Supporting Windows 8 Mail in your organization

All versions of Windows 8 and Windows RT include a built in email app named Mail (also referred to as Windows 8 Mail or the Windows 8 Mail app). The Windows 8 Mail app includes support for IMAP and Exchange ActiveSync (EAS) accounts.

This article includes some key technical details of the Windows 8 Mail app. Use the information to help you support the use of Windows 8 Mail app in your organization. Read this article start to finish, or jump to the topic that interests you. Use the reference links throughout the article for more information.

NOTE Mail, Calendar, People, Calendar, and Messaging are apps that are built in to Windows 8 and Windows RT. Although this article discusses the Windows 8 Mail app, please note that much of the information in this article also applies to the Calendar, People, and Messaging apps. This is because, when connected to a server that supports Exchange ActiveSync, the Calendar, and People apps may also display data that was downloaded over the Exchange ActiveSync connection.

Protocol Support

The Windows 8 Mail app lets users connect to any service provider that supports either of the following two protocols:

• Exchange ActiveSync
• IMAP/SMTP

POP is not currently supported.

Exchange ActiveSync

Exchange ActiveSync can be used to sync data for email, contacts, and calendar. The Windows 8 Mail app supports EAS versions 2.5, 12.0, 12.1, and 14.0. For detailed protocol documentation, see Exchange Sever Protocol Documents on MSDN.

NOTE All Windows Communications apps (Mail, Calendar, and People) can use the data that is synchronized with Exchange ActiveSync. After a user connects to their account in the Windows 8 Mail app, their contacts and calendar data are available in the other Windows Communications Apps and vice versa.

IMAP/SMTP

The Windows 8 Mail app supports IMAP via the following standards:

• IMAP4 rev1 RFC 3501
• SMTPRFC 5321
• IMAP4 IDLE command (push email) RFC 2177
• IMAP LIST Extension for Special Folders RFC 6154
• XLIST extension of the LIST command (identifies special folders). See Extension of the LIST command: XLIST in Google Apps Platform documentation.

IMAP/SMTP can be used to send and receive email only. Contacts data and calendar data is not synchronized when IMAP/SMTP is used.

Sync Configuration

The Windows 8 Mail app can be configured to synchronize data at different times as follows:

• Push email (default)
• Polling at fixed intervals
• Manually

If a push email connection can’t be established, it will automatically switch to poll at fixed intervals.

Push Email

Push email requires that accounts are either Exchange ActiveSync (which all support Push) or IMAP with the IDLE extension. Not all IMAP servers support IDLE, and it is supported only for the Inbox folder.

When a push connection can’t be established, Mail will change to polling on 30 minute intervals. Push email on Exchange ActiveSync requires that HTTP connections must be maintained for up to 60 minutes, and IMAP IDLE requires TCP connections to be maintained for up to 30 minutes.

Account Setup Features

Windows 8 and Windows RT users can add email accounts to the Windows 8 Mail app using the Windows 8 Settings charm. The Windows 8 Settings charm is always available on the right side of the Windows 8 and Windows RT screen.

NOTE This section provides an overview of Windows 8 Mail app account setup. For step-by-step procedures for setting up an account in the Windows 8 Mail app, see What else do I need to know? at the end of this guide.

To make it as easy as possible to add accounts, account setup only prompts the user to enter the email address and password for the account they want to set up. From that data, Mail attempts to automatically configure the account as follows:

• The domain portion of the email address is matched against a database of well-known service providers. If it’s a match, its settings are automatically configured.
• The domain portion of the email address is used to execute Exchange ActiveSync Autodiscover processes. For detailed information, see Autodiscover HTTP Service Protocol Specification on MSDN.
• If still not configured, the user is prompted to provide detailed settings for their server.

Exchange ActiveSync

Figure 1: Exchange ActiveSync (EAS) configuration in Windows Mail

Full details needed to connect to an Exchange server – needed only if Autodiscover failed

The information required to connect to a server via Exchange ActiveSync is:

• Email address
• Server address
• Domain
• Username
• Password

IMAP/SMTP

Figure 2: IMAP/SMTP configuration in Windows Mail

The information required to connect to a server via IMAP/SMTP is:

• Email address
• Username
• Password
• IMAP email server
• IMAP SSL
• IMAP port
• SMTP email server
• SMTP SSL
• SMTP port
• Whether SMTP requires authentication
• Whether SMTP uses the same credentials as IMAP (If not, user must also provide SMTP credentials)

Security Features

Mail provides administrators with some level of security through Exchange ActiveSync policies. It doesn’t support any means of managing or securing PCs that are connected via IMAP.

Policy Support

Exchange ActiveSync devices can be managed using Exchange ActiveSync policies. Windows 8 Mail supports the following EAS policies. :

• Password required
• Allow simple password
• Minimum password length (to a maximum of 8 characters)
• Number of complex characters in password (to a maximum of 2 characters)
• Password history
• Password expiration
• Device encryption required (on Windows RT and editions of Windows that support BitLocker)
• Maximum number of failed attempts to unlock device
• Maximum time of inactivity before locking

Note that if AllowNonProvisionableDevices is set to false and your server sets policies that are not part of this list, the device won’t be able to connect to the Exchange server.

Getting into Compliance

Most of the policies listed above can be automatically enabled by Mail, but there are certain cases where the user has to take action first. These are:

• Server requires encryption:
  • User has a device that supports BitLocker but BitLocker isn’t enabled. User must manually enable BitLocker.
  • User has a Windows RT device that supports device encryption but it is suspended. User must reboot.
  • User has a Windows RT device that supports device encryption, but it isn’t enabled. User must sign into Windows with a Microsoft account.
• An admin on this PC doesn’t have a strong password. All admin accounts must have a strong password before continuing.
• The user’s account doesn’t have a strong password. User must set a strong password before continuing.

Domain Joined PCs

If a Windows 8 PC is joined to an Active Directory domain and controlled by Group Policy, there may be conflicting policy settings between Group Policy and an Exchange ActiveSync policy. In the event of any conflict, the strictest rule in either policy takes precedence. The only exception is password complexity rules for domain accounts. Group policy rules for password complexity (length, expiry, history, number of complex characters) take precedence over Exchange ActiveSync policies – even if group policy rules for password complexity are less strict than Exchange ActiveSync rules, the domain account will be deemed in compliance with Exchange ActiveSync policy.

Remote Wipe

Mail supports the Exchange ActiveSync remote wipe directive, but unlike Windows Phones, the data deleted by this directive is scoped to the specified Exchange ActiveSync account. The user's personal data is not deleted. For example, if a user has an Outlook.com account for personal use and a Contoso.com account for work use, a remote wipe directive from the Contoso.com server would impact Windows 8 and Windows Phone 7 as follows:

Account Roaming

To make it as easy as possible for users to have all of their accounts set up on all of their devices, Windows 8 uploads vital account information to the user’s Microsoft account. This information includes email address, server, server settings, and password. When a user signs into a new PC with their Microsoft account, their email accounts are automatically set up for them.

Passwords are not uploaded from a PC for any accounts which are controlled by any Exchange ActiveSync policies. Users will have to enter their password to begin syncing a policy-controlled account on a new PC.

Microsoft Accounts

Users are required to have a Microsoft Account, formerly known as Windows Live ID, to use the Windows Communications apps. This will usually be the Microsoft account that the user is signed into Windows with, but if they have not done so, they will be prompted to provide one before proceeding.

Microsoft accounts will automatically sync to Microsoft services using Exchange ActiveSync 14.0 when Mail starts. This will synchronize:

• Email, if the user’s Microsoft account is also their Hotmail or Outlook.com account
• Contacts from Windows Live
• Calendar events

If the user’s Microsoft account is not a Outlook.com or Hotmail account (for example, dave@contoso.com), Mail will prompt the user to provide the password for their email account, which will be added automatically.

Data Consumption

By default, Mail only downloads the last two weeks of email. This is user configurable and can potentially download the user’s entire mailbox. For Exchange ActiveSync accounts, all contacts are downloaded and calendar events are downloaded only for three months behind the current date and 18 months ahead.

Additionally, messages are only partially downloaded to reduce bandwidth use as follows:

• Message bodies are truncated to the first 100KB (20KB on metered networks). For more details see Engineering Windows 8 for mobile networks.
• Attachments are not downloaded automatically.

Embedded images in email messages are downloaded on-demand as the user reads them, and attachments are downloaded on-demand as the user attempts to open them.

By default, Mail only downloads the user’s Inbox and Sent folders. Other folders are downloaded once the user accesses them for the first time.

Mail does not enforce any limits on how many or large of attachments users can send.

Limitations

The following features are currently not supported by Mail:

• Mailbox connections using POP:  IMAP and EAS are supported.

  (Note, this does not mean that Windows 8 does not support POP3. This post is about the Windows 8 Mail app. )

• Servers that require self-signed certificates: Users can work around the self-signed certificate limitation by manually installing the certificate on their Windows 8 or Windows RT device. For additional information about the self-signed certificates, see Self-Signed Certificates section below.

• Opaque-Signed and Encrypted S/MIME messages: When S/MIME messages are received in Windows 8 Mail, it displays an email item with a message body that begins with “This encrypted message can’t be displayed.”

  To view email items in the S/MIME format, users must open the message using Outlook Web App, Microsoft Outlook, or another email program that supports S/MIME messages. For more information, see Opaque-Signed and Encrypted S/MIME Message on MSDN.

Self-Signed Certificates

Users may experience connectivity errors when trying to connect to an Exchange servers that require self-signed certificates. The user may receive the following error messages.

Unable to connect. Ensure the information entered is correct.

<Email address> is unavailable

NOTE This issue may occur because the Mail app cannot connect to Exchange by using self-signed certificates.

Consider the following options to resolve this issue.

1. Option 1: Install a certificate that is signed by a Microsoft-trusted root certification authority (CA) on the server

   This enables Exchange to work for all clients without prompting. For more information about the trust root CAs, see the following topics on TechNet:

   • Windows Root Certificate Program overview
   • Windows Root Certificate Program - Members List (All CAs)

2. Option 2: Install a server’s self-signed certificate on a device

   This enables Exchange to work for Windows 8 devices that have the certificate installed.

Note To install a self-signed certificate for a domain’s certification authority, the administrator must provide a certificate file (.cer). The certificate can be installed to the trusted root certificate authority store for either of the following options:

• For the current user This option does not require admin rights but must be completed for each user on the device.
• For the local device This option requires administrator rights and needs to be done only one time for a device.

The user or the system administrator can use the .cer file to install the certificate. To do this, use one of the following methods:

• Command-line tool

  At an elevated command prompt, run the following command:

  certutil.exe -f -addstore root <name_of_certificatefile>.cer

  NOTE The command installs the certificate for all users on the device.

• User interface

  1. Double-click the certificate file. A certificate dialog opens.
  2. Click Install Certificate. A Certificate Import Wizard window opens.
  3. Select the option to install the certificate for only the current user or for the local device.
  4. Select Place all certificates in the following store
  5. Click Browse to open the store selection dialog. Select Trusted Root Certification Authorities.
  6. Select the store, and then click Ok. You are returned to Certificate Import Wizard dialog, and the certificate store and certificate to be installed into that store are displayed.

Troubleshooting Windows 8 Mail Client Connectivity

If Windows 8 Mail users can't successfully connect to their accounts, consider the following:

• Verify that the user is using the latest version of the Windows 8 Mail app. A user can check for updates to the Windows 8 Mail app by doing the following: from the Start screen, go to Store > Settings > App updates > Check for updates.
• The user should wait a few minutes and try again.
• If the account is a cloud-based email account that requires registration (for example, a Microsoft Office 365 account), the user must register their account before they can set up their account in Windows 8 Mail. If the user is a Microsoft Office 365 user, they register their account when they sign in to Office 365 for the first time. If the user is not an Office 365 user, the user registers their account when they sign in to their account using Microsoft account or Outlook Web App.

TIP The user will see the following message if they haven't registered their account. In Windows 8 Mail, you will see the following message:
“We couldn’t find the settings for. Provide use with more info and we’ll try connecting again.”

For information about signing into Outlook Web App or the Office 365 Portal, see Sign In to Outlook Web App.

After the user signs in to your account using Outlook Web App, the user should sign out, and then try to connect using Windows 8 Mail.

What else do I need to know?

• Set up email in Windows 8 Mail
• Mail: Frequently asked questions