Commands › Exchange Online
New-ActiveSyncMailboxPolicy
Create a Microsoft Mobile Device mailbox policy object. **Note**: In Exchange 2013 or later, use the New-MobileDeviceMailboxPolicy cmdlet instead. If you have scripts that use New-ActiveSyncMailboxPolicy, update them to use New-MobileDeviceMailboxPolicy.
Quick start script
# New-ActiveSyncMailboxPolicy — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-ExchangeOnline -CertificateThumbprint $thumb -AppId $appId -Organization $org
# 2. Capture the current state first — you cannot roll back what you never recorded
$before = Get-ActiveSyncMailboxPolicy
$before | Format-List
# 3. Make the change (dry run first)
New-ActiveSyncMailboxPolicy -Name <String> -WhatIf
New-ActiveSyncMailboxPolicy -Name <String>
# 4. Verify and diff
$after = Get-ActiveSyncMailboxPolicy
Compare-Object ($before | Out-String) ($after | Out-String)Syntax
New-ActiveSyncMailboxPolicy [-Name] <String>
[-AllowApplePushNotifications <Boolean>]
[-AllowBluetooth <BluetoothType>]
[-AllowBrowser <Boolean>]
[-AllowCamera <Boolean>]
[-AllowConsumerEmail <Boolean>]
[-AllowDesktopSync <Boolean>]
[-AllowExternalDeviceManagement <Boolean>]
[-AllowHTMLEmail <Boolean>]
[-AllowInternetSharing <Boolean>]
[-AllowIrDA <Boolean>]
[-AllowMobileOTAUpdate <Boolean>]
[-AllowNonProvisionableDevices <Boolean>]
[-AllowPOPIMAPEmail <Boolean>]
[-AllowRemoteDesktop <Boolean>]
[-AllowSMIMEEncryptionAlgorithmNegotiation <SMIMEEncryptionAlgorithmNegotiationType>]
[-AllowSMIMESoftCerts <Boolean>]
[-AllowSimpleDevicePassword <Boolean>]
[-AllowStorageCard <Boolean>]
[-AllowTextMessaging <Boolean>]
[-AllowUnsignedApplications <Boolean>]
[-AllowUnsignedInstallationPackages <Boolean>]
[-AllowWiFi <Boolean>]
[-AlphanumericDevicePasswordRequired <Boolean>]
[-ApprovedApplicationList <ApprovedApplicationCollection>]
[-AttachmentsEnabled <Boolean>]
[-Confirm]
[-DeviceEncryptionEnabled <Boolean>]
[-DevicePasswordEnabled <Boolean>]
[-DevicePasswordExpiration <Unlimited>]
[-DevicePasswordHistory <Int32>]
[-DevicePolicyRefreshInterval <Unlimited>]
[-DomainController <Fqdn>]
[-IrmEnabled <Boolean>]
[-IsDefault <Boolean>]
[-IsDefaultPolicy <Boolean>]
[-MaxAttachmentSize <Unlimited>]
[-MaxCalendarAgeFilter <CalendarAgeFilterType>]
[-MaxDevicePasswordFailedAttempts <Unlimited>]
[-MaxEmailAgeFilter <EmailAgeFilterType>]
[-MaxEmailBodyTruncationSize <Unlimited>]
[-MaxEmailHTMLBodyTruncationSize <Unlimited>]
[-MaxInactivityTimeDeviceLock <Unlimited>]
[-MinDevicePasswordComplexCharacters <Int32>]
[-MinDevicePasswordLength <Int32>]
[-PasswordRecoveryEnabled <Boolean>]
[-RequireDeviceEncryption <Boolean>]
[-RequireEncryptedSMIMEMessages <Boolean>]
[-RequireEncryptionSMIMEAlgorithm <EncryptionSMIMEAlgorithmType>]
[-RequireManualSyncWhenRoaming <Boolean>]
[-RequireSignedSMIMEAlgorithm <SignedSMIMEAlgorithmType>]
[-RequireSignedSMIMEMessages <Boolean>]
[-RequireStorageCardEncryption <Boolean>]
[-UNCAccessEnabled <Boolean>]
[-UnapprovedInROMApplicationList <MultiValuedProperty>]
[-WSSAccessEnabled <Boolean>]
[-WhatIf]
[<CommonParameters>]Parameters (57)
| Parameter | Type | Required | What it controls |
|---|---|---|---|
| -Name | String | yes | The Name parameter specifies the name of the policy. |
| -AllowApplePushNotifications | Boolean | This parameter is available only in the cloud-based service. | |
| -AllowBluetooth | BluetoothType | The AllowBluetooth parameter specifies whether the Bluetooth capabilities of the mobile phone are allowed. The available options are Disable, HandsfreeOnly, and Allow. The default value is Allow. | |
| -AllowBrowser | Boolean | The AllowBrowser parameter specifies whether Microsoft Pocket Internet Explorer is allowed on the mobile phone. The default value is $true. This parameter doesn't affect non-Microsoft browsers. | |
| -AllowCamera | Boolean | The AllowCamera parameter specifies whether the mobile phone's camera is allowed. The default value is $true. | |
| -AllowConsumerEmail | Boolean | The AllowConsumerEmail parameter specifies whether the mobile phone user can configure a personal email account on the device. The default value is $true. | |
| -AllowDesktopSync | Boolean | The AllowDesktopSync parameter specifies whether the mobile phone can synchronize with a desktop computer through a cable. The default value is $true. | |
| -AllowExternalDeviceManagement | Boolean | The AllowExternalDeviceManagement parameter specifies whether an external device management program is allowed to manage the device. | |
| -AllowHTMLEmail | Boolean | The AllowHTMLEmail parameter specifies whether HTML email is enabled on the device. The default value is $true. | |
| -AllowInternetSharing | Boolean | The AllowInternetSharing parameter specifies whether the mobile phone can be used as a modem to connect a computer to the Internet. The default value is $true. | |
| -AllowIrDA | Boolean | The AllowIrDA parameter specifies whether infrared connections are allowed to the mobile phone. The default value is $true. | |
| -AllowMobileOTAUpdate | Boolean | The AllowMobileOTAUpdate parameter specifies whether certain updates are seen by devices that implemented support for this restricting functionality. Further control can be specified via the MobileOTAUpdateMode parameter. | |
| -AllowNonProvisionableDevices | Boolean | When set to $true, the AllowNonProvisionableDevices parameter enables all devices to synchronize with the computer running Exchange, regardless of whether the device can enforce all the specific settings established... | |
| -AllowPOPIMAPEmail | Boolean | The AllowPOPIMAPEmail parameter specifies whether the user can configure a POP3 or IMAP4 email account on the device. The default value is $true. | |
| -AllowRemoteDesktop | Boolean | The AllowRemoteDesktop parameter specifies whether the mobile phone can initiate a remote desktop connection. The default value is $true. | |
| -AllowSimpleDevicePassword | Boolean | The AllowSimpleDevicePassword parameter specifies whether a simple device password is allowed. A simple device password is a password that has a specific pattern, such as 1111 or 1234. The default value is $true. | |
| -AllowSMIMEEncryptionAlgorithmNegotiation | SMIMEEncryptionAlgorithmNegotiationType | The AllowSMIMEEncryptionAlgorithmNegotiation parameter specifies whether the messaging application on the device can negotiate the encryption algorithm in case a recipient's certificate doesn't support the specified... | |
| -AllowSMIMESoftCerts | Boolean | The AllowSMIMESoftCerts parameter specifies whether S/MIME software certificates are allowed. The default value is $true. | |
| -AllowStorageCard | Boolean | The AllowStorageCard parameter specifies whether the device can access information stored on a storage card. The default value is $true. | |
| -AllowTextMessaging | Boolean | The AllowTextMessaging parameter specifies whether text messaging is allowed from the device. The default value is $true. | |
| -AllowUnsignedApplications | Boolean | The AllowUnsignedApplications parameter specifies whether unsigned applications can be installed on the device. The default value is $true. | |
| -AllowUnsignedInstallationPackages | Boolean | The AllowUnsignedInstallationPackages parameter specifies whether unsigned installation packages can be run on the device. The default value is $true. | |
| -AllowWiFi | Boolean | The AllowWiFi parameter specifies whether wireless Internet access is allowed on the device. The default value is $true. | |
| -AlphanumericDevicePasswordRequired | Boolean | The AlphanumericDevicePasswordRequired parameter specifies whether the device password must be alphanumeric. The default value is $false. | |
| -ApprovedApplicationList | ApprovedApplicationCollection | The ApprovedApplicationList parameter specifies a list of approved applications for the device. | |
| -AttachmentsEnabled | Boolean | The AttachmentsEnabled parameter specifies whether the user can download attachments. When set to $false, the user is blocked from downloading attachments. The default value is $true. | |
| -Confirm | SwitchParameter | The Confirm switch specifies whether to show or hide the confirmation prompt. How this switch affects the cmdlet depends on whether the cmdlet requires confirmation before proceeding. | |
| -DeviceEncryptionEnabled | Boolean | The DeviceEncryptionEnabled parameter, when set to $true, enables device encryption on the mobile phone. The default value is $false. Currently, only the storage card can be encrypted on devices running Windows... | |
| -DevicePasswordEnabled | Boolean | When set to $true, the DevicePasswordEnabled parameter specifies that the user set a password for the device. The default value is $false. | |
| -DevicePasswordExpiration | Unlimited | The DevicePasswordExpiration parameter specifies the length of time, in days, that a password can be used. After this length of time, a new password must be created. The format of the parameter is dd.hh.mm:ss, for... | |
| -DevicePasswordHistory | Int32 | The DevicePasswordHistory parameter specifies the number of previously used passwords to store. When a user creates a password, the user can't reuse a stored password that was previously used. | |
| -DevicePolicyRefreshInterval | Unlimited | The DevicePolicyRefreshInterval parameter specifies how often the policy is sent from the server to the mobile phone | |
| -DomainController | Fqdn | This parameter is available only in on-premises Exchange. | |
| -IrmEnabled | Boolean | The IrmEnabled parameter specifies whether Information Rights Management (IRM) is enabled for the mailbox policy. | |
| -IsDefault | Boolean | The IsDefault parameter specifies whether this policy is the default Mobile Device mailbox policy. The default value is $false. If another policy is currently set as the default, setting this parameter replaces the... | |
| -IsDefaultPolicy | Boolean | The IsDefault parameter specifies whether this policy is the default Mobile Device mailbox policy. The default value is $false. If another policy is currently set as the default, setting this parameter replaces the... | |
| -MaxAttachmentSize | Unlimited | The MaxAttachmentSize parameter specifies the maximum size of attachments that can be downloaded to the mobile phone. The default value is Unlimited. | |
| -MaxCalendarAgeFilter | CalendarAgeFilterType | The MaxCalendarAgeFilter parameter specifies the maximum range of calendar days that can be synchronized to the device. Valid values are: | |
| -MaxDevicePasswordFailedAttempts | Unlimited | The MaxDevicePasswordFailedAttempts parameter specifies the number of attempts a user can make to enter the correct password for the device. You can enter any number from 4 through 16. The default value is 8. | |
| -MaxEmailAgeFilter | EmailAgeFilterType | The MaxEmailAgeFilter parameter specifies the maximum number of days of email items to synchronize to the device. | |
| -MaxEmailBodyTruncationSize | Unlimited | The MaxEmailBodyTruncationSize parameter specifies the maximum size at which email messages are truncated when synchronized to the device. The value is specified in kilobytes (KB). | |
| -MaxEmailHTMLBodyTruncationSize | Unlimited | The MaxEmailHTMLBodyTruncationSize parameter specifies the maximum size at which HTML-formatted email messages are synchronized to the device. The value is specified in KB. | |
| -MaxInactivityTimeDeviceLock | Unlimited | The MaxInactivityTimeDeviceLock parameter specifies the length of time that the device can be inactive before the password is required to reactivate the device. You can enter any interval between 30 seconds and 1... | |
| -MinDevicePasswordComplexCharacters | Int32 | The MinDevicePasswordComplexCharacters parameter specifies the minimum number of complex characters required in a device password. A complex character isn't a letter. | |
| -MinDevicePasswordLength | Int32 | The MinDevicePasswordLength parameter specifies the minimum number of characters in the device password. You can enter any number from 1 through 16. The maximum length a password can be is 16 characters. The default... | |
| -PasswordRecoveryEnabled | Boolean | The PasswordRecoveryEnabled parameter specifies whether you can store the recovery password for the device on an Exchange server. When set to $true, you can store the recovery password for the device on an Exchange... | |
| -RequireDeviceEncryption | Boolean | The RequireDeviceEncryption parameter specifies whether encryption is required on the device. The default value is $false. | |
| -RequireEncryptedSMIMEMessages | Boolean | The RequireEncryptedSMIMEMessages parameter specifies whether you must encrypt S/MIME messages. The default value is $false. | |
| -RequireEncryptionSMIMEAlgorithm | EncryptionSMIMEAlgorithmType | The RequireEncryptionSMIMEAlgorithm parameter specifies what required algorithm must be used when encrypting a message. | |
| -RequireManualSyncWhenRoaming | Boolean | The RequireManualSyncWhenRoaming parameter specifies whether the device must synchronize manually while roaming. The default value is $false. | |
| -RequireSignedSMIMEAlgorithm | SignedSMIMEAlgorithmType | The RequireSignedSMIMEAlgorithm parameter specifies what required algorithm must be used when signing a message. | |
| -RequireSignedSMIMEMessages | Boolean | The RequireSignedSMIMEMessages parameter specifies whether the device must send signed S/MIME messages. | |
| -RequireStorageCardEncryption | Boolean | The RequireStorageCardEncryption parameter specifies whether encryption of a storage card is required. The default value is $true. | |
| -UnapprovedInROMApplicationList | MultiValuedProperty | The UnapprovedInROMApplicationList parameter specifies a list of applications that can't be run in ROM. | |
| -UNCAccessEnabled | Boolean | The UNCAccessEnabled parameter specifies whether access to Microsoft Windows file shares is enabled. Access to specific shares is configured on the Microsoft Exchange ActiveSync virtual directory. | |
| -WhatIf | SwitchParameter | The WhatIf switch shows what the command does without making any changes. You don't need to specify a value with this switch. | |
| -WSSAccessEnabled | Boolean | The WSSAccessEnabled parameter specifies whether access to Microsoft Windows SharePoint Services is enabled. Access to specific shares is configured on the Exchange ActiveSync virtual directory. |
Reference facts derived from Microsoft documentation, © Microsoft, licensed CC BY 4.0; restructured with original guidance by serv365.ai.