administrator help
13. On the Allowed mail user agents page, you can specify mail user agents (i.e. email client applications) that are allowed to connect to the EAS proxy. When a client connects to the EAS proxy using an email application that is not specified, the request will be rejected.
■
■
Select Allow all mail user agents to configure no restriction.
Select Only allow the specified mail user agents and then select a mail user agent from the list. Click Add to add the entry to the list of allowed agents. Repeat this for all mail user agents that are allowed to connect to the EAS proxy.
14. On the Sophos Mobile Control EAS Proxy - Configuration Wizard finished page, click
Finish to close the Configuration Wizard and return to the Setup Wizard.
15. In the Setup Wizard, make sure that Start Sophos Mobile Control EAS Proxy server now is selected, then click Finish to complete the configuration and to start the Sophos Mobile
Control EAS proxy for the first time.
To complete the EAS proxy configuration, upload the certificates that were created for every proxy instance to Sophos Mobile Control:
16. Log in to the Sophos Central Admin console.
17. On the menu sidebar, under My Products, click Mobile.
18. On the menu sidebar of the Mobile view, under SETTINGS, click Setup > System setup and then click the EAS proxy tab.
19. Under External, click Upload a file and upload the certificate that the Sophos Mobile Control
EAS Proxy - Setup Wizard has created for the PowerShell connection.
If you have set up more than one instance, repeat this for all instance certificates.
20. Click Save.
21. In Windows, open the Services dialog and restart the EASProxy service.
This completes the initial setup of the standalone EAS proxy.
Note: Every day, the EAS proxy log entries are moved to a new file, using the naming pattern
EASProxy.log.yyyy-mm-dd
. These daily log files are not deleted automatically and thus may cause disk space issues over time. We recommend that you set up a process to move the log files to a backup location.
19.4 Set up email access control through PowerShell
You can set up a PowerShell connection to an Exchange or an Office 365 server. This means that the EAS proxy service communicates with the email server through PowerShell to control the email access for your managed devices. Email traffic is routed directly from the devices to the email server. It is not routed through a proxy.
The PowerShell scenario has these advantages:
■
Devices communicate directly with the Exchange server.
■
You do not need to open a port on your server for incoming email traffic from your managed devices.
Supported email servers are:
■
Exchange Server 2010
■
Exchange Server 2013
189
Sophos Mobile Control (in Sophos Central)
■
■
Exchange Server 2016
Office 365 with an Exchange Online plan
To set up PowerShell:
1. Configure PowerShell.
2. Create a service account on the Exchange server or in Office 365. This account is used by
Sophos Mobile Control to execute PowerShell commands.
3. Set up one or more PowerShell connection instances to Exchange or Office 365.
4. Upload the instance certificates to Sophos Mobile Control.
Configure PowerShell
1. On the computer on which you are going to install the EAS proxy, open Windows PowerShell, as an administrator, and enter:
PS C:\Windows\system32> Set-ExecutionPolicy RemoteSigned
Note: If PowerShell is not available, install it as described in the Microsoft article Installing
Windows PowerShell (external link) .
2. If you want to connect to a local Exchange server, open Windows PowerShell as administrator on that computer and enter the same command as before:
PS C:\Windows\system32> Set-ExecutionPolicy RemoteSigned
Note: This step is not required for Office 365.
Create a service account
3. Log in to the relevant admin console:
■
■
■
For Exchange Server 2010: Exchange Management Console
For Exchange Server 2013/2016: Exchange Admin Center
For Office 365: Office 365 Admin Center
4. Create a user account. This account is used as a service account by Sophos Mobile Control to execute PowerShell commands.
■
■
■
Use a user name like
smc_powershell
that identifies the account purpose.
Turn off the setting to make the user change their password the next time they log in.
Remove any Office 365 license that was automatically assigned to the new account. Service accounts don’t require a license.
5. Create a new role group and assign it the required permissions.
■
Use a role group name like
smc_powershell
.
■
■
Add the Mail Recipients and Organization Client Access roles.
Add the service account as a member.
Set up PowerShell connections
190
administrator help
6. Use the Sophos Mobile Control EAS Proxy - Setup Wizard as if you would set up a standalone EAS Proxy. In wizard step EAS Proxy instance setup, configure the following settings:
■
■
■
■
■
Instance type: Select PowerShell Exchange/Office 365.
Instance name: A name to identify the instance.
Exchange server: The name or IP address of the Exchange server (for a local Exchange server installation) or
outlook.office365.com
(for Office 365). Don’t include a prefix
https://
or a suffix
/powershell
. These are added automatically.
Allow all certificates: The certificate that the Exchange server presents is not verified.
Use this for example if you have a self-signed certificate installed on your Exchange server.
Because the Allow all certificates option reduces the security level of the server communication, we strongly recommend that you select it only if required by your network environment.
Allow EWS subscription requests from Secure Email: Select this to allow the Sophos
Secure Email app on iOS to subscribe to push notifications through Exchange Web Services
(EWS). Push notifications inform the device when there are messages for Secure Email, even if the app is closed.
Note: By default, the EAS proxy blocks all requests to the Exchange server’s EWS interface for security reasons. If you select this checkbox, subscription requests are allowed. Other requests remain blocked.
■
■
Service account: The name of the user account you created in the Exchange or Office
365 admin console.
Password: The password of the user account.
7. Click Add to add the instance to the Instances list.
8. Optional: Repeat the previous steps to set up PowerShell connections to other Exchange or
Office 365 servers.
9. Complete the Sophos Mobile Control EAS Proxy - Setup Wizard as described in Install the standalone EAS proxy (page 187).
Upload certificates
10. Log in to the Sophos Central Admin console.
11. On the menu sidebar, under My Products, click Mobile.
12. On the menu sidebar of the Mobile view, under SETTINGS, click Setup > System setup and then click the EAS proxy tab.
13. Under External, click Upload a file. Upload the certificate that the Sophos Mobile Control
EAS Proxy - Setup Wizard created for the PowerShell connection.
If you have set up more than one instance, repeat this for all instance certificates.
14. Click Save.
15. In Windows, open the Services dialog and restart the EASProxy service.
This completes the initial setup of PowerShell connections. Email traffic between a managed device and the Exchange or Office 365 servers is blocked if the device violates a compliance rule.
You can block an individual device by setting the email access mode for that device to Deny.
Note: Depending on the configuration of your Exchange server, devices receive a notification when their email access is blocked.
191
