Fix Exchange Online Mobile Devices Returning to Quarantine
Question details
An administrator needs to stop approved mobile devices from repeatedly returning to quarantine in Exchange Online.
- Product
- Microsoft Exchange Online
- Device & OS
- iPhone and Android
- Scenario
- An iPhone and an Android device are approved for Exchange access, while other users' devices are unaffected.
- Observed behavior
- Manual approval works temporarily, but the affected devices return to Quarantined Devices.
Sign in with an account authorized to manage Exchange Online mailboxes and mobile devices. Identify the affected mailbox and device, and install the Exchange Online PowerShell module if it is not already available.
Add the affected device ID to the mailbox's allowed list
Use Exchange Online PowerShell to check the device ID and preserve existing allowed IDs while adding the affected device.
Open PowerShell and run Connect-ExchangeOnline. Sign in with your Exchange administrator account.
Run Get-MobileDevice -Mailbox user@contoso.com | Format-Table Identity,DeviceId,DeviceAccessState. Replace the mailbox address and note the DeviceId for the affected phone.
Run Get-CASMailbox -Identity user@contoso.com | Select-Object -ExpandProperty ActiveSyncAllowedDeviceIDs. Record the existing IDs so they remain on the list.
In the same PowerShell session, run $ids = @((Get-CASMailbox -Identity user@contoso.com).ActiveSyncAllowedDeviceIDs) | Where-Object { $_ }; then run $ids = @($ids + 'DEVICE_ID' | Select-Object -Unique), replacing DEVICE_ID with the value you found. Run Set-CASMailbox -Identity user@contoso.com -ActiveSyncAllowedDeviceIDs $ids to apply the complete list.
Wait 15 minutes to two hours, then run Get-MobileDevice -Mailbox user@contoso.com | Format-Table Identity,DeviceId,DeviceAccessState and check whether the phone remains allowed.
Recreate the mobile device partnership
Try a fresh partnership if the device continues to return to quarantine after the allowed-ID change has had time to apply.
Work with Office files in WPS Office
WPS Office is a free, lightweight alternative for working with documents, spreadsheets, and presentations. Its familiar interface and Microsoft Office format compatibility make it easy to move existing files. It does not manage Exchange Online quarantine or replace an Exchange email client.
Frequently Asked Questions
How do I find the Exchange device ID for a phone?
Connect to Exchange Online PowerShell and run Get-MobileDevice -Mailbox user@contoso.com | Format-Table Identity,DeviceId,DeviceAccessState. Match the phone to its DeviceId.
Will adding a device ID remove existing approvals?
It can if you submit only the new ID. Read ActiveSyncAllowedDeviceIDs with Get-CASMailbox and include all IDs that should remain allowed when running Set-CASMailbox.
How long does an allowed-device change take to apply?
Allow approximately 15 minutes to two hours, then check the device access state again with Get-MobileDevice.
What should I do if the phone keeps returning to quarantine?
Remove the affected partnership with Remove-MobileDevice, restart and reconnect the phone, and approve it again. If the problem persists, contact Microsoft Support to investigate possible replication or service issues.
