# grommunio MDM 2026 step by step: manage ActiveSync devices safely

Source: https://forgeone.solutions/en/tech/grommunio-mdm-2026-step-by-step
Language: en
Published: 2026-09-08
Updated: 2026-10-23

Practical guide for grommunio Mobile Device Management with Exchange ActiveSync, grommunio Sync, device overview, resync, remove and remote-wipe safety.

## Overview

The validated baseline is the openSUSE-based grommunio appliance 2026.06.1. The examples consistently use the neutral appliance domain https://mail.example.test; paths such as /web/, /admin/, /auth/, /chat/, /meet/ and /files/ live on the same appliance. This article shows how to validate grommunio MDM with ActiveSync devices and document device management in a practical way.

You enable EAS, connect a device, verify synchronization, device status, policies, remote wipe handling, logs and technical acceptance.

## Tested environment

- grommunio 2026 on the openSUSE-based grommunio appliance.
- All appliance commands are run directly on the grommunio appliance.
- Public examples consistently use the neutral appliance domain https://mail.example.test.

## 1. Starting point & prerequisites

The starting point is a grommunio installation with working DNS, TLS, admin access and a clean baseline validation. Each article covers exactly the building block required for a complete collaboration platform.

## 2. Step-by-step guide

This article shows the relevant grommunio component on the openSUSE-based appliance so you can understand, validate and operate the configuration.

### Prerequisites

An existing or planned grommunio environment, matching DNS names, TLS, administrative access and a clear target for mail, collaboration or operations.

This guide shows how Mobile Device Management works in grommunio 2026.06.1 in practice: through Exchange ActiveSync, grommunio Sync and the Mobile Devices view in grommunio Web. At the end, a test user is enabled for EAS, the sync endpoint is verified, a device is registered, mail, calendar and contact folders synchronize, and resync and remove are tested in a reproducible way.

Important: grommunio MDM is not a full UEM/MDM product like Intune or Jamf. It manages the ActiveSync relationship of the mailbox: view the device, inspect status, trigger full resync, remove server state and prepare remote wipe. Device policies always depend on the EAS client and its implementation.

### What we build

The actual architecture is intentionally straightforward: a smartphone or mail client connects via HTTPS to the ActiveSync endpoint, grommunio Sync talks to the mailbox and stores device state, and grommunio Web shows the device under Settings with the actions Wipe Device, Full resync, Remove device and Refresh.

- Smartphone / mail client
- HTTPS / Exchange ActiveSync
- /Microsoft-Server-ActiveSync
- grommunio Sync
- mailbox and device state
- grommunio Web
- Settings / Mobile Devices

### Tested basis

- grommunio-release: 2026.06.1
- grommunio-sync: 2.5.2.0d70954
- grommunio-web: 3.19.371.ge256c4858
- grommunio-admin-api: 1.21.1
- gromox: 3.10.73
- OS basis: SLES-based grommunio Appliance 2026.06.1
- FQDN in the test: mail.example.test
- Test user: alice@example.test

### Check prerequisites

Before the first device test, DNS, TLS, Web, Sync, mailbox and user privileges must be correct. An HTTP status 401 on the EAS endpoint is not an error here; it is the expected signal that the endpoint is reachable and requires authentication.

```bash
hostname -f
rpm -qa | grep -Ei 'grommunio-release|grommunio-sync|grommunio-web|grommunio-admin-api|gromox' | sort
systemctl is-active nginx php-fpm gromox-http gromox-zcore gromox-midb
curl -k -I https://mail.example.test/Microsoft-Server-ActiveSync
curl -k -I https://mail.example.test/Autodiscover/Autodiscover.xml
```

[![Terminal proof of the ActiveSync and Autodiscover endpoints.](https://forgeone.solutions/media/grommunio-mdm-2026-06-terminal-endpoints.png)](https://forgeone.solutions/media/grommunio-mdm-2026-06-terminal-endpoints.png)

### Enable EAS for the user

grommunio controls ActiveSync per user through the EAS privilege. For this test, alice@example.test was enabled. In normal environments this is the clean path: set the privilege, inspect the user, then use the EAS endpoint with a real device or an isolated test client.

```bash
grommunio-admin user modify alice@example.test --privEas 1
grommunio-admin user query username=alice@example.test
```

[![Terminal proof of EAS enablement for the test user.](https://forgeone.solutions/media/grommunio-mdm-2026-07-terminal-eas-enable.png)](https://forgeone.solutions/media/grommunio-mdm-2026-07-terminal-eas-enable.png)

### Connect a device

On Android, add an Exchange or work account, enter the full email address and use mail.example.test with HTTPS/TLS for manual setup. On iOS, choose Microsoft Exchange, enter email address and description, and for manual setup verify server, username and TLS. Use a disposable device or isolated test environment for testing.

- Email: alice@example.test
- Username: full email address
- Server: mail.example.test
- Encryption: SSL/TLS enabled
- Synchronization: enable mail, calendar and contacts where supported by the client.

### Prove synchronization

For reproducible lab proof, an isolated ActiveSync test client was used. It performs Provision, FolderSync and Sync against the same HTTPS endpoint. The important part is not the specific test client, but the result: provisioning succeeds, default folders are detected, and mail, calendar, contacts, tasks and further folders are visible through EAS.

[![Terminal proof for Provision, FolderSync and Sync.](https://forgeone.solutions/media/grommunio-mdm-2026-08-terminal-sync-proof.png)](https://forgeone.solutions/media/grommunio-mdm-2026-08-terminal-sync-proof.png)

### Inspect the device in grommunio Web

After a successful sync, the device appears in grommunio Web under Settings -> Mobile Devices. The view shows device type, user agent, provisioning status, last contact and device ID. This is the central entry point for users and administrators when a device needs to be resynchronized, removed or wiped after loss.

[![grommunio mdm user web.](https://forgeone.solutions/media/grommunio-mdm-user-web.webp)](https://forgeone.solutions/media/grommunio-mdm-user-web.webp)

[![grommunio Web shows the registered ActiveSync device under Mobile Devices.](https://forgeone.solutions/media/grommunio-mdm-2026-04-mobile-devices-settings.png)](https://forgeone.solutions/media/grommunio-mdm-2026-04-mobile-devices-settings.png)

### Manage devices through the CLI

For operations and support, the CLI matters because it lets you inspect the same device relationships without a browser. In the test, list, full resync, remove and subsequent re-registration were validated.

[![grommunio MDM Admin Web](https://forgeone.solutions/media/grommunio-mdm-admin-web.webp)](https://forgeone.solutions/media/grommunio-mdm-admin-web.webp)

```bash
grommunio-admin user devices alice@example.test list
grommunio-admin user devices alice@example.test show fone20260908mdm01
grommunio-admin user devices alice@example.test resync fone20260908mdm01
grommunio-admin user devices alice@example.test remove fone20260908mdm01
```

[![Terminal proof for device list, resync, remove and re-register.](https://forgeone.solutions/media/grommunio-mdm-2026-09-terminal-device-actions.png)](https://forgeone.solutions/media/grommunio-mdm-2026-09-terminal-device-actions.png)

## Result Validation / Technical Acceptance

| Test area | Check | Expected result | Status |
| --- | --- | --- | --- |
| Installation | Check packages and components | The component is fully installed | PASS |
| Services | Check systemd services | The required services are active | PASS |
| Network | Check ports and URLs | The component is reachable through the intended paths | PASS |
| Core function | Run standalone test | The core function works before deeper integration | PASS |
| Authentication | Test SSO/login | Login works through the intended path or is intentionally not required | PASS or N/A |
| grommunio Web | Check integration from Web | The component is reachable or usable from grommunio Web | PASS or N/A |
| End-to-end | Test real user workflow | The full workflow is reproducibly successful | PASS |
| Restart | Restart services | The function remains available after service restart | PASS |
| Logs | Check relevant logs | No blocking errors in the validated flow | PASS |

## 4. Typical issues & troubleshooting

- Web UI does not load: check FQDN, TLS, reverse proxy, firewall and service status.
- Login or SSO fails: check realm, client, redirect URIs, certificate chain, time and user mapping.
- Feature remains empty: check package level, plugins, permissions, logs and background services.

## 5. Conclusion & outlook

The grommunio building block is configured and placed in the platform context. The next parts continue the collaboration environment step by step.

### Understand policies and remote wipe safely

EAS policies are client-dependent. A client can only enforce what it supports and accepts. The lab test client is suitable for Provision, FolderSync, Sync, Resync and Remove, but not for a reliable policy enforcement test. Therefore, policy enforcement is documented here as not supported by the test client.

Remote wipe was intentionally not executed because no disposable physical Android or iOS test device with an explicit safety marker was available. The command and web behavior are documented, but wipe belongs only on a device approved with TEST DEVICE CONFIRMED / NO PRODUCTION DATA / DESTRUCTIVE ACTION ACCEPTED.

```bash
grommunio-admin user devices alice@example.test wipe --mode account DEVICE_ID
grommunio-admin user devices alice@example.test wipe --mode normal DEVICE_ID
grommunio-admin user devices alice@example.test wipe --mode cancel DEVICE_ID
```

### Logs, monitoring and operations

In operations, avoid collecting unnecessary personal device inventories and monitor technical state instead: EAS endpoint reachability, TLS expiry, repeated 401/403 errors, sync errors, stale last-connect times and service status.

```bash
journalctl -u nginx -u php-fpm -u gromox-http -u gromox-zcore --since today
tail -n 200 /var/log/grommunio-sync/grommunio-sync.log
tail -n 200 /var/log/grommunio-sync/grommunio-sync-error.log
grommunio-admin user devices alice@example.test list
```

### Troubleshooting

- Account cannot be added: check EAS endpoint, TLS certificate, FQDN and username.
- EAS returns 401: without authentication this is normal. With correct credentials the client must proceed.
- Device does not appear: check EAS privilege, mailbox state, grommunio-sync log and device ID.
- Sync is stuck: inspect last-connect time, sync errors, network and client provisioning.
- Resync has no visible effect: wait for the next client sync or trigger account synchronization on the test device.
- Device returns after remove: this is expected if the account was not removed from the device.
- Wipe remains pending: the device must connect again; powered-off or offline devices cannot acknowledge wipe.

## Sources

Vendor and upstream documentation used:

- [grommunio documentation](https://docs.grommunio.com/)
- [grommunio downloads and release information](https://download.grommunio.com/)
- [grommunio mobile device management documentation](https://docs.grommunio.com/)

## Introduce grommunio MDM safely?

ForgeOne supports ActiveSync, policies, device management, operations, support and clean documentation.

- [Discuss your MDM project](https://forgeone.solutions/en/contact)

## Hero image

[![grommunio Web shows the registered ActiveSync device under Mobile Devices.](https://forgeone.solutions/media/grommunio-mdm-2026-04-mobile-devices-settings.png)](https://forgeone.solutions/media/grommunio-mdm-2026-04-mobile-devices-settings.png)

## Author

Mathias Rumbold

## Category

- [grommunio & Groupware](https://forgeone.solutions/en/tech/grommunio-mdm-2026-step-by-step?category=grommunio-groupware)

## Tags

- [grommunio](https://forgeone.solutions/en/tech/grommunio-mdm-2026-step-by-step?tags=grommunio)
- [Groupware](https://forgeone.solutions/en/tech/grommunio-mdm-2026-step-by-step?tags=groupware)
- [Mobile Device Management](https://forgeone.solutions/en/tech/grommunio-mdm-2026-step-by-step?tags=mobile-device-management)
- [Exchange ActiveSync](https://forgeone.solutions/en/tech/grommunio-mdm-2026-step-by-step?tags=exchange-activesync)
- [Digital Sovereignty](https://forgeone.solutions/en/tech/grommunio-mdm-2026-step-by-step?tags=digitale-souveraenitaet)
- [Native Exchange Replacement](https://forgeone.solutions/en/tech/grommunio-mdm-2026-step-by-step?tags=native-exchange-replacement)
- [Keycloak](https://forgeone.solutions/en/tech/grommunio-mdm-2026-step-by-step?tags=keycloak)
- [SSO](https://forgeone.solutions/en/tech/grommunio-mdm-2026-step-by-step?tags=sso)
- [MFA](https://forgeone.solutions/en/tech/grommunio-mdm-2026-step-by-step?tags=mfa)
- [Enterprise Linux](https://forgeone.solutions/en/tech/grommunio-mdm-2026-step-by-step?tags=enterprise-linux)
- [Upgrade](https://forgeone.solutions/en/tech/grommunio-mdm-2026-step-by-step?tags=upgrade)

## Manage mobile devices securely

We support ActiveSync, policies, device management and secure operations with grommunio MDM.

[Discuss MDM setup](https://forgeone.solutions/de/produkte/grommunio/grommunio-mdm)

## grommunio 2026 Schritt für Schritt

Die Beiträge bauen chronologisch aufeinander auf: Installation, Security, SSO, Module, Betrieb, Migration, Upgrade und Client-Abnahme. Veröffentlichte Teile werden automatisch verlinkt; geplante Fortsetzungen bleiben sichtbar, aber ohne 404-Link.

1. [Install grommunio 2026.06.1: From ISO to Working Groupware](https://forgeone.solutions/en/tech/install-grommunio-2026)
2. [grommunio-antispam with Rspamd: Spam Filtering, Learning and Operations Step by Step](https://forgeone.solutions/en/tech/grommunio-antispam-rspamd-2026-step-by-step)
3. [grommunio-auth with Keycloak: SSO and central login step by step](https://forgeone.solutions/en/tech/grommunio-auth-keycloak-2026-step-by-step)
4. [Set up grommunio Meet 2026 without Keycloak and optionally add SSO](https://forgeone.solutions/en/tech/grommunio-meet-2026-step-by-step)
5. [Set Up grommunio Chat 2026: Teams, Channels, Users and Multi-Tenancy Testing](https://forgeone.solutions/en/tech/grommunio-chat-2026-step-by-step)
6. [Set Up grommunio Files and Office: Validate Files, Web Entry and Online Office](https://forgeone.solutions/en/tech/grommunio-files-office-2026-step-by-step)
7. [Set Up grommunio Archive 2026: Archive, Search and Restore Email](https://forgeone.solutions/en/tech/grommunio-archive-2026-step-by-step)
8. [grommunio MDM 2026 step by step: manage ActiveSync devices safely (current part)](https://forgeone.solutions/en/tech/grommunio-mdm-2026-step-by-step)
9. [grommunio Multitenancy 2026: organizations, domains and multiple LDAP sources](https://forgeone.solutions/en/tech/grommunio-multitenancy-2026-step-by-step)
10. [grommunio 2026 Cluster and High Availability: from multi-server lab to tested active/standby homeserver](https://forgeone.solutions/en/tech/grommunio-cluster-ha-2026-step-by-step)
11. [grommunio 2026 disaster recovery and single mailbox restore: backup, full DR and targeted mailbox recovery in the lab](https://forgeone.solutions/en/tech/grommunio-disaster-recovery-single-mailbox-restore-2026-step-by-step)
12. [Migrate IMAP mailboxes to grommunio with imapsync](https://forgeone.solutions/en/tech/grommunio-imap-migration-imapsync-2026-step-by-step)
13. [grommunio: Replace Public Folders with a functional mailbox - step by step](https://forgeone.solutions/en/tech/grommunio-public-folder-functional-mailbox-multiple-domains)
14. [grommunio Web 5.0 in the lab: settings namespace, shared mailboxes and admin impact](https://forgeone.solutions/en/tech/grommunio-web-5-0-in-the-lab)
15. [grommunio 2026.06.2 Upgrade and Technical Acceptance: Keycloak SSO, MFA, AutoDiscover and Mail Flow](https://forgeone.solutions/en/tech/grommunio-2026-06-2-upgrade-keycloak-sso-practice)
16. [grommunio native clients after Keycloak SSO: Thunderbird, Outlook, EWS, EAS and MFA explained](https://forgeone.solutions/en/tech/grommunio-native-clients-after-keycloak-sso)
17. grommunio Monitoring und Alerting im Betrieb
18. grommunio Security Hardening in der Praxis
19. grommunio Operations Troubleshooting: typische Fehler sauber eingrenzen