Changes to the Intune Exchange On-Premises Connector

apnet1205 - Outlook for iOS and Android (Outlook mobile) has always been a cloud-backed application. Processing information in our service fabric enables advanced features and capabilities, such as the categorization of email for the Focused Inbox, improved search speed, artificial intelligence scenarios, and more. It enhances Outlook’s performance and stability, relying on the Outlook service for intensive processing and minimizing the resources required from users' devices. Lastly, it allows Outlook to build features that work across all email accounts, regardless of the technological capabilities of the underlying messaging platforms (e.g. different versions of Exchange, 3rd party email systems like Yahoo! Mail and Gmail, etc.). There are no plans to provide an Outlook mobile experience that does not rely on cloud integration.

But let's break this down. What do you have today? You have a on-premises Exchange server and a mobile EAS device (and possibly laptops with Outlook cached mode). The mobile EAS device contains a portion of the user's mailbox data. This mobile EAS device (and laptop!) roams wherever the user goes - in-country, out-country, etc. All changes that the user enacts on the mobile device are synced to the on-premises Exchange server which is considered the authoritative source. 

Now let's look at the Outlook mobile architecture (http://aka.ms/hmaom). You have a mobile app, EXO, and on-premises Exchange. What is EXO in this scenario? It's nothing more than the mobile EAS device in the previous example - it syncs a portion of the mailbox data from on-premises using EAS. The authoritative source is still on-premises Exchange (e.g, message transport occurs via on-premises). Outlook+EXO = "mobile EAS device". And you get all the benefits from a security, privacy, and compliance perspective that O365 provides. Plus, you get additional capabilities like Conditional Access and Intune App Protection Policies that you may not have available with traditional EAS clients, which further protects the data on the physical device and ensures only trusted users gain access to the data.

In the event you have a legal requirement that a portion of the mailbox data cannot reside in a cloud service (but again challenge the notion if the authoritative and complete source remains on-premises and traditional EAS mobile devices are allowed out of country!), then yes, the native mail clients are your only option (remember, there are other third-party client apps out there that sync data to cloud repositories).