Compliance, quarantinedStatus, and blockReason values
The APIs which return information about a device include these fields:
- <compliance>
- <quarantinedStatus>
- <blockReason>
The value of each of these fields appears in the response as a decimal number that represents a bitmap value. Each bit in the value represents a reason why the device is not in compliance, has been quarantined, or has been blocked from accessing the ActiveSync server.
The following table shows when each of these fields is non-zero:
Field | Value |
|---|---|
<compliance> | The value is non-zero if the device is not in compliance as specified by its security policy. |
<quarantinedStatus> | The value is non-zero if the device is not in compliance as specified by its security policy, and the setting that is not in compliance specifies an action that includes quarantining the device. |
<blockReason> | The value is non-zero in the following cases:
|
Note: If multiple reasons apply, the corresponding bit values are summed. For example, if the device has been compromised (value 1), and its OS version is less than the required version (value 2), then the field has the value 3.
The following table shows all the possible bitmap values for the <compliance>, <quarantinedStatus>, and <blockReason> fields:
Hexadecimal value | Decimal value | Description |
|---|---|---|
0x000000 | 0 | Device is in compliance. Note: Jailbroken Android devices have the compliance value 0, but the security_state field in the Android device details has the value “compromised”. |
0x000001 | 1 | Device is compromised. |
0x000002 | 2 | OS version is less than the supported OS version. |
0x000004 | 4 | Hardware version is not allowed. |
0x000008 | 8 | Data Protection is not enabled. |
0x000020 | 32 | Device is out of contact. |
0x000040 | 64 | App control policy is out of compliance. |
0x000080 | 128 | Device exceeds per mailbox limit. |
0x000100 | 256 | Device is not registered. |
0x000200 | 512 | Device is manually blocked. |
0x000400 | 1024 | Exchange Reported. |
0x000800 | 2048 | Device administrator is deactivated. Note: On an Android device, the device administrator is deactivated. On iOS 5.0 and higher, the MDM profile has been removed, which deactivates MDM on the device. |
0x001000 | 4096 | Disallowed app control policy is out of compliance. |
0x002000 | 8256 | Required app control policy is out of compliance. |
0x000010 | 8272 | Policy is out of date. |
0x004000 | 16384 | Allowed app control policy is out of compliance. |
0x008000 | 32768 | User logged out. |
0x10000 | 65536 | Attestation Failed. |
0x400000 | 4194304 | Unknown reason. |
