grommunio MDM 2026 step by step: manage ActiveSync devices safely

This guide shows how Mobile Device Management works in grommunio 2026.06.1 in practice: through Exchange ActiveSync, grommunio Sync and the Mobile Devices view in grommunio Web. At the end, a test user is enabled for EAS, the sync endpoint is verified, a device is registered, mail, calendar and contact folders synchronize, and resync and remove are tested in a reproducible way.

Important: grommunio MDM is not a full UEM/MDM product like Intune or Jamf. It manages the ActiveSync relationship of the mailbox: view the device, inspect status, trigger full resync, remove server state and prepare remote wipe. Device policies always depend on the EAS client and its implementation.

grommunio 2026 step by step

• Part 1: Install grommunio 2026 - /en/tech/install-grommunio-2026
• Part 2: Antispam / Rspamd - /en/tech/grommunio-antispam-rspamd-2026-step-by-step
• Part 3: Auth / Keycloak / MFA - /en/tech/grommunio-auth-keycloak-2026-step-by-step
• Part 4: Meet - /en/tech/grommunio-meet-2026-step-by-step
• Part 5: Chat - /en/tech/grommunio-chat-2026-step-by-step
• Part 6: Files + Office - /en/tech/grommunio-files-office-2026-step-by-step
• Part 7: Archive - /en/tech/grommunio-archive-2026-step-by-step
• Part 8: Mobile Device Management - /en/tech/grommunio-mdm-2026-step-by-step - you are here.

What we build

The actual architecture is intentionally straightforward: a smartphone or mail client connects via HTTPS to the ActiveSync endpoint, grommunio Sync talks to the mailbox and stores device state, and grommunio Web shows the device under Settings with the actions Wipe Device, Full resync, Remove device and Refresh.

Smartphone / mail client
  -> HTTPS / Exchange ActiveSync
  -> /Microsoft-Server-ActiveSync
  -> grommunio Sync
  -> mailbox and device state
  -> grommunio Web
  -> Settings / Mobile Devices

Tested basis

• grommunio-release: 2026.06.1
• grommunio-sync: 2.5.2.0d70954
• grommunio-web: 3.19.371.ge256c4858
• grommunio-admin-api: 1.21.1
• gromox: 3.10.73
• OS basis: SLES-based grommunio Appliance 2026.06.1
• FQDN in the test: mail.example.test
• Test user: alice@example.test

Check prerequisites

Before the first device test, DNS, TLS, Web, Sync, mailbox and user privileges must be correct. An HTTP status 401 on the EAS endpoint is not an error here; it is the expected signal that the endpoint is reachable and requires authentication.

hostname -f
rpm -qa | grep -Ei 'grommunio-release|grommunio-sync|grommunio-web|grommunio-admin-api|gromox' | sort
systemctl is-active nginx php-fpm gromox-http gromox-zcore gromox-midb
curl -k -I https://mail.example.test/Microsoft-Server-ActiveSync
curl -k -I https://mail.example.test/Autodiscover/Autodiscover.xml

app.example.com

Enable EAS for the user

grommunio controls ActiveSync per user through the EAS privilege. For this test, alice@example.test was enabled. In normal environments this is the clean path: set the privilege, inspect the user, then use the EAS endpoint with a real device or an isolated test client.

grommunio-admin user modify alice@example.test --privEas 1
grommunio-admin user query username=alice@example.test

app.example.com

Connect a device

On Android, add an Exchange or work account, enter the full email address and use mail.example.test with HTTPS/TLS for manual setup. On iOS, choose Microsoft Exchange, enter email address and description, and for manual setup verify server, username and TLS. Use a disposable device or isolated test environment for testing.

• Email: alice@example.test
• Username: full email address
• Server: mail.example.test
• Encryption: SSL/TLS enabled
• Synchronization: enable mail, calendar and contacts where supported by the client.

Prove synchronization

For reproducible lab proof, an isolated ActiveSync test client was used. It performs Provision, FolderSync and Sync against the same HTTPS endpoint. The important part is not the specific test client, but the result: provisioning succeeds, default folders are detected, and mail, calendar, contacts, tasks and further folders are visible through EAS.

app.example.com

Inspect the device in grommunio Web

After a successful sync, the device appears in grommunio Web under Settings -> Mobile Devices. The view shows device type, user agent, provisioning status, last contact and device ID. This is the central entry point for users and administrators when a device needs to be resynchronized, removed or wiped after loss.

app.example.com

Manage devices through the CLI

For operations and support, the CLI matters because it lets you inspect the same device relationships without a browser. In the test, list, full resync, remove and subsequent re-registration were validated.

grommunio-admin user devices alice@example.test list
grommunio-admin user devices alice@example.test show fone20260908mdm01
grommunio-admin user devices alice@example.test resync fone20260908mdm01
grommunio-admin user devices alice@example.test remove fone20260908mdm01

app.example.com

Understand policies and remote wipe safely

EAS policies are client-dependent. A client can only enforce what it supports and accepts. The lab test client is suitable for Provision, FolderSync, Sync, Resync and Remove, but not for a reliable policy enforcement test. Therefore, policy enforcement is documented here as not supported by the test client.

Remote wipe was intentionally not executed because no disposable physical Android or iOS test device with an explicit safety marker was available. The command and web behavior are documented, but wipe belongs only on a device approved with TEST DEVICE CONFIRMED / NO PRODUCTION DATA / DESTRUCTIVE ACTION ACCEPTED.

grommunio-admin user devices alice@example.test wipe --mode account DEVICE_ID
grommunio-admin user devices alice@example.test wipe --mode normal DEVICE_ID
grommunio-admin user devices alice@example.test wipe --mode cancel DEVICE_ID

Logs, monitoring and operations

In operations, avoid collecting unnecessary personal device inventories and monitor technical state instead: EAS endpoint reachability, TLS expiry, repeated 401/403 errors, sync errors, stale last-connect times and service status.

journalctl -u nginx -u php-fpm -u gromox-http -u gromox-zcore --since today
tail -n 200 /var/log/grommunio-sync/grommunio-sync.log
tail -n 200 /var/log/grommunio-sync/grommunio-sync-error.log
grommunio-admin user devices alice@example.test list

Troubleshooting

• Account cannot be added: check EAS endpoint, TLS certificate, FQDN and username.
• EAS returns 401: without authentication this is normal. With correct credentials the client must proceed.
• Device does not appear: check EAS privilege, mailbox state, grommunio-sync log and device ID.
• Sync is stuck: inspect last-connect time, sync errors, network and client provisioning.
• Resync has no visible effect: wait for the next client sync or trigger account synchronization on the test device.
• Device returns after remove: this is expected if the account was not removed from the device.
• Wipe remains pending: the device must connect again; powered-off or offline devices cannot acknowledge wipe.

Production checklist

• HTTPS and FQDN are correct externally and internally.
• ActiveSync endpoint and Autodiscover are reachable.
• EAS privilege is enabled only for authorized users.
• Mail, calendar and contacts were tested with at least one real device.
• The device appears in grommunio Web under Mobile Devices.
• List, full resync and remove were tested.
• Policy behavior was verified with the actual client in use.
• The remote-wipe process is organizationally approved and documented.
• Logs and monitoring are in place.
• The support process for lost or replaced devices is clear.

Sources

• grommunio Web MDM documentation: https://docs.grommunio.com/web/mdm/
• grommunio Groupware user guide for ActiveSync: https://docs.grommunio.com/user/groupware/
• grommunio CLI Cookbook: https://docs.grommunio.com/cli/cookbook/
• grommunio Release Notes 2026.06.1: https://docs.grommunio.com/admin/release_notes/