Create a service account

The Sophos Mobile EAS proxy in PowerShell mode uses a dedicated service account to connect to your Exchange mail server. The EAS proxy uses the service account for the following tasks:

• Reading ActiveSync device information
• Allowing or blocking device access
• Managing ActiveSync device access rules

The service account only requires Exchange role-based access control (RBAC) roles. It doesn't require a Microsoft 365 license, a mailbox, or an Azure or Microsoft Entra role.

For details on creating and configuring the service account, see the section for your mail server below.

Exchange Online

For Exchange Online, do the following steps to create a service account for the EAS proxy:

1. Create a user account in the Microsoft 365 admin center, admin.microsoft.com.

   Note

   You create Exchange Online user identities in the Microsoft 365 admin center, not in the Exchange admin center. You still use the Exchange admin center afterward to assign roles to the account.

2. Configure the new user account as follows:

   • Use a username like smc_powershell that identifies the account's purpose.
   • Turn off the setting to make the user change their password the next time they log in.
   • If a Microsoft 365 license was automatically assigned to the account, remove it. The service account doesn't need a license or a mailbox.

3. Assign the service account its roles.

   Click the tab below for instructions for your preferred method.

   Exchange admin centerPowerShell

   To assign roles through a role group in the Exchange admin center, do as follows:

   1. Open the Exchange admin center, admin.exchange.microsoft.com.
   2. Go to Roles > Admin roles.

   3. Create a new role group with the following settings:

      • Use a role group name like smc_powershell_role.
      • Add the Mail Recipients and Organization Client Access roles.
      • Add the service account as a member.

   Use this option for automated or scripted deployments, or if you prefer a command-line interface.

   To assign roles through PowerShell commands, do as follows:

   1. Connect to Exchange Online PowerShell:

      Connect-ExchangeOnline
      

   2. Assign the required roles directly to the service account:

      New-ManagementRoleAssignment -Role "Mail Recipients" -User "smc_powershell@<tenant>.onmicrosoft.com"
      New-ManagementRoleAssignment -Role "Organization Client Access" -User "smc_powershell@<tenant>.onmicrosoft.com"
      

   3. Verify the role assignments:

      Get-ManagementRoleAssignment -RoleAssignee smc_powershell@<tenant>.onmicrosoft.com | Select-Object Role, RoleAssigneeName
      

   Direct role assignments are a valid RBAC mechanism in Exchange Online. They behave the same as role-group-based assignments at runtime.

4. To verify that the service account can access Exchange Online, do as follows:

   1. Start an Exchange PowerShell session.

      Connect-ExchangeOnline
      

   2. Run the following cmdlets:

      Get-MobileDevice
      Get-ActiveSyncDeviceAccessRule
      

      If a cmdlet fails, check that the service account has both roles assigned.

Exchange Server

For an on-premises Exchange Server, do the following steps to create a service account for the EAS proxy:

1. Open your Exchange admin center, https://<ServerFQDN>/ecp, in a web browser.

   <ServerFQDN> is your Exchange Server's fully-qualified domain name.

2. Create a user account with the following settings:

   • Use a username like smc_powershell that identifies the account's purpose.
   • Turn off the setting to make the user change their password the next time they log in.

3. Create a new role group with the following settings:

   • Use a role group name like smc_powershell_role.
   • Add the Mail Recipients and Organization Client Access roles.
   • Add the user account as a member.

Troubleshooting

To troubleshoot the service account configuration, you can temporarily assign the Exchange Administrator role to the service account.