Fix Mobile Device Quarantine Loop After Hybrid Exchange Migration
Question details
Mobile devices repeatedly enter quarantine status during or after a hybrid migration to Microsoft 365, despite administrative tools showing them as approved.
- Product
- Microsoft Exchange / Microsoft 365
- Device & OS
- not provided
- Scenario
- Migrating mailboxes from Exchange 2013 to Microsoft 365 in a hybrid environment while managing mobile device access.
- Observed behavior
- Devices revert to a quarantined state in a loop even when Exchange PowerShell reports the DeviceAccessState as Allowed, indicating a frontend-to-backend inconsistency.
Ensure you have the Exchange Online PowerShell module installed and hold global administrator or Exchange administrator privileges to run the necessary diagnostic commands.
Verify Device Status via PowerShell and Escalate to Support
Since the frontend admin interface and backend status conflict, you must use PowerShell to document the inconsistency and work with Microsoft Support for a backend fix.
When mobile devices enter a quarantine loop despite being allowed, it typically points to a synchronization issue within the Microsoft 365 backend. Attempting to continuously allow the device via the admin interface will only provide a temporary change.
To resolve this, you need to extract the actual status directly from the Exchange backend using PowerShell and provide these logs to your Microsoft Support representative.
Open PowerShell as an administrator and run 'Connect-ExchangeOnline' to authenticate with your Microsoft 365 tenant credentials.
Run the command 'Get-CASMailbox -Identity <UserEmail> | Select-Object ActiveSyncAllowedDeviceIDs, ActiveSyncBlockedDeviceIDs' to verify if the device ID is explicitly listed in the allowed array.
Execute 'Get-MobileDevice -Mailbox <UserEmail> | Select-Object DeviceAccessState, DeviceAccessStateReason' to confirm that PowerShell reports the status as 'Allowed'.
Take screenshots of the 'Allowed' status in your PowerShell output and the contrasting 'Quarantined' status in the Exchange Admin Center.
Attach the PowerShell outputs and screenshots to your open Microsoft Support case, explicitly requesting a backend investigation for the synchronization loop.
Ensure Uninterrupted Productivity with WPS Office
While resolving complex Microsoft 365 server migrations and Exchange backend issues, make sure your team maintains access to powerful desktop productivity tools. WPS Office provides a free, lightweight, and highly compatible alternative for everyday document tasks.
- 1. Download the Installer: Visit the official WPS Office website and click 'Free Download' to get the installer for your operating system.
- 2. Install the Suite: Run the installer and follow the quick setup wizard to install WPS Office on your device.
- 3. Open Your Documents: Launch WPS Office and instantly open your existing Microsoft Office files without needing to convert them.
Frequently Asked Questions
Why does DeviceAccessState show as Allowed but the device remains quarantined?
This occurs when there is a synchronization delay or data inconsistency between the Exchange Admin Center's interface and the actual Microsoft 365 backend policy enforcement engine.
Can I fix the quarantine loop by modifying mobile-device policies locally?
Generally, no. If no strict local mobile-device policy was actively configured to block them and the issue persists in a loop, it is a backend server sync problem that requires Microsoft Support intervention.
Does migrating from Exchange 2013 to Microsoft 365 automatically quarantine devices?
Migrations do not inherently quarantine devices unless your Exchange ActiveSync (EAS) default access rules or Azure AD Conditional Access policies restrict them by default. A recurring loop implies an error rather than expected behavior.
