Windows Phone 8 Device Management Overview This white paper is part of a series of technical papers designed to help IT professionals evaluate Windows Phone 8 and understand how it can play a role in their organizations. It discusses and contains information about Windows Phone 8 mobile device management. October 2012
Legal Disclaimer 2012 Microsoft Corporation. All rights reserved. This document is provided "as-is." Information and views expressed in this document, including URL and other Internet website references, may change without notice. You bear the risk of using it. This document does not provide you with any legal rights to any intellectual property in any Microsoft product. You may copy and use this document for your internal, reference purposes. Published: October 2012
Table of contents Windows Phone 8 Device Management Overview 1 Introduction 1 Email and access policy management with 1 Supported ActiveSync policies 1 Supported ActiveSync features by Server version 4 App distribution and access policy management 5 Resources 6
Introduction Organizations need to provide a secure and consistent experience for all mobile workers while maintaining control of all devices that may contain or provide access to business data. Windows Phone provides the ability to manage Windows Phone 8 devices through Microsoft ActiveSync (EAS) with Server for email and access policy management. With the release of Microsoft System Center Configuration Manager 2012 SP1, customers will be able to use Windows Intune and System Center Configuration Manager for app distribution and access policy management. 1 Email and access policy management with Windows Phone 8 supports the ActiveSync protocol for synchronizing email, calendar, task, and contact information with Server 2003 SP2 and all subsequent releases or Microsoft Office 365. Supported ActiveSync policy settings Similar to Group Policy settings for PC operating systems, EAS provides the ability to manage Windows Phone through the use of security-related policies that are configured by an organizations IT department. EAS security-related configuration policy settings that can be managed using Server include those shown in the following table. Policy setting AllowSimpleDevicePassword The AllowSimpleDevicePassword setting specifies whether a simple device password is allowed. A simple password is one consisting only of repeated "2222" or sequential abcd" characters. The default is $true.
Policy setting AlphanumericDevicePasswordRequired DevicePasswordEnabled DevicePasswordExpiration DevicePasswordHistory IrmEnabled MaxDevicePasswordFailedAttempts MaxInactivityTimeDeviceLock The AlphanumericDevicePasswordRequired setting specifies whether the password for the mobile phone must be alphanumeric. The default is $false. The DevicePasswordEnabled setting specifies whether a password is required. When set to $true, DevicePasswordEnabled requires that the user set a password for the mobile phone. The default is $false. The DevicePasswordExpiration setting specifies the length of time, in days, that a password can be used. After this length of time, a new password must be created. The format of the setting is dd.hh.mm:ss; for example, 24.00:00 = 24 hours. The DevicePasswordHistory setting specifies the number of previously used passwords to store. When a user creates a new password, the user can't reuse a stored password that was previously used. The IrmEnabled setting specifies whether IRM is enabled for the mailbox policy. The MaxDevicePasswordFailedAttempts setting specifies the number of attempts a user can make to enter the correct password for the mobile phone before a device reset to factory settings is initiated. You can specify any number from 4 through 16. The default is 8. The MaxInactivityTimeDeviceLock setting specifies the length of time that the mobile phone can be inactive before the password is required to reactivate it. You can specify any interval between 30 seconds and 1 hour. The default is 15 minutes. The format of the setting is hh.mm:ss; for example, 15:00 = 15 minutes. 2
Policy setting MinDevicePasswordComplexCharacters MinDevicePasswordLength RequireDeviceEncryption RemoteWipe The MinDevicePasswordComplexCharacters setting specifies the number of character groups that are required to be present in the password. The character groups are defined as: Lower case alphabetical characters Upper case alphabetical characters Numbers Non-alphanumeric characters For example, if the value of MinDevicePasswordComplexCharacters is 2, a password with both upper case and lower case alphabetical characters would be sufficient, as would a password with lower case alphabetical characters and numbers. The MinDevicePasswordLength setting specifies the minimum number of characters in the device password. You can specify any number from 1 through 16. The maximum length a password can be is 16 characters. The default is 4. The RequireDeviceEncryption setting specifies whether encryption is required on the device. Once set, BitLocker conversion automatically starts encrypting the internal storage of the phone. The default is $false. Deletes data on the user data partition and resets the phone to default settings. 3
Policy setting AllowNonProvisionableDevices AllowNonProvisionableDevices is a server enforced setting that specifies whether all mobile phones can synchronize with the server running. When set to $true, AllowNonProvisionableDevices enables all mobile phones to synchronize with the server, regardless of whether the phone can enforce all the specific settings established in the ActiveSync policy. This also includes mobile phones managed by a separate device management system. When set to $false, this setting blocks mobile phones that aren't provisioned from synchronizing with the server. The default is $false. 4 Additionally, the following EAS policy setting is supported when managing devices with Microsoft System Center Configuration Manager. Policy setting AllowStorageCard The AllowStorageCard setting specifies whether the mobile phone can access information stored on a storage card. The default is $true. Supported ActiveSync features by Server version While Windows Phone 8 was designed to support the latest EAS features, previous versions of Server may not support all EAS features that are supported by Windows Phone. The following table outlines supported features by Server version. ActiveSync feature Server 2007 Server 2010 Server 2013 Direct Push Yes Yes Yes Email sync Yes Yes Yes Calendar sync Yes Yes Yes
ActiveSync feature Server 2007 Server 2010 Server 2013 Contacts sync Yes Yes Yes Remote wipe Yes Yes Yes Sync multiple folders Yes Yes Yes 128-bit SSL encrypted Yes Yes Yes transmission 5 User-initiated remote wipe Yes Yes Yes Link access Yes Yes Yes HTML mail Yes Yes Yes GAL lookup Yes Yes Yes Follow-up flags Yes Yes Yes Meeting attendee information Yes Yes Yes Autodiscover Yes Yes Yes Bandwidth reductions Yes Yes Yes Reply state No Yes Yes Nickname cache No Yes Yes Block/Allow/Quarantine list No Yes Yes Allow attachment download No Yes Yes 256-bit SSL encrypted transmission No Yes Yes App distribution and access policy management Organizations looking to distribute line of business apps in addition managing EAS policy can use Windows Intune to manage Windows Phone 8 devices and will have the flexibility of using either the Windows Intune or Configuration Manager 2012 SP1 console for managing Windows Phone devices.
Resources For more information about all the aspects of using Windows Phone in your company, see, Windows Phone for Business (http://www.windowsphone.com/en- US/business/for-business). To learn more about EAS policy management and managing Windows Phones, additional information is available in the following articles: 6 Managing ActiveSync Devices at http://technet.microsoft.com/en-us/library/aa998933.aspx What s New in Windows Intune at http://technet.microsoft.com/en-us/library/hh452635.aspx