The two-layer reality
Modern layer (the decision-maker): Conditional Access + Intune compliance/MAM — 'require approved client + protection policy' (Outlook mobile + MAM) is the standard posture; native mail apps ride device-compliance gates or die at CA. This layer is where mobile-mail SECURITY actually happens now (the Teams mobility concepts, mail edition).
Exchange layer (still underneath): per-mailbox ActiveSyncEnabled, org ActiveSync settings, ABQ (Allow/Block/Quarantine device rules — Get-ActiveSyncOrganizationSettings' DefaultAccessLevel + device-family rules), and mobile device mailbox policies (PIN/encryption asks honoured variably by clients — the reason Intune exists). Both org objects are in the nightly scan.
The interaction rules that matter:
- Most restrictive wins: CA can block what ABQ allows; ABQ can quarantine what CA passed. A device 'blocked mysteriously' walks BOTH layers — sign-in logs for the CA verdict, device access state (Get-MobileDevice) for the Exchange verdict.
- Outlook mobile mostly bypasses classic ActiveSync semantics (it syncs via its own service path) — ABQ device rules bite native apps hardest; if policy says 'Outlook only', ENFORCE at CA and set the Exchange layer's default to quarantine/block as the backstop, not the primary.
- The quarantine limbo: DefaultAccessLevel=Quarantine parks new devices awaiting admin approval, mailing the admins — an estate that forgot this setting has a mailbox of decade-old approval requests and users who think mobile 'just doesn't work'.
What to watch (proofs)
- The org stance: ActiveSyncOrganizationSettings + ActiveSyncMailboxPolicy in the scan — DefaultAccessLevel drift is the 'suddenly no new phones work' pre-explanation.
- Per-user truth: Get-CASMailbox (protocol switches) + Get-MobileDevice/statistics (device states, last sync) — the blocked/quarantined census with staleness.
- Layer attribution per ticket: CA sign-in verdict FIRST, then Exchange device state — the two-layer walk as desk procedure.
- Legacy-app exposure: devices syncing via native ActiveSync clients (device-type stats) — the population your MAM posture doesn't cover; drive to zero or accept explicitly.