Deploying Outlook for iOS and Android app configuration settings in Exchange Online

Summary: How to customize the behavior of Outlook for iOS and Android in your Exchange organization.

Outlook for iOS and Android supports app settings that allow unified endpoint management (UEM) administrators (using tools such as Microsoft Intune) and Microsoft 365 or Office 365 administrators to customize the behavior of the app.

App configuration can be delivered either through the mobile device management OS channel on enrolled devices (Managed App Configuration channel for iOS or the Android in the Enterprise channel for Android or through the Intune App Protection Policy (APP) channel. Outlook for iOS and Android supports the following configuration scenarios:

• Account setup configuration
• Organization allowed accounts mode
• General app configuration settings
• S/MIME settings
• Data protection settings

Each configuration scenario highlights its specific requirements for example, whether the configuration scenario requires device enrollment, and thus works with any UEM provider, or requires Intune App Protection Policies. The following flowchart outlines which channel needs to be used for the above configuration scenarios:

Account configuration scenarios

Outlook for iOS and Android offers administrators the following app configuration scenarios with enrolled devices:

• Account setup configuration
• Organization allowed accounts mode

These configuration scenarios only work with enrolled devices. However, any UEM provider is supported. If you aren't using Microsoft Intune, you need to refer your UEM documentation on how to deploy these settings. For more information on the configuration keys, see Configuration keys.

Account setup configuration scenario

Outlook for iOS and Android offers administrators the ability to "push" account configurations to their Office 365 and on-premises users leveraging hybrid Modern Authentication users. For more information on account setup configuration, see Account setup with modern authentication in Exchange Online.

Organization allowed accounts mode scenario

Outlook for iOS and Android offers administrators the ability to restrict email and storage provider accounts to only corporate accounts. For more information on organization allowed accounts mode, see Account setup with modern authentication in Exchange Online.

General app configuration scenarios

Outlook for iOS and Android offers administrators the ability to customize the default configuration for several in-app settings. This capability is offered for both enrolled devices via any UEM provider and for devices that aren't enrolled when Outlook for iOS and Android has an Intune App Protection Policy applied.

Outlook supports the following settings for configuration:

Settings that are security-related in nature have an additional option, Allow user to change setting. For these settings (Save Contacts, Block external images, and Require Biometrics to access the app), organizations can prevent the user from changing the app's configuration. The organization's configuration can't be overridden.

Allow user to change setting doesn't change the app's behavior. For example, if the admin enables Block external images and prevents a user change, then by default, external images aren't downloaded in messages; however, the user can manually download the images for that message body.

The following conditions describe Outlook's behavior when implementing various app configurations:

• If the admin configures a setting with its default value, and the app is configured with the default value, then the admin's configuration doesn't have any effect. For example, if the admin sets External recipients MailTip=on, the default value is also on, so Outlook's configuration doesn't change.
• If the admin configures a setting with the non-default value and the app is configured with the default value, then the admin's configuration is applied. For example, the admin sets Focused Inbox=off, but app default value is on, so Outlook's configuration for Focused Inbox is off.
• If the user has configured a non-default value, but the admin has configured a default value and allows user choice, then Outlook retains the user's configured value. For example, the user has enabled contact synchronization, but the admin sets Save Contacts=off and allows user choice, so Outlook keeps contact synchronization on and doesn't break caller-ID for user.
• If the admin disables user choice, Outlook always enforces the admin-defined configuration, regardless of the user's configuration or default app configuration. For example, the user has enabled contact synchronization, but the admin sets Save Contacts=off and disables user choice, so contact synchronization gets disabled and the user is prevented from enabling it.
• After the app configuration is applied, if the user changes the setting value to not match the admin desired value (and user choice is allowed), then the user's configuration is retained. For example, Block external images is off by default, admin set Block external images=on, but afterwards, user changes Block external images back to off. In this scenario, Block external images remains off the next time the policy is applied.

Users are alerted to configuration changes via a notification toast in the app:

This notification toast will automatically dismiss after 10 seconds. There are two scenarios where this notification toast won't appear:

• If the app has previously shown the notification in the last hour.
• If the app has been installed in less than 24 hours.

External recipients MailTip offline domain configuration

In Outlook for iOS and Android, when the MailTip service is unavailable for external recipients as the user is offline or due to low connectivity, use the following MDM app configuration to set all the internal domains of the tenant:

• Key: com.microsoft.outlook.Mail.InternalDomains.
• Value:
  1. A list of domains split by a comma (,) in string type.
  2. You only need to add all your root domains. For example, if you have microsoft.com domain in your config, service.microsoft.com, exchange.microsoft.com, and hr.service.microsoft.com are all considered as internal recipients.
  3. All domains aren't case sensitive.
• Config example:
  microsoft.com, contoso.onmicrosoft.com, hcdhc.net

Save Contacts

The Save Contacts setting is a special case scenario because unlike the other settings, this setting requires user interaction: the user needs to grant Outlook permissions to access the native Contacts app and the data stored within. If the user doesn't grant access, then contact synchronization can't be enabled.

The workflow for enabling Save Contacts is the same for new accounts and existing accounts.

1. The user is notified that the administrator has enabled contact synchronization. In Outlook for iOS, the notification occurs within the app, whereas in Outlook for Android, a persistent notification is delivered via the Android notification center.

   

2. If the user taps on the notification, the user is prompted to grant access:

   

3. If the user allows Outlook to access the native Contacts app, access is granted, and contact synchronization is enabled. If the user denies Outlook access to the native Contacts app, then the user is prompted to go into the OS settings and enable contact synchronization:

   

4. In the event the user denies Outlook access to the native Contacts app and dismisses the previous prompt, the user may later enable access by navigating to the account configuration within Outlook and tapping Open Settings:

   

Calendar Sync

Calendar sync enables users to synchronize their Outlook for Android calendar data with the native Android Calendar app. Calendar sync is off by default and requires user participation. ] Like Save Contacts, the Sync Calendars setting is another special case scenario because this setting requires user interaction: the user needs to grant Outlook permissions to access the native Calendar app and the data stored within. If the user doesn't grant access, then calendar synchronization can't be enabled.

S/MIME scenarios

On enrolled devices, Outlook for iOS and Android supports automated certificate delivery. Outlook for iOS and Android also supports app configuration settings that enable or disable S/MIME in the app, as well as the user's ability to change the setting. For more information on how to deploy these settings via Microsoft Intune, see Understanding S/MIME. For more information on the configuration keys, see Configuration keys.

Data protection scenarios

Outlook for iOS and Android supports app configuration policies for the following data protection settings when the app is managed by Microsoft Intune with an Intune App Protection Policy applied:

• Managing the use of wearable technology
• Managing sensitive data in mail and calendar reminder notifications
• Managing the contact fields synchronized to the native contacts app
• Managing calendar sync availability
• Managing add-ins availability

These settings can be deployed to the app regardless of device enrollment status. For more information on the configuration keys, see Configuration keys.

Configure Wearables for Outlook for iOS and Android

By default, Outlook for iOS and Android supports wearable technology, allowing the user to receive message notifications and event reminders, and the ability to interact with messages and view daily calendars. Organizations that want to disable the ability to access corporate data on wearables can block wearables with an App Configuration Policy.

Configure Notifications for Outlook for iOS and Android

Mobile app notifications are critical in alerting users of new content or reminding them to act. Users interact with these notifications via the lock screen and in the operating system's notification center. Notifications often include detailed information, which can be sensitive in nature. This information, unfortunately, can inadvertently be leaked to casual observers.

Outlook for iOS and Android has designed its notifications to enable users to triage email and alert users to upcoming meetings, including incorporating Time to Leave suggestions. Mail notifications include the sender's address, the subject of the message, and a short message preview of the message body. Calendar reminders include the subject, location, and start time of the meeting.

Recognizing that these notifications may include sensitive data, organizations can use an Intune App Protection Policy setting, Org Data Notifications to remove the sensitive data. As this is an App Protection Policy setting, it applies on all devices (phones, tablets, and wearables) of the user for the apps that support the setting. For more information on the setting, see iOS App Protection Policy settings and Android App Protection Policy settings.

In addition to the App Protection Policy setting, Outlook for iOS and Android has a data protection App Configuration Policy setting, Calendar Notifications that provides additional flexibility with calendar notifications – organizations can block sensitive information in mail notifications, while allowing sensitive information in calendar notifications. After all, users might just need to know where they're going and when they should leave, at a glance.

The following table outlines the notification experience in Outlook for iOS and Android based on the combination of the App Protection and App Configuration policy settings:

Configure Contact Field Sync to native Contacts for Outlook for iOS and Android

The settings allow organizations to control the contact fields that synchronize between Outlook on iOS and Android and the native Contacts apps.

Configure Calendar Sync availability with Outlook for Android

Calendar sync enables users to synchronize their Outlook for Android calendar data with the native Android Calendar app. Organizations can control whether calendar sync is available to the work or school account with the following methods:

• With Intune App Protection Policies, the setting Sync policy managed app data with native apps or add-ins defines whether Save Contacts, Sync Calendars, and Add-ins are available for use within the work or school account. By default, this setting is set to Allow. If this setting is set to Block, Save Contacts, Sync Calendars, and Add-ins are disabled for the work or school account and their associated App Configuration Policy settings are ignored.
• When the Intune App Protection Policy setting Sync policy managed app data with native apps or add-ins is set to Allow, organizations can also choose to define the availability of Sync Calendars through a managed apps App Configuration Policy. This flexibility allows for feature granularity control from a data protection perspective; for example, organizations can enable Save Contacts (by setting Sync policy managed app data with native apps or add-ins to Allow) but disable Sync Calendars (by setting the Allow Calendar Sync setting within a managed apps App Configuration Policy to Off).
• Finally, if organizations allow the availability of Sync Calendars, through an App Configuration Policy setting Sync Calendars, organizations can define the default sync state of calendar sync. This setting removes the need for the user to enable calendar synchronization manually.

Configure Add-ins availability with Outlook for iOS and Android

Users can synchronize work or school account data into other services using add-ins. The availability of add-ins within the work or school account can be controlled with the following methods:

• With Intune App Protection Policies, the setting Sync policy managed app data with native apps or add-ins defines whether Save Contacts, Sync Calendars, and Add-ins are available for use within the work or school account. By default, this setting is set to Allow. If this setting is set to Block, Save Contacts, Sync Calendars, and Add-ins are disabled for the work or school account and their associated App Configuration Policy settings are ignored.
• When the Intune App Protection Policy setting Sync policy managed app data with native apps or add-ins is set to Allow, organizations can also choose to define the availability of Add-ins through a managed apps App Configuration Policy. This flexibility allows for feature granularity control from a data protection perspective; for example, organizations can enable Save Contacts (by setting Sync policy managed app data with native apps to Allow) but disable Add-ins (by setting the Allow Add-ins setting within a managed apps App Configuration Policy to Off).

Deploying configuration scenarios with Microsoft Intune for enrolled devices

Microsoft Intune enables administrators to easily deploy these settings to Outlook for iOS and Android via App Configuration Policies.

The following steps allow you to create an app configuration policy. After the configuration policy is created, you can assign its settings to groups of users.

Create a managed devices app configuration policy for Outlook for iOS and Android

1. Log in to Microsoft Intune admin center.

2. Select Apps and then select App configuration policies.

3. On the App Configuration policies blade, choose Add and select Managed devices to start the app configuration policy creation flow.

4. On the Basics section, enter a Name, and optional Description, for the app configuration settings.

5. For Platform, choose either iOS/iPadOS or Android Enterprise.

6. If Android Enterprise is selected as the platform, for Profile Type, choose All Profile Types.

7. For Targeted app, choose Select app, and then, on the Associated app blade, choose Microsoft Outlook. Select OK.

   Note

   If Outlook isn't listed as an available app, then you must add it by following the instructions in Assign apps to Android work profile devices with Intune and Add iOS store apps to Microsoft Intune.

8. Select Next to complete the basic settings of the app configuration policy.

9. On the Settings section, select Use configuration designer for the Configuration settings format.

10. If you want to deploy account setup configuration, select Yes for Configure email account settings and configure appropriately:

    Note

    If an App Protection Policy is targeted to the users, the recommendation is to deploy the general app configuration settings in a Managed Apps device enrollment model instead of using Managed devices. This method ensures the App Configuration Policy is deployed to both enrolled devices and unenrolled devices.

    • For Authentication type, select Modern authentication. This setting is required for Microsoft 365 or Office 365 accounts or on-premises accounts using hybrid modern authentication.
    • For Username attribute from Microsoft Entra ID, select User Principal Name.
    • For Email address attribute from Microsoft Entra ID, select Primary SMTP Address.
    • If you want to configure Outlook for iOS and Android such that only the work or school account can be used, select Require for Allow only work or school accounts. This configuration will only allow a single corporate account to be added to Outlook for iOS and Android.

11. If you want to deploy general app configuration settings, configure the desired settings accordingly:

    • For Focused Inbox, choose from the available options: Not configured (default), On (app default), and Off.

    • For Require Biometrics to access the app, choose from the available options: Not configured (default), On, and Off (app default). When selecting On or Off, administrators can choose to allow the user to change the app setting's value. Select Yes (app default) to allow the user to change the setting or select No if you want to prevent the user from changing the setting's value. This setting is only available in Outlook for iOS.

      Important

      If the account is protected by an Intune App Protection Policy that requires a PIN to access the protected account, then the Require Biometrics to access the app setting should be disabled, otherwise the user is prompted with multiple authentication prompts when accessing the app.

    • For Save Contacts, choose from the available options: Not configured (default), On, and Off (app default). When selecting On or Off, administrators can choose to allow the user to change the app setting's value. Select Yes (app default) to allow the user to change the setting or select No if you want to prevent the user from changing the setting's value.

    • For Suggested Replies, choose from the available options: Not configured (default), On (app default), and Off. When selecting On or Off, administrators can choose to allow the user to change the app setting's value. Select Yes (app default) to allow the user to change the setting or select No if you want to prevent the user from changing the setting's value.

    • For Recommendations feed, choose from the available options: Not configured (default), On (app default), and Off.

    • For External recipients MailTip, choose from the available options: Not configured (default), On (app default), and Off.

    • For Default app signature, choose from the available options: Not configured (default), On (app default), and Off.

    • For Block external images, choose from the available options: Not configured (default), On, and Off (app default). When selecting On or Off, administrators can choose to allow the user to change the app setting's value. Select Yes (app default) to allow the user to change the setting or select No if you want to prevent the user from changing the setting's value.

    • For Organize mail by thread, choose from the available options: Not configured (default), On (app default), and Off.

    • For Play My Emails, choose from the available options: Not configured (default), On (app default), and Off.

    • For Themes, choose from the available options: Not configured (default), On (app default), and Off.

    • For Sync Calendars, choose from the available options: Not configured (default), On (app default), and Off. When selecting On or Off, administrators can choose to allow the user to change the app setting's value. Select Yes (app default) to allow the user to change the setting or select No if you want to prevent the user from changing the setting's value. This feature is only available in Outlook for Android.

    • For Text Predictions, choose from the available options: Not configured (default), On (app default), and Off. When selecting On or Off, administrators can choose to allow the user to change the app setting's value. Select Yes (app default) to allow the user to change the setting or select No if you want to prevent the user from changing the setting's value.

12. If you want to configure S/MIME settings, see Outlook for iOS automated certificate delivery or Outlook for Android automated certificate delivery.

13. When you're finished selecting settings, select Next.

14. On the Assignments section, select Select groups to include. Select the Microsoft Entra group to which you want to assign the app configuration policy, and then select Select.

15. When you're finished with assignments, select Next.

16. On the Review + Create section, review the settings configured and select Create.

The newly created configuration policy is displayed on the App configuration blade.

Deploying configuration scenarios with Microsoft Intune for unenrolled devices

If you're using Microsoft Intune as your mobile app management provider, the following steps allow you to create a managed apps app configuration policy. After the configuration is created, you can assign its settings to groups of users.

Create a managed apps app configuration policy for Outlook for iOS and Android

1. Log in to Microsoft Intune admin center.

2. Select Apps and then select App configuration policies.

3. On the App Configuration policies blade, choose Add and select Managed apps.

4. On the Basics section, enter a Name, and optional Description, for the app configuration settings.

5. For Public apps, choose Select public apps, and then, on the Targeted apps blade, choose Outlook by selecting both the iOS and Android platform apps. Click Select to save the selected public apps.

6. Click Next to complete the basic settings of the app configuration policy.

7. On the Settings section, expand the Outlook configuration settings.

8. If you want to deploy general app configuration settings, configure the desired settings accordingly:

   • For Focused Inbox, choose from the available options: Not configured (default), Yes (app default), and No.

   • For Require Biometrics to access the app, choose from the available options: Not configured (default), Yes, and No (app default). When selecting Yes or No, administrators can choose to allow the user to change the app setting's value. Select Yes (app default) to allow the user to change the setting or select No if you want to prevent the user from changing the setting's value. This setting is only available in Outlook for iOS.

     Important

     If the account is protected by an Intune App Protection Policy that requires a PIN to access the protected account, then the Require Biometrics to access the app setting should be disabled, otherwise the user is prompted with multiple authentication prompts when accessing the app.

   • For Save Contacts, choose from the available options: Not configured (default), Yes, and No (app default). When selecting Yes or No, administrators can choose to allow the user to change the app setting's value. Select Yes (app default) to allow the user to change the setting or select No if you want to prevent the user from changing the setting's value.

   • For External recipients MailTip, choose from the available options: Not configured (default), Yes (app default), and No.

   • For Block external images, choose from the available options: Not configured (default), Yes, and No (app default). When selecting Yes or No, administrators can choose to allow the user to change the app setting's value. Select Yes (app default) to allow the user to change the setting or select No if you want to prevent the user from changing the setting's value.

   • For Default app signature, choose from the available options: Not configured (default), Yes (app default), and No.

   • For Suggested Replies, choose from the available options: Not configured (default), Yes (app default), and No. When selecting Yes or No, administrators can choose to allow the user to change the app setting's value. Select Yes (app default) to allow the user to change the setting or select No if you want to prevent the user from changing the setting's value.

   • For Organize mail by thread, choose from the available options: Not configured (default), Yes (app default), and No.

   • For Recommendations feed, choose from the available options: Not configured (default), Yes (app default), and No.

   • For Play My Emails, choose from the available options: Not configured (default), Yes (app default), and No.

   • For Sync Calendars, choose from the available options: Not configured (default), Yes (app default), and No. When selecting Yes or No, administrators can choose to allow the user to change the app setting's value. Select Yes (app default) to allow the user to change the setting or select No if you want to prevent the user from changing the setting's value. This feature is available only in Outlook for Android.

   • For Text Predictions, choose from the available options: Not configured (default), Yes (app default), and No. When selecting Yes or No, administrators can choose to allow the user to change the app setting's value. Select Yes (app default) to allow the user to change the setting or select No if you want to prevent the user from changing the setting's value.

9. If you want to manage the data protection settings, configure the desired settings accordingly:

   • For Org data on wearables, choose from the available options: Not configured (default), Yes (app default), and No.
   • For Calendar Notifications, choose from the available options: Not configured (default) and Allowed. By default, calendar notifications are allowed within the app and display sensitive information. Allowed only takes effect when the App Protection Policy setting Org Data Notifications is set to Block org data.
   • For Allow Add-ins, choose from the available options: Not configured (default), Yes (app default), and No. For more information on the setting choices, see Add-ins.
   • For Allow Calendar Sync, choose from the available options: Not configured (default), Yes (app default), and No. For more information on the setting choices, see Calendar Sync.
   • If you want to manage which contact fields sync with the native contacts apps, configure the desired Sync contact fields to native contacts app configuration settings accordingly. For each contact field setting, choose from the available options: Not configured (default), Yes (app default), No.

10. If you want to manage the app's S/MIME configuration, configure the desired settings accordingly:

    • For Enable S/MIME, choose from the available options: Not configured (default), Yes, and No (app default). When selecting Yes or No, administrators can choose to allow the user to change the app setting's value. Select Yes (app default) to allow the user to change the setting or select No if you want to prevent the user from changing the setting's value.

    Important

    S/MIME certificates must be available within Outlook for iOS and Android for the user sign or encrypt messages. For more information, see S/MIME for Outlook for iOS and Android.

    • Choose whether to Encrypt all emails by selecting Yes or No. When selecting Yes or No, administrators can choose to allow the user to change the app setting's value. Select Yes (app default) to allow the user to change the setting or select No if you want to prevent the user from changing the setting's value.
    • Choose whether to Sign all emails by selecting Yes or No. When selecting Yes or No, administrators can choose to allow the user to change the app setting's value. Select Yes (app default) to allow the user to change the setting or select No if you want to prevent the user from changing the setting's value.
    • If needed, deploy a LDAP URL for recipient certificate lookup. For more information on the URL format, see LDAP support for certificate lookup.

11. When you're finished configuring the settings, select Next.

12. On the Assignments section, choose Select groups to include. Select the Microsoft Entra group to which you want to assign the app configuration policy, and then select Select.

13. When you're finished with the assignments, select Next.

14. On the Create app configuration policy Review + Create blade, review the settings configured and select Create.

The newly created configuration policy is displayed on the App configuration blade.

Configuration keys

The following sections outline the app configuration keys and their supported values. Configuration keys identified with the Managed apps device enrollment type are delivered through the App Protection Policy channel. Configuration keys identified with the Managed devices device enrollment type are delivered through the mobile device management OS channel. If a configuration key is listed with both device enrollment types, the key can be delivered through either channel; for more information, see General app configuration scenarios.

iOS devices and third-party unified endpoint management solutions

If the Managed devices device enrollment type configuration keys are deployed with a third-party UEM provider, then the following additional key must also be delivered for iOS devices:

key = IntuneMAMUPN, value = username@company.com

The exact syntax of the key/value pair may differ based on the third-party UEM provider used. The following table shows examples of some third-party UEM providers and the exact values for the key/value pair:

Account setup configuration

Outlook for iOS and Android offers administrators the ability to "push" account configurations to their Microsoft 365 and Office 365 users. For more information on account setup configuration, see Account setup with modern authentication in Exchange Online.

Organization allowed accounts mode settings

Outlook for iOS and Android offers administrators the ability to restrict email and storage provider accounts to only corporate accounts. For more information on organization allowed accounts mode, see Account setup with modern authentication in Exchange Online.

General app configuration settings

Outlook for iOS and Android offers administrators the ability to customize the default configuration for several in-app settings.

S/MIME settings

Outlook for iOS offers administrators the ability to customize the default S/MIME configuration in Outlook for iOS and Android.

Data protection settings

Outlook for iOS and Android offers administrators additional data protection capabilities when Outlook is managed by Microsoft Intune and has an Intune App Protection Policy.