iOS 9 Outlook App & Lync 2013 App Issues

Posted on September 17, 2015 by Michel de Rooij

iphone6 After Apple released iOS 9 to the public yesterday. From an Exchange or Office 365 perspective, iOS 9 supports the enhanced calendar features of Office 365 and Exchange 2016 when that is released. Unfortunately, incidents have been reported with the Outlook app and the Lync 2013 App.

Regarding the Outlook App, iOS9 users might not be able to start the Outlook App or the Outlook app will just crash. The far from ideal workaround offered by the Outlook team, is to reinstall the Outlook app.

Of course, this also requires users to reconfigure accounts and Outlook App settings, so organizations can expect some calls to the service desk by users who upgraded. Organizations can report on the currently registered iOS8 devices that syned in the last 30 days, using:

Get-MobileDevice | Where-Object {$_.DeviceOS -like 'iOS 8*' -and $_.whenChanged -gt (Get-Date).AddDays(-30)} | Select UserDisplayName, FriendlyName, DeviceModel, DeviceOS, whenChanged

This will product a list of users, the name of their device, the device model and OS and when it last synced with Exchange. This information can be useful when you want to proactively approach users with iOS8 devices.

For Lync 2013 users, there are sign-in issues when they have configured different region and language settings on their iOS device. Those users will be presented the following:

The issue has officially been confirmed through publication of KB3096704, which states:

“This problem is fixed in the Microsoft Skype for Business for iOS app that will replace Lync for iPhone and Lync for iPad when it’s released. No fix for this issue is scheduled for the current releases of Lync for iPhone and Lync for iPad”.

Since the Skype for Business app is not available yet, this is not good news. Mitigation is possible by matching the region with the language setting (or the other way around), after which you need to reinstall the Lync 2013 app from the store.

With all this in mind, should organizations wish to first test the new iOS against their Exchange environment for potential other issues, you can block iOS 9 from accessing your Exchange 2013 environment, or Office 365 tenant if you must, using the Access/Block/Quarantine feature. First you need to retrieve the reported DeviceOS string for iOS 9 for a device:

Get-MobileDevice | Where-Object {$_.DeviceOS -like “iOS 9*”} | Select DeviceModel, DeviceOSLanguage, DeviceOS

The reported DeviceOS strings then is used to create an ActiveSync device rule. For example, my iPhone 6 reports DeviceOS as “iOS 9.0 13A344”. To block these devices with iOS 9.0 and put them in quarantine, run the following:

New-ActiveSyncDeviceAccessRule -QueryString "iOS 9.0 13A344" -Characteristic DeviceOS -AccessLevel Quarantine

If you would like to know more about the Access/Block/Quarantine option, check out this article.

iOS 8.3 Exchange-related fixes

Posted on April 9, 2015 by Michel de Rooij

Today, Apple released an update for iOS which supposedly fixes, amongst other things, some Exchange-related issues. The release notes of iOS 8.3 mentions the following Exchange-related fixes:

Exchange out-of-office message can now be edited separately for external replies.
Improves recovery of Exchange accounts from temporary connection problems.
Fixes an issue that caused Exchange meetings with long notes to be truncated.

As for any update, I’d recommend to thoroughly test this in a test and acceptance environment first, prior to allowing access to your production environment. Apart from potentially blocking the new iOS, monitor the support forums from Apple and Microsoft for related issues. To block a specific version of iOS, consult this page.

More information on known issues with Exchange ActiveSync and 3rd party devices can be found in KB2563324.

iOS 8.2 fixes Exchange-related issues

Posted on March 11, 2015 by Michel de Rooij

Today, Apple released an update for iOS which supposedly fixes, amongst other things, some Exchange-related issues. The release notes of iOS 8.2 mention the following Exchange-related fixes:

Fixes stability of Mail
Addresses an issue that caused certain events in a custom reoccurring meeting to drop from Exchange calendar
Fixes an certificate error that prevented configuring an Exchange account behind a third-party gateway
Fixes an issue that could cause an organizer’s Exchange meeting notes to be overwritten
Resolves an issue that prevented some Calendar events from automatically showing as “busy” after accepting an invite.

However, some existing complaints are not resolved by this update, such as the WiFi performance issue.

It is a natural law that for every bug that is fixed, new ones are introduced. So, some organizations may therefor want to test and accept this iOS update before giving it the green light for their Exchange environment. To block a specific version of iOS, consult this page.

More information on current issues with Exchange ActiveSync and 3rd party devices can be found in support article KB2563324.

IOS 7.0: To Block or Not to Block? (updated)

Posted on September 20, 2013 by Michel de Rooij

With the meeting and log flooding issues caused by certain IOS 6.x versions still fresh in memory, one may prefer to adopt a more conservative strategy when it comes to new IOS releases interacting with your Exchange infrastructure – or any mobile OS for that matter.

After Apple released IOS 7.0 this week, some shops consider blocking or quarantining this version until it’s been approved after proper testing and monitor online communities for potential issues during a small waiting period.

In an earlier article, I mentioned how to accomplish (temporarily) blocking IOS 6.x on Exchange 2010 or TMG; here’s how to achieve this for IOS 7.0 on current platforms:

To distinguished IOS 7.0 from earlier versions, you need to check the DeviceOS field as returned by Get-ActiveSyncDevice (Exchange 2010) or Get-MobileDevice (Exchange 2013). For example, here’s how to return current partnered EAS devices:

#Exchange 2010:
Get-ActiveSyncDevice | Where {$_.DeviceOS -like"IOS 7.0*"}

#Exchange 2013:
Get-MobileDevice | Where {$_.DeviceOS -like "IOS 7.0*"}

To block or quarantine IOS 7.0 devices you can utilize Exchange’s Allow/Block/Quarantine (ABQ) mechanism using the New-ActiveSyncDeviceAccessRule cmdlet in conjunction with the DeviceOS, DeviceModel or UserAgent string. When using DeviceOS, it requires specifying the full device OS string, which can vary per device or IOS.

For example, when the DeviceOS is iOS 7.0 11A465 (meaning build 11A465) or 7.0.1 11A470a, the cmdlet for setting up the quarantine rule would be (for blocking replace Quarantine with Block):

New-ActiveSyncDeviceAccessRule -QueryString “iOS 7.0 11A465″ -Characteristic DeviceOS -AccessLevel Quarantine
New-ActiveSyncDeviceAccessRule -QueryString “iOS 7.0.1 (11A470a)″ -Characteristic DeviceOS -AccessLevel Quarantine

For the exact strings consult Get-ActiveSyncDevice/Get-MobileDevice output.

For examples of alternative blocking methods using TMG or F5, check this article. More information on ABQ here. Note that users utilizing the OWA for iPhone or iPad apps won’t be blocked after implementing this measure.

Be advised there are already reports of issues with iOS 7.0 such as substantial reduction of battery life and slow devices. What’s far worse is that you can also bypass the lock screen, similar to the lock screen glitch in IOS 6.1.3. L’histoire se répète.

Update (21Sep): According to reports, iOS 7 allows you to make calls despite the lock. How’s that for a potential corporate smart phone.

Update (26sep): Apple has released security update iOS 7.0.2 (build 11A501, all devices) which fixes the lock screen glitch. Another good reason to block earlier iOS 7.0 / 7.0.1 versions, only allowing iOS 7.0.2 devices to retrieve company data.

OWA for iPhone and OWA for iPad are here!

Posted on July 17, 2013 by Michel de Rooij

Today, the Exchange team announced the immediate availability of the (free) OWA for iPhone and OWA for iPad apps. Exchange fellows Tony Redmond and Dave Stork already hinted earlier this month that something was about to happen in this area.

Users of the Windows 8 Mail app may find the look of the OWA apps to be very familiar:

A quick summary on the app features:

Stored credentials for automatic logins;
Push notifications;
Meeting reminders (even with app closed);
Voice activated actions (English only);
Contact sync for caller ID function;
Remote wipe capability (user data, when the app runs).

That last one is a great, much requested feature when Bring Your Own Device is practiced (apart from that it makes sense due to the sandboxing principle). When required the business can selectively wipe business data without touching your personal information, similar to a feature to be introduced with Windows 8.1 called Remote Business Data Removal.

Besides that you need an iPhone 4S or iPad 2 or higher running iOS 6 or later, the apps are currently only supported for Office 365 subscribers running the tenant on Wave15 (or later). There are reports of the apps working with on-premises Exchange 2013 but that’s unofficial. To find out which version your tenant is running, use Get-OrganizationConfig in a remote PowerShell session, e.g.

$session = New-PSSession –ConnectionUri https://ps.outlook.com/powershell –AllowRedirection –Authentication Basic –Credential (Get-Credential) –ConfigurationName Microsoft.Exchange
Import-PSSession $session
Get-OrganizationConfig | ft AdminDisplayVersion

My tenant is running on 15.0.698.10 (15 = Wave 15), so theoretically I’m good to be running OWA for iPhone or OWA for iPad. I say theoretically, as I don’t have any iPhone or iPad available for testing.

An app version for on-premises Exchange 2013 is expected to be released at a later date. More information on configuration and usage of the OWA apps on the Office 365 blog here.