Mac Mail and Microsoft Exchange via IMap
by: George Starcher, Associate Editor
Today I had to help our Corporate office. They had a person in our graphics department that used Outlook on a 10.3.9 version Mac. They had moved this person’s email box to a new Exchange server and their mail quit working. Rather than fight with this old unsupported software I showed them how to setup the native Mac Mail and Address book to talk to the company Exchange system using IMap and Ldap.
This assumes your company Exchange server already is set to allow IMap and Ldap. Ours was for a voicemail unified messaging system.
The key here is to get the user name right. All the rest is as you would expect. Give the IP address of the Exchange server, choose Imap as your connection type.
The user name format is Domain/DomainUserName/ExchangeMailboxAlias
An example would be MyDomain/gstarcher/georgestarcher
Your password is your Microsoft network domain user password. Keep in mind most companies (if they are smart) make you change your network password regularly. So you will need to update it in your mail account settings if you choose to save the password every time it changes.
- Domain – This is your Microsoft Windows domain name
- DomainUserName – This is your network logon user ID
- ExchangeMaiboxAlias – This is the alias name setup in your Exchange Mailbox settings on the Exchange server. You may need to get this from your IT department.
Address Book
Open up address book. Open the program preferences and go to the Ldap tab. Click the Plus button to add a new Ldap server. Enter the appropriate settings provided by the IT department. Depending on how they have Ldap setup you may need to use SSL to encrypt it and a logon to authenticate (usually your domain user logon like in mail above) to be able to do lookups. However the default on Microsoft Exchange is wide open so usually just the IP address of the Exchange server will work. Big Surprise there I know.
That is it. As long as your Mac can reach the Exchange server then you can check your email and even send to other company employees via their names. Keep in mind if you are not setting up all this with SSL to encrypt it then I would not do this except for Macs that stay inside the company network and never leave.
Our IT department here claims that IMAP has serious security issues. Is this true? I would like them to expose IMAP so that I can dump my blackberry and jump to the iPhone.
JoeM
Comment by Joe Manich — December 6, 2007 @ 8:21 am
It is just like pop3. Unencrypted by itself. A blackberry is secure in its entire data path. You would be potentially exposing data unless imap is run over SSL for encryption purposes. Plus likely your company has a large investment in the blackberry platform. Just so a user can jump to an iphone is not enough of a valid business reason to throw away the investment in the completely secure and corporate managable Blackberry solution. There is no corporate management of the iphone to ensure the device keeps the data encrypted, that the device can be wiped and disabled remotely if it is lost or stolen. So it is more than just an issue of default imap being unencrypted.
Comment by George Starcher — December 6, 2007 @ 10:06 am
Great entry overall George, but a little nit in your comment to Joe. There is no such thing as “completely secure” – for Blackberries, or anything else.
I will grant you that the *possibility* that you *can* secure a Blackberry to a far greater degree than an iPhone, is a true statement, and completely agree with you otherwise state (i.e., that unsecured IMAP, POP3, etc. is not a great idea).
It seems dangerous to me to think/state that a Blackberry is “completely secure.”
The subpoint is, there are MANY ways that companies CAN make systems more secure. But do they? Should they? Security can frequently get in the way, as much as it can prevent “bad things” from happening.
Sidebar: We didn’t cover Blackberry security per se, but in 2 months ago, we (AIIM Market Intelligence) wrote up a nearly 70 page document on Content Security (i.e. security of content, no matter where it lives). Freely available, for anyone interested. Search on Market IQ on Content Security, or linked a number of times from my blog.
Cheers,
Dan
Comment by Dan Keldsen — December 6, 2007 @ 2:16 pm
I meant secure from a data path standpoint. It is encrypted from the Enterprise systems all the way to the device. True if content security is not enabled on the device along with a locking password then someone could just pick up the physical berry unit and get into the data. But relative to Joe’s IT department’s complaint about IMap vs the blackberry the key issue is the encryption in transit of the credentials and data. For that purpose the blackberry system with a corporate BES is much more secure.
Comment by George Starcher — December 6, 2007 @ 3:27 pm