policy password settings are interpreted and applied by Android devices.
|
Exchange mobile device mailbox policy setting |
Android password complexity level | Password requirements |
|---|---|---|
| Password enabled = false | None | No password requirements are configured. |
|
Allow simple password = true Min password length < 4 |
Low | Password can be a pattern or a PIN with either repeating (4444) or ordered (1234, 4321, 2468) sequences. |
|
Allow simple password = true Min password length = 4 |
Medium |
Passwords that meet one of the following criteria:
|
|
Allow simple password = false Alphanumeric password required = true Min password length <= 4 |
||
|
Allow simple password = true Min password > 4 |
High |
Passwords that meet one of the following criteria:
|
|
Allow simple password = false Alphanumeric password required = true Min password length > 4 |
Policies supported by default
Android supports some EAS policies by default. As a result, the following EAS policies aren't directly configurable:
- Password expiration
- Password history
- Max password failed attempts
- Max inactivity time lock
- Require device encryption
Wipe a device remotely
If a wipe command is sent from Exchange Server, Gmail will remove the EAS account from the device (or work profile) rather than wiping the entire device (or work profile). If you have an EMM provider, you can wipe a device or a work profile in your EMM console.
What should my organization do to handle these changes?
You don't need to take any action. The changes to the way Gmail handles wipe commands and certain EAS password policies will not disrupt device functionality, though you may want to review your current device password policies to ensure they're suitable for your organization.