What Is Exchange ActiveSync (EAS) and Who Still Uses It?

Exchange ActiveSync (EAS) is a Microsoft-developed protocol that lets mobile devices synchronize email, calendar events, contacts, and tasks with a Microsoft Exchange server or Exchange Online mailbox — and receive new mail the moment it arrives, via a server-initiated push. That push model is what originally distinguished EAS from IMAP: instead of your phone polling the server every few minutes to ask whether anything new had arrived, the server notified the device directly. For an enterprise that needed near-real-time email delivery on every employee's phone without draining battery on constant polling, that was a meaningful difference.

Microsoft introduced EAS with Exchange Server 2003 and licensed the protocol to third-party device and application makers. For over a decade it was the dominant mobile email protocol in corporate environments, and its device management layer — remote wipe, PIN enforcement, encryption requirements — gave IT departments control over enrolled devices they had no equivalent for over IMAP. That combination of push delivery plus device policy in one protocol explains its widespread adoption.

As of 2026, EAS remains supported on Exchange Online, but it is a legacy protocol in Microsoft's roadmap. Basic Authentication for EAS was blocked on Exchange Online in October 2022, requiring Modern Authentication (OAuth 2.0) for all remaining EAS connections to Microsoft 365. More consequentially, Microsoft's developer documentation consistently directs new integrations toward Microsoft Graph — a modern REST API that covers the same mail, calendar, and contacts data with far broader access to Microsoft 365 services. EAS still runs on millions of devices and will not disappear immediately, but understanding what it does and what it has ceded to Graph determines whether it belongs in any new deployment.

How does Exchange ActiveSync work?#

EAS carries its data as binary XML packets sent over HTTPS. The encoding format is called WBXML (WAP Binary XML), a compact representation designed for the low-bandwidth mobile connections of the early 2000s. Every message, calendar item, contact record, or task is serialized into a WBXML payload and exchanged between the device and server using a single HTTPS endpoint. The device connects, authenticates, and issues an HTTPS POST with a command verb — Sync, FolderSync, Search, GetItemEstimate, and others — and the server responds with the relevant data.

Push delivery works through long-polling. The device sends a Sync request with a specified wait interval — often 30 minutes. If nothing changes on the server during that window, the server holds the connection open until new mail arrives or the wait time expires, then responds. The device immediately issues another request. This pattern produces near-instantaneous delivery at the cost of a persistent connection, which consumed more battery than later push notification platforms. Modern push systems — Apple Push Notification service and Google Firebase Cloud Messaging — have since improved on this, and Microsoft Graph now uses webhook subscriptions rather than long-polling.

Authentication switched from Basic Auth (a username and password sent with every request) to Modern Authentication via OAuth 2.0. Basic Auth for EAS was blocked on Exchange Online in October 2022; any EAS connection to Microsoft 365 now requires an OAuth access token issued by Azure AD. Once authenticated, the device performs a FolderSync to retrieve the folder hierarchy, then issues Sync commands for each folder it monitors, receiving only delta changes since the last sync — a design that keeps ongoing bandwidth low.

Device management commands travel on the same connection. An IT administrator issuing a remote wipe sends a Wipe command from the Exchange admin center; the server queues it for the device. The next time the device checks in — typically within seconds for an active EAS client — the command executes, restoring the device to factory settings. Password and encryption policies work similarly: the server sends an ActiveSync policy document requiring a minimum PIN length or device encryption, and the device must acknowledge and enforce the policy before the server completes the initial sync.

What does EAS deliver that IMAP cannot?#

EAS was designed to solve three problems IMAP handled poorly or not at all: push delivery, unified data sync beyond email, and server-enforced device policy.

Push delivery is the most visible difference. IMAP is a pull protocol — the client requests new messages from the server at a configured interval. EAS reversed the direction: the server pushes new mail to the device the moment it arrives, with latency measured in seconds. Before modern push notification platforms existed, EAS was the only practical way to receive near-real-time corporate email on a mobile device.

Unified data sync is the second advantage. IMAP handles email only. Synchronizing calendar events and contacts from an Exchange server over IMAP requires adding separate CalDAV and CardDAV connections — three protocol sessions, three authentication flows, three potential points of failure. EAS delivers all of it over a single authenticated HTTPS connection, which simplified enterprise mobile deployments considerably.

Device management is the sharpest differentiator. EAS introduced a policy mechanism that IMAP has no equivalent for: the Exchange server can require a minimum PIN length, mandate full-device encryption, block devices that do not comply, and issue a remote wipe command if the device is lost or stolen. This was the reason enterprise IT standardized on EAS rather than IMAP for corporate mobile email — and it remains the reason some regulated environments retain EAS requirements today, even as Graph has taken over mail and calendar sync.

Without EAS, organizations that need device management must substitute a Mobile Device Management solution — such as Microsoft Intune, Jamf, or VMware Workspace ONE — that enforces policies at the MDM layer rather than the email-protocol layer. Many IT teams have moved to exactly this setup: MDM handles device policy, Graph handles mail and calendar, and EAS is either disabled or restricted to legacy hardware.

Exchange ActiveSync vs IMAP vs Microsoft Graph#

The three protocols are all paths to email on a remote server, but they differ sharply in scope, design, and Microsoft's current recommendation for new work.

Common misconceptions about Exchange ActiveSync#

EAS has been around long enough that several inaccurate beliefs about it circulate in IT discussions and email client documentation. Four come up often enough to be worth addressing directly.

Misconception: EAS is the same as IMAP. It is not. IMAP is an IETF open standard, royalty-free and supported by virtually every email server since the 1990s. EAS is a Microsoft-proprietary, licensed protocol that third-party developers must sign a patent licence to implement. IMAP handles email only; EAS handles email plus calendar, contacts, tasks, and device policy. A client that supports one does not automatically support the other.

Misconception: EAS is a public open standard. Microsoft has published the EAS protocol specification as part of its Open Specifications programme, which is a transparency measure — but publication is not the same as open licensing. Third parties implementing EAS must enter a Microsoft patent licence agreement. This is different from IMAP, which carries no licensing requirement whatsoever.

Misconception: All smartphones still use EAS for corporate email. Fewer do in 2026. Apple's iOS has supported Microsoft Graph API for Microsoft 365 accounts using Modern Authentication since iOS 16, and Apple Mail on recent macOS versions does the same. Outlook for iOS and Android has long used Graph rather than EAS. The devices that still rely on EAS are typically older operating-system versions or connections to on-premises Exchange servers that have not yet exposed a Graph endpoint.

Misconception: EAS is disappearing immediately. Microsoft has not published an end-of-life date for EAS on Exchange Online as of mid-2026. The transition is directional rather than abrupt — developer documentation consistently points toward Graph, and the October 2022 Basic Auth deprecation was the largest single forcing function — but existing EAS connections using Modern Auth remain functional. Building new applications against EAS is inadvisable; that is different from existing deployments needing to migrate immediately.

How this shows up in AI Emaily#

AI Emaily connects to Outlook and Microsoft 365 mailboxes through Microsoft Graph API rather than Exchange ActiveSync, and connects to all other providers — Gmail, iCloud, Fastmail, Proton, and standard accounts — through IMAP. Neither path uses EAS, which means AI Emaily does not issue or respond to EAS device management policies such as remote wipe or PIN enforcement. Those controls remain the domain of your organization's Mobile Device Management tool. If your IT team requires EAS enrollment before permitting access to a corporate mailbox, that enrollment runs through the MDM — not through AI Emaily itself.

We build AI Emaily. You can see how the Outlook connection works at aiemaily.com/docs/connect-outlook, and compare what each plan includes at aiemaily.com/pricing.