Exchange ActiveSync Device Partnerships
The question it answers: Which phones sync mail over Exchange ActiveSync, and which of them Intune does not manage?
Phones that sync mail over ActiveSync with the built-in mail app keep a full copy of the mailbox on a device Intune may never have seen. LegacyProtocols shows whether ActiveSync is allowed; this report shows the actual partnerships - unmanaged native mail apps, partnerships silent for 90 days, devices waiting in quarantine and users with many devices.
At a glance
Section titled “At a glance”| Where in the app | Exchange Online › Mail Security & Hygiene › ActiveSync Device Partnerships |
| Workload | Exchange Online |
| Kind | Findings list · dashboard tile |
| Data | A scan: it runs only when someone presses Run scan (or calls the API’s scan action) and can take minutes. The last result is kept until the next scan. It reads through PowerShell (Exchange Online or SharePoint Online), so the first load takes longer than a Graph report. |
| Licence | No extra licence needed. |
| Report id (API and MCP) | exchange.hygiene.active-sync-devices |
Columns
Section titled “Columns”| Column | Key | Type |
|---|---|---|
| Severity | Severity | Status |
| Client | Category | Text |
| User | Subject | Link |
| Check | Setting | Text |
| Device | Value | Text |
| Finding | Finding | Text |
| Detail | Detail | Text |
| Last successful sync | When | Date |
| Count | Number | Number |
A findings list hides columns that no row fills. Severity is Critical, Serious, Warning, OK or Info; rows rated Critical, Serious or Warning need attention (Working with findings).
What it needs
Section titled “What it needs”Licence: No extra licence needed.
Application permissions on the IntensiveReports app registration (all permissions):
| Permission | API | What it allows | Note |
|---|---|---|---|
Exchange.ManageAsApp | Office 365 Exchange Online | Manage Exchange As Application | + View-Only Recipients |
Data sources it reads
Get-ActiveSyncOrganizationSettingsGet-MobileDeviceGet-EXOMobileDeviceStatistics
Through the API and MCP
Section titled “Through the API and MCP”GET /ir-api/v1/reports/exchange.hygiene.active-sync-devices?size=100POST /ir-api/v1/reports/exchange.hygiene.active-sync-devices/scanAn AI assistant reads it with the MCP tool get_report and the id exchange.hygiene.active-sync-devices. The client needs the Run scan grant for Exchange Online. See Using the API.