grommunio MDM 2026 step by step: manage ActiveSync devices safely

Overview

The validated baseline is the openSUSE-based grommunio appliance 2026.06.1. The examples consistently use the neutral appliance domain https://mail.example.test; paths such as /web/, /admin/, /auth/, /chat/, /meet/ and /files/ live on the same appliance.This article shows how to validate grommunio MDM with ActiveSync devices and document device management in a practical way.

You enable EAS, connect a device, verify synchronization, device status, policies, remote wipe handling, logs and technical acceptance.

Tested environment

• grommunio 2026 on the openSUSE-based grommunio appliance.

• All appliance commands are run directly on the grommunio appliance.

• Public examples consistently use the neutral appliance domain https://mail.example.test.

1. Starting point & prerequisites

The starting point is a grommunio installation with working DNS, TLS, admin access and a clean baseline validation. Each article covers exactly the building block required for a complete collaboration platform.

2. Step-by-step guide

This article shows the relevant grommunio component on the openSUSE-based appliance so you can understand, validate and operate the configuration.

Prerequisites

An existing or planned grommunio environment, matching DNS names, TLS, administrative access and a clear target for mail, collaboration or operations.

This guide shows how Mobile Device Management works in grommunio 2026.06.1 in practice: through Exchange ActiveSync, grommunio Sync and the Mobile Devices view in grommunio Web. At the end, a test user is enabled for EAS, the sync endpoint is verified, a device is registered, mail, calendar and contact folders synchronize, and resync and remove are tested in a reproducible way.

Important: grommunio MDM is not a full UEM/MDM product like Intune or Jamf. It manages the ActiveSync relationship of the mailbox: view the device, inspect status, trigger full resync, remove server state and prepare remote wipe. Device policies always depend on the EAS client and its implementation.

What we build

The actual architecture is intentionally straightforward: a smartphone or mail client connects via HTTPS to the ActiveSync endpoint, grommunio Sync talks to the mailbox and stores device state, and grommunio Web shows the device under Settings with the actions Wipe Device, Full resync, Remove device and Refresh.

• Smartphone / mail client
• HTTPS / Exchange ActiveSync
• /Microsoft-Server-ActiveSync
• grommunio Sync
• mailbox and device state
• grommunio Web
• Settings / Mobile Devices

Tested basis

• grommunio-release: 2026.06.1
• grommunio-sync: 2.5.2.0d70954
• grommunio-web: 3.19.371.ge256c4858
• grommunio-admin-api: 1.21.1
• gromox: 3.10.73
• OS basis: SLES-based grommunio Appliance 2026.06.1
• FQDN in the test: mail.example.test
• Test user: alice@example.test

Check prerequisites

Before the first device test, DNS, TLS, Web, Sync, mailbox and user privileges must be correct. An HTTP status 401 on the EAS endpoint is not an error here; it is the expected signal that the endpoint is reachable and requires authentication.

hostname -f
rpm -qa | grep -Ei 'grommunio-release|grommunio-sync|grommunio-web|grommunio-admin-api|gromox' | sort
systemctl is-active nginx php-fpm gromox-http gromox-zcore gromox-midb
curl -k -I https://mail.example.test/Microsoft-Server-ActiveSync
curl -k -I https://mail.example.test/Autodiscover/Autodiscover.xml

Enable EAS for the user

grommunio controls ActiveSync per user through the EAS privilege. For this test, alice@example.test was enabled. In normal environments this is the clean path: set the privilege, inspect the user, then use the EAS endpoint with a real device or an isolated test client.

grommunio-admin user modify alice@example.test --privEas 1
grommunio-admin user query username=alice@example.test

Connect a device

On Android, add an Exchange or work account, enter the full email address and use mail.example.test with HTTPS/TLS for manual setup. On iOS, choose Microsoft Exchange, enter email address and description, and for manual setup verify server, username and TLS. Use a disposable device or isolated test environment for testing.

• Email: alice@example.test
• Username: full email address
• Server: mail.example.test
• Encryption: SSL/TLS enabled
• Synchronization: enable mail, calendar and contacts where supported by the client.

Prove synchronization

For reproducible lab proof, an isolated ActiveSync test client was used. It performs Provision, FolderSync and Sync against the same HTTPS endpoint. The important part is not the specific test client, but the result: provisioning succeeds, default folders are detected, and mail, calendar, contacts, tasks and further folders are visible through EAS.

Inspect the device in grommunio Web

After a successful sync, the device appears in grommunio Web under Settings -> Mobile Devices. The view shows device type, user agent, provisioning status, last contact and device ID. This is the central entry point for users and administrators when a device needs to be resynchronized, removed or wiped after loss.

Manage devices through the CLI

For operations and support, the CLI matters because it lets you inspect the same device relationships without a browser. In the test, list, full resync, remove and subsequent re-registration were validated.

grommunio-admin user devices alice@example.test list
grommunio-admin user devices alice@example.test show fone20260908mdm01
grommunio-admin user devices alice@example.test resync fone20260908mdm01
grommunio-admin user devices alice@example.test remove fone20260908mdm01

Result Validation / Technical Acceptance

4. Typical issues & troubleshooting

• Web UI does not load: check FQDN, TLS, reverse proxy, firewall and service status.

• Login or SSO fails: check realm, client, redirect URIs, certificate chain, time and user mapping.

• Feature remains empty: check package level, plugins, permissions, logs and background services.

5. Conclusion & outlook

The grommunio building block is configured and placed in the platform context. The next parts continue the collaboration environment step by step.

Understand policies and remote wipe safely

EAS policies are client-dependent. A client can only enforce what it supports and accepts. The lab test client is suitable for Provision, FolderSync, Sync, Resync and Remove, but not for a reliable policy enforcement test. Therefore, policy enforcement is documented here as not supported by the test client.

Remote wipe was intentionally not executed because no disposable physical Android or iOS test device with an explicit safety marker was available. The command and web behavior are documented, but wipe belongs only on a device approved with TEST DEVICE CONFIRMED / NO PRODUCTION DATA / DESTRUCTIVE ACTION ACCEPTED.

grommunio-admin user devices alice@example.test wipe --mode account DEVICE_ID
grommunio-admin user devices alice@example.test wipe --mode normal DEVICE_ID
grommunio-admin user devices alice@example.test wipe --mode cancel DEVICE_ID

Logs, monitoring and operations

In operations, avoid collecting unnecessary personal device inventories and monitor technical state instead: EAS endpoint reachability, TLS expiry, repeated 401/403 errors, sync errors, stale last-connect times and service status.

journalctl -u nginx -u php-fpm -u gromox-http -u gromox-zcore --since today
tail -n 200 /var/log/grommunio-sync/grommunio-sync.log
tail -n 200 /var/log/grommunio-sync/grommunio-sync-error.log
grommunio-admin user devices alice@example.test list

Troubleshooting

• Account cannot be added: check EAS endpoint, TLS certificate, FQDN and username.
• EAS returns 401: without authentication this is normal. With correct credentials the client must proceed.
• Device does not appear: check EAS privilege, mailbox state, grommunio-sync log and device ID.
• Sync is stuck: inspect last-connect time, sync errors, network and client provisioning.
• Resync has no visible effect: wait for the next client sync or trigger account synchronization on the test device.
• Device returns after remove: this is expected if the account was not removed from the device.
• Wipe remains pending: the device must connect again; powered-off or offline devices cannot acknowledge wipe.