Cyber Security News

Microsoft to Block Exchange Online Access from Outdated Devices

Microsoft has announced a significant update to its device connectivity policies for Exchange Online, aimed at enhancing security and ensuring users are on modern protocols.

Starting March 1, 2026, mobile devices running Exchange ActiveSync (EAS) versions older than 16.1 will no longer be able to connect to Exchange Online mailboxes.

Exchange ActiveSync version 16.1 was originally released in June 2016 as part of Exchange Server and Exchange Online updates.

After nearly a decade, Microsoft is phasing out support for older versions to maintain a secure and reliable environment.

This move ensures that all connected devices benefit from the stability and security improvements inherent in the modern protocol.

Microsoft stated that this decision follows extensive collaboration with device and application vendors to minimize service disruptions.

The company emphasizes that if users keep their devices and applications updated to the latest versions, they should experience no interruption in their email service.

This policy change applies specifically to Exchange Online users. It does not affect on-premises Exchange Server environments.

The restriction targets mobile devices using native email applications that rely on the EAS protocol. Common examples include:

  • iOS Mail App: Users running iOS 10 or later are safe, as EAS 16.1 was adopted with that operating system.
  • Gmail & Samsung Mail Apps: Microsoft notes that updates for these applications are currently in progress. Users simply need to keep their apps updated to ensure they automatically switch to version 16.1 before the deadline.

IT administrators are encouraged to proactively identify outdated devices within their organization.

Microsoft has provided a PowerShell command that allows admins to generate a report of all devices and applications currently using ActiveSync versions below 16.1.

By running the following command, admins can pinpoint affected users:

powershellGet-MobileDevice -ResultSize Unlimited | Where-Object {($_.ClientType -eq 'EAS' -or $_.ClientType -match 'ActiveSync') -and $_.ClientVersion -and ([version]$_.ClientVersion -lt [version]'16.1')} | Sort-Object UserDisplayName | Select-Object UserDisplayName, Identity, DeviceId, DeviceModel | Format-List

Organizations are advised to notify affected users well before the March 2026 cutoff to ensure they update their device firmware or email applications.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.

Divya

Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

Recent Posts

Storm-2603 Hackers Exploit SharePoint and Abuse Cloudflare Tunnel to Hide Remote Access

A December intrusion to Storm-2603, the China-based group Microsoft ties to Warlock ransomware. The attackers…

1 minute ago

OpenSSH sshole Flaw Allows Hackers to Log Into Password-Disabled Linux Accounts Using 257-Character Passwords

A decade-old authentication bypass in OpenSSH on musl-based Linux lets attackers log into accounts that…

4 minutes ago

New GhostMap Android Vulnerability Can Crash Phones Permanently Without Opening an App or Granting Permissions

Bitdefender researchers have revealed a vulnerability called GhostMap that affects Android devices. This vulnerability can…

14 minutes ago

Microsoft Paint Vulnerability Allows Hackers to Execute Malicious Code Remotely Without User Interaction

Microsoft has announced a vulnerability in Windows Paint that could let unauthenticated attackers execute malicious…

37 minutes ago

ARTEX AI Framework Linked to Bank Breaches and Cloud Attacks Found Exposed Across Hundreds of Servers

An autonomous penetration-testing framework linked to South Korean banking breaches and cloud supply-chain attacks is…

1 hour ago

Shopify Makes IP Allowlisting Mandatory for All Public Apps to Prevent Stolen API Token Abuse

Shopify is making IP allowlisting mandatory for all public apps to limit abuse of stolen…

1 hour ago