Configuring Microsoft Exchange cutoff

For IP and Device Cutoff Methods please view the Microsoft Exchange cutoff prohibits users from connecting to your Exchange server directly via ActiveSync, ensuring that all mobile devices connect through Forcepoint ONE SSE. It works in stages:

  • In the first stage, upon adding the account, the Forcepoint ONE SSE Autodiscover service ensures that the server is Forcepoint ONE SSE.
  • This is accomplished by sending a unique pre-shared identifier to your Exchange server. This identifier is used to create a Device Access Rule on the Exchange server that will prohibit ActiveSync connections from any device that is not passing through Forcepoint ONE SSE.
    • Instructions for implementing a device access rule can be found on the guide page.


  • By clicking Migration Status we can view the status (amount) of user devices that have been provisioned for the Device Family Cutoff feature:
    • This will indicate how many users have their devices configured through the ActiveSync proxy compared to the total number of users on the people tab.