Enterprise IT: How to manage Apple iPhones with Microsoft Exchange

Apple Online Store “When iPhones first started trickling into my office, I was a little apprehensive. At the time they only supported IMAP and POP3 for e-mail, which can be tricky to support in an Exchange environment. Two generations later, the iPhone has become a robust enterprise-grade mobile device,” Michael Scalisi reports for PC World.

“Slowly but surely, my users have been migrating from their BlackBerrys to iPhones. I’m happy to help them make the transition. iPhones are simply easier to integrate with Microsoft Exchange,” Scalisi reports.

“ActiveSync on the iPhone is natively supported on both Exchange Server 2003 and 2007,” Scalisi reports. “If you are already running an OWA server configured to use SSL with port 443 open on your firewall, you have already done the hard part.”

Read the full article here.

27 Comments

  1. I have no doubt that some IT Specialist will chime in how iPhone is missing several critical security features and as such is simply a no-go for any serious large-scale enterprise deployment. We’ve seen those posts every time an article pops up about iPhone in the enterprise.

    This article proves the point that vast majority of enterprises (medium and large corporations) that currently have blackberry deployments could easily migrate to iPhone without any security policy issues. No doubt, there is a small number of companies that have fairly confidential data on their mobile fleet and some of the features offered by Blackberry have not been replicated on the iPhone. However, as I said, the number of such deployments is rather small, and for many others out there, iPhone can easily check all the necessary check boxes for compliance. So, the only remaining issue will be, as always, the expertise (or lack thereof) and the will (or lack thereof) of the IT departments required to execute the migration. Ay, there’s the rub (as the Bard would say…).

    It’s always nice to come across articles like this one. They provide arguments for those in IT business who don’t mind doing a bit extra work in order to migrate the drones away from MS/RIMM and into the Apple world.

  2. Biggest problem we had deploying iPhones was getting OWA SSL to work properly and it was all Exchange 2003’s fault. My users love their iPhones. They have full Mail, Contact, and Calendar support, and we have deployed some web based tools for them as well that run great in Safari. iPhone in the Enterprise is great.

  3. Yes if all you care about is Exchange ActiveSync it’s pretty basic to setup and support. The kicker is you need a hodge podge approach using Apple’s Web Configuration Utility and EAS policy and there is still gaps.

    Doesn’t help the fact you have zero management / reporting and for any corporate liable installation that is a big deal when you need to manage thousands of devices.

    Add the fact iPhone itself is as secure as Paris Hilton’s latest liason and it’s simply not worth the headache. 3GS encryption is a joke and has been shown to be nothing but a farce. Every OS is jailbroken and thus has a means to SSH into the iPhone and disable said EAS policy so no – There will be no iPhones supported in any enterprise that actually cares about security and has regulations to adhere to. Come Jan 1, 2010 the State of Mass has some pretty indepth consumer focused data protection regulation that applies to any business that hold consumer data from that state (read any company that does business outside of their home state) – so as iPhone is now it will not meet this regulation.

    So you’ll all cry don’t store any consumer data on your iPhone .. ahhh if only said regulators would take my word for that. Doesn’t help that iPhone keeps an image cache for the past few months of the screen everytime you press the home button.

    Lets stop pretending iPhone is somethng its not. Fantastic consumer focused MID with decent “business” usage but no where close to what a BB attached to BES provides enterprise. If Apple wants that – fix your product or snap into Microsoft Mobile Device Manager 2008 or even better add support for RIM BES. You’ll get all the sales you can handle.

    Until that happens (read not in this lifetime) – keep it for personal usage and off corporate networks.

  4. yawn,

    What an appropriate name you have.

    You and your ‘they’ll pry Windows from my dead hands’ brethren are going the way of the sabretooth tiger.

    Your points aren’t invalid, it’s your delivery and absolute ‘know-it-all’ attitude that will hurt you in the end.

  5. @ yawn.
    You are indeed a yawn, and a typical corporate IT guy.
    Loads of Cert’s and no common sense, let alone intelligence.
    You keep playing it the 80’s way.
    You’ll soon need one of Obama’s programs as you’ll be unemployed.
    Fool.

  6. “IMAP and POP3 for e-mail, which can be tricky to support in an Exchange environment”

    Um, checking the ‘enable pop’ and ‘enable imap’ boxes is tricky?

    Sure, there were IT departs that didn’t WANT to enable them, but that is totally different from it being difficult or tricky to enable them.

  7. I’m sorry if the truth is hard to swallow. Every point is spot on and known across every enteprise that support mobility. We have given Apple boatloads of feedback and their response is always “It’s not on our roadmap”. Well when their ready for enterprise sales / support let us know.

    This is more about SMB that want to be mobile then “enterprise” which has a whole different set of needs. Apple wants to be both but its apparent their focus is consumers and I’m not blaming them – it’s the largest growth vertical and hoping personal liable devices will somehow change how enterprise functions is just not a valid approach to me. I have yet to meet anyone in the Fortune 500 that is estastic about allowing personal liable mobile devices connect to corporate data.

  8. The company I work for has a diferent name for the network password and for the inbox name, so is kind of difficult implement the domain\user credentials because the iPhone expect the \user to be the inbox name.

    Using the OWA alternative works perfectly,

  9. What I love most about this site is if you slam anything that isn’t all pro Apple you somehow are not part of the faithful?

    I actually work part time at an Apple Store genius bar as gasp I’m also an Apple certified tech as well. Imagine that. I get out plenty and don’t drink the kool-aid. If you want to believe iPhone via EAS is as good as BES more power to you, but I will argue against that as I support mobility every day for a living and it’s not even close.

    No excuse me while I rescue yet another user who killed his macBook.

  10. Isn’t Scalisi the same guy who blasted the rumored iTablet for being a “train wreck”, based on his own guesses and such? “The concept is such a train wreck I don’t know where to start…”

    He’s got about as much credibility as Thurrott, Dvorak, and Enderle.

  11. Yawn,

    I think your concerns are valid and it seems that you know more about them than anyone, including myself.

    It is your smarter-than-me attitude that I have a problem with. It doesn’t matter if you are a Windows or Mac know-it-all, either way your less than constructive criticism is not appreciated.

    A simple re-phrase would come across as more acceptable and embraceable.

    It isn’t the message, it’s the way it is expressed that is the issue.

    To be fair, I feel the same way about flight attendants that just because they have been “doing this for years” act as if you should also do things in only the way that they want you to do it. Even if it is your first time on an airplane.

  12. I like yawn. She sounds super smart and sensible—which is the exact opposite of you MAC cultists. You should listen to what she is saying instead of trying to justify that dumpy I-Phone that obviously doesn’t work where it really counts: the enterprise.

    Leave it to MAC dorks to second guess IT Professionals, who happen to be the most intelligent people I know. Because they all recommend Windows. Suck it, MAC dorks.

    Your potential. Our passion.™

    P.S. yawn, I look forward to more of your insightful posts. Great job! If I could make a suggestion, maybe in the future you could discuss the merits of Windows Mobile in the enterprise. It would blow MAC sheep’s minds!

  13. OK, first, Zune Tang®. You, my friend, are frickin’ hi-larious. Intentional or not, pure poetry!

    Now, to Ms. Yawn. Maybe your name should actually be Ms. Lawn, as in astro-turf. Because you sound grass roots, but it just feels phony. I mean, sure you have (debatable) facts to site, but what part-time Apple genius also rubs elbows with the “Fortune 500” IT and corporatati? Do you have a super-hero costume as well?

    I’m sorry, but I just don’t buy it.

  14. Part-time sys admin and Apple genius?
    I think not.
    I am an IT professional and we do use the iPhone.
    If yawner really did too, he’d talk about the costs of running BES and the fact that Active Sync works great and almost never has problems as opposed to running separate BES.
    What a joker.
    Blackberries can be broken just like an iPhone, and we immediately shut down and wipe any iPhone that has been broken.
    Service calls for iPhones are non-existant and the BBs cost us a fortune in both costs of failing/broken hardware and crappy software.
    Again -you have to have separate BES hardware/software that costs a ton.
    Not so with Active Sync on the EXCH servers.

  15. Yes FULL time sys Admin (exchange/iron/BES/Rightfax etc) AND part time to pay off college – some people do have to work.

    Your logic is invalid as yes BES does have a seperate hardware and CAL but to equal said BES security / management you need to go beyond basic EAS policy provided by Exch2003/2007 and install Microsoft Mobile Device Manager 2008 or a 3rd party solution (Good, Trust Digital, Sybase etc) all of which have a higher CAL cost and STILL don’t come close to what BES provides.

    If all you want is email SYNC knock yourself out with EAS (that is no where near as clean as BES push) it was a pig when it first came out and it still is. How long does your battery last pulling down email all day against EAS? How’s your international roaming fees when users download large attachments?

    Please provide one report that shows Blackberry encryption broken in 10 mins? Or anything showing one hacked? RIM has the highest security certification out there.

    Sorry but EAS remote wipe has a major flaw in all I need to do if I stole your iPhone is pop the sim out and I can spend all the time I want hacking it / stealing your company data. So no matter how quickly a user informs you of a lost / stolen device you are at the mercy of those users telling you. BES provides a policy that after X time of not communicating it will self erase. Not to mention all the other security focused options. Sounds like you have no regulations to adhere to so as I’ve said “enterprise” is something that is loosely thrown around and there is a difference supporting mobility for 100 people vs. 20,000. Love to hear how you do any reporting on usage using EAS. Even basic asset management is a chore with parsing our IIS logs.

    Perhaps if operating BES costs you so much you might want to hire some people that know what their doing with experience supporting mobility? Just a thought.

  16. Actually, all the DO need is mail/contacts and calendars.
    As for roaming, none of our BB or iPhone users have roaming sans the very high-end execs and their assistants.
    Batteries are fine. Blackberries that are comparable have the same battery life.
    As for the SIM and disabling: if a user waits long enough that we can’t remotely wipe, then it’s on them.
    The only way to secure your data is to not let it leave the buildings.
    No laptops, BBs or iPhones at all is the safe way.
    As for the number of people, we have ~5k globally. Each region (4) maintains the data for each.
    Having to have four BES to take care of that base is ridiculous compared to using AS on the EXCH servers.
    We also have RightFAX – that’s a decent setup.

  17. Then yes I agree for your company EAS makes sense but for us being global with upwards of 30k users we need the management and security BES offers.

    Mobility definately expands your WAN border and brings many things to consider when you weigh risk / usage. The benefit of mobility is clearly been shown though through workflow improvements, communication etc.

    Yeah RF is decent, our darn board servers keep flaking out but when you have almost 10k people using RF I guess it’s expected!

Reader Feedback

This site uses Akismet to reduce spam. Learn how your comment data is processed.