Secure Mobile Email Access — Without User Friction or MDM

Protect Office 365 email on mobile devices with continuous, device-based MFA — purpose-built for BYOD environments.

As organisations move from on‑premises Exchange to Exchange Online (Office 365), securing mobile email access becomes increasingly challenging. Traditional MFA solutions introduce friction, rely on one‑time checks, or require full mobile device management (MDM) — often unacceptable in BYOD scenarios.

Deepnet’s Device-Based MFA for Office 365 Email Access delivers strong, continuous authentication for iOS and Android devices using native Office 365 certificate authentication — with no user disruption and no requirement for Microsoft Intune.

Why Device-Based MFA?

The Challenge

• Mobile email is a primary attack vector
• Credentials can be compromised after login
• OTP and push-based MFA only protect initial sign‑in
• MDM solutions are intrusive and unpopular with BYOD users

The Solution

Device-Based MFA continuously validates the trusted device itself, not just the user’s credentials — providing stronger protection throughout the entire email session.

Key Benefits

✔ Built for BYOD

Secure personal devices without enrolling them into Intune or full MDM. Users keep their privacy while IT teams retain control over email access.

✔ Native Office 365 Integration

The solution layers seamlessly on top of Office 365’s native certificate-based authentication. A unique device identity is embedded into a digital certificate, which Office 365 already trusts — ensuring compatibility and reliability.

✔ Continuous Authentication

Unlike OTPs, push notifications, or FIDO keys that authenticate only at login, device-based MFA continuously verifies the device during the session — dramatically reducing the risk of session hijacking.

✔ Real-Time Device Control

Administrators can instantly suspend or block a device, even while an email session is active — ideal for lost, stolen, or compromised devices.

✔ Self-Service Enrollment with Optional Approval

Users enrol their own devices via a secure self-service flow. Newly enrolled devices can be automatically quarantined for administrator review before activation.

✔ Full Device Lifecycle Management

Using the SafeID Token Service, administrators can manage devices end-to-end:

• Enrollment and activation
• Monitoring and auditing
• Suspension or revocation
• Deletion and expiration

How It Works

1. User enrols their mobile device via the Deepnet DeviceID app
2. A unique device identity is generated
3. The device identity is embedded into a certificate
4. The device certidficate is enrolled into the user's account
5. Office 365 authenticates email access using the device certificate
6. The device certificate is continuously checked during access
7. Administrators maintain real-time visibility and control

Why Not Just Use Microsoft MFA?

Office 365’s built-in MFA options are effective, but they are event-based — authentication occurs only at sign-in.

They do not provide:

• Continuous session validation
• Real-time device blocking
• BYOD-friendly enforcement without MDM

Deepnet’s Device-Based MFA complements Microsoft MFA by adding continuous, device-centric security where it matters most: mobile email access.

Ideal For Organisations That:

• Support BYOD email access on iOS and Android
• Want stronger security without degrading user experience
• Require instant response to lost or compromised devices
• Need compliance-friendly controls without full device management