Skip to content

Intune Device Compliance Block Disrupts Exchange Online Mobile Sync

← Back to categories

Description

Affected users experience a loss of email synchronization on managed mobile devices (iOS and Android) running Outlook Mobile, which typically displays a "Disconnected" banner, "Last synced: never," or simply stops delivering new messages and push notifications. The disruption often begins abruptly — correlating with the device being marked non-compliant in Intune MDM — while mailbox access through Outlook on the web and, in most cases, the desktop Outlook client continues to function normally, confirming the underlying mailbox remains healthy.

The non-compliant state is triggered by factors such as a recent compliance policy update, a deprecated policy reference, a missing OS security patch, or an incomplete Company Portal compliance prompt. Exchange Online responds by blocking ActiveSync and EWS connectivity for the affected endpoints, with transport logs showing HTTP 403 rejections and, in some cases, HTTP 429 throttling caused by aggressive retry loops from stale Outlook sessions. The issue has been observed both for individual users and across groups of users enrolled under the same compliance policy, sometimes affecting multiple offices and device platforms simultaneously after a single policy push.

Desktop Outlook clients are occasionally affected as well, showing intermittent disconnections or delayed mail delivery around the same timeframe. Desktop connectivity is typically restored independently after a profile rebuild or restart, pointing to a separable local profile issue rather than the same compliance block. The persistent and primary impact remains on the mobile device, where email access is fully blocked until device compliance is remediated and the mobile sync partnership is re-established.

Reported variations

  • Desktop Outlook continues to receive mail normally while only the mobile client is affected, indicating the compliance block is isolated to the mobile sync partnership.
  • Multiple users across more than one office or device group are affected simultaneously following a specific compliance policy rollout targeting an organizational unit.
  • Outlook Mobile displays a "Connected" status despite no new mail arriving and push notifications ceasing, masking the compliance block from the user's perspective.
  • Exchange Online diagnostics reveal EWS HTTP 429 throttling on affected mailboxes caused by aggressive retry loops from stale Outlook profiles, compounding the compliance block.
  • The compliance block is triggered by a deprecated or outdated MDM policy reference rather than a newly introduced policy requirement.
  • The issue onset occurs overnight or in early morning hours, aligning with the compliance policy evaluation timestamp rather than any user action.
  • A device re-enrolled in MDM enters a brief non-compliant state during the re-enrollment process, triggering a surge of mobile sync requests and corresponding throttling.
  • An affected device is flagged non-compliant specifically due to a missing OS security patch, activating a conditional access policy blocking the mobile sync partnership until the patch is applied.

Affected environment

Distribution across 16 reported cases:

  • Operating system: iOS 16; Windows 10 (12%), iOS 15.4 and Windows 10 (6%), Windows 10; iOS 15 (6%)
  • Device / platform: mobile (31%), mobile and desktop (25%), Microsoft 365 / Exchange Online (12%)
  • Team: Sales (62%), Sales - Mobile Users (12%), global-sales (6%)
  • Region: us-east-1 (50%), EMEA (25%), US-West (12%)

Root cause

A change or update to Intune device compliance policies caused affected managed mobile devices to be evaluated as non-compliant, which triggered Exchange Online to block ActiveSync and mobile API access for those endpoints. In some cases, stale Outlook desktop profiles and transient EWS throttling from retry loops contributed secondary disruption but were not the persistent blocker.

Diagnostics

Steps used to confirm this root cause:

  1. Review the reported Outlook client state and compare mobile disconnected behavior with intermittent desktop access to determine whether the issue is endpoint-specific or mailbox-wide.
    Expected: Outlook shows connected and mailbox folders update without sync delay.
  2. Assess whether sign-out/sign-in or account re-add is needed to clear a stale Outlook session after compliance is restored.
    Expected: Clean profile syncs the mailbox without stale cache errors.
  3. Review mobile sync partnership health together with device compliance context from the ticket to assess whether Exchange Online mobile access is being blocked by MDM policy.
    Expected: Active mobile partnerships are healthy and compliant.

Resolution

Performed by IT support. Representative resolutions from prior cases:

Example 1

  1. Reviewed Intune compliance status for the affected iOS device (, user , EMP ) and identified that the device was failing the required OS patch compliance policy (minimum iOS 15.4.1 not met).
  2. Remediated the device compliance issue by coordinating with () to update the required OS patch level on the iPhone, then reapplied the Intune compliance profile until the device returned to a compliant state as verified by agent .
  3. Cleared the affected device's () ActiveSync partnership in Exchange Online via Remove-MobileDevice cmdlet to remove the blocked mobile sync relationship for mailbox .
  4. Forced a fresh device/mailbox synchronization after compliance returned to healthy so Exchange Online could establish a new allowed ActiveSync partnership for against the mailbox.
  5. Had restart Outlook on and re-initiate mobile sync on the iPhone, then verified successful send/receive and current mailbox updates on both iOS and Outlook desktop. Confirmed no further 403 blocks in Exchange Online logs.

Example 2

  1. Reviewed the affected mailbox for and device state in Exchange Online and Intune to confirm the mobile device registered to () was associated with a deprecated compliance policy reference CP-EMEA-2025-DEPRECATED and that mailbox connectivity was intermittently dropping from client IP .
  2. Cleared the existing mobile sync partnership for the affected device belonging to so the mailbox could establish a fresh synchronization relationship after compliance was corrected.
  3. Rebuilt the user's Outlook profile on the Windows workstation to remove the stale local profile state for and re-established the Exchange Online mailbox connection to . This step was performed by desktop support engineer .
  4. Updated the device from the deprecated MDM compliance policy reference CP-EMEA-2025-DEPRECATED to the current policy version and forced a new compliance evaluation in Intune for user () in the office.
  5. Validated that the device returned to a compliant state and confirmed mailbox synchronization resumed successfully in Outlook desktop on and on the mobile device for , then monitored for recurrence. Notified at that service was restored.

Recommendation

Resolved by IT after remediating Intune device compliance status and resetting the affected Exchange Online mobile sync partnerships.

← Back to categories