Microsoft Exchange isn't one protocol, it's a family. BlueMail speaks the two that matter, Exchange ActiveSync and Exchange Web Services, and it was built first for the Exchange Server in your own datacenter. Exchange Online is supported right alongside.
Whether you run Exchange Server in your own datacenter, as most BlueMail Work fleets do, or Exchange Online in Microsoft 365, the server exposes several ways in. Most email apps pick one and live with its limits. BlueMail implements both major protocols and uses each for what it does best. EAS (Exchange ActiveSync) is the always-on sync backbone. EWS (Exchange Web Services) handles the rich operations ActiveSync was never designed to carry. And because BlueMail is native on Windows, Mac and Linux as well as Android and iOS, the same two protocols power every screen your team works on. One account, identical from phone to workstation.
Setup is automatic. Enter your address and BlueMail discovers the right endpoints via Autodiscover, negotiates modern OAuth authentication where your server supports it and encrypts every connection with TLS. No server names, no port numbers, no IT ticket.
Most BlueMail Work fleets don't live in the cloud. They run on Exchange Server in the company's own datacenter. So on-prem isn't a compatibility checkbox here. It's the deployment BlueMail is engineered around: 2016, 2019 and Subscription Edition, standalone or hybrid, behind your firewall and across your VPN.
BlueMail connects directly to your server over TLS, against your internal DNS, honoring your certificate authority. Your people sign in with the identity you already run, ADFS included. Mail syncs between device and server, and message content never touches a third-party cloud. Custom Autodiscover, manual endpoints and private-CA certificates are first-class settings, not support tickets.
And while Microsoft steers Exchange Online toward new APIs, EAS and EWS remain the native tongue of on-premises Exchange, and BlueMail exercises all of both. On-prem isn't legacy. It's the bigger market, and it stays current.
On desktop (Windows, Mac and Linux) BlueMail holds the Direct Push connection itself, straight to the server. Android and iPhone restrict long-lived background connections, so a small encrypted change event (never your mail) wakes the app through Google's or Apple's push service, and it syncs straight from your server. For on-premises Exchange, that wake-up comes from PushRelay, below. Curious how push works for consumer accounts like Gmail? See How Instant Push works.
Want instant push from an on-premises server, on iPhone, Android and desktop alike? That's what PushRelay is for. A small connector runs inside your network beside Exchange and watches for new mail. When something arrives, the only thing that leaves your network is a tiny notification, end-to-end encrypted from the connector all the way into your device, like a sealed tunnel. It travels through Apple's and Google's push services, but neither they nor any server along the way can read it. Bodies and attachments stay home: the notification decrypts on the device itself, and the app fetches the mail straight from your server with your existing authentication. No VPN, no reverse proxy, no inbound ports.
The sync engine. Born for phones, perfected over two decades.
The deep-integration API. Everything ActiveSync can't reach.
| EAS · Exchange ActiveSync | EWS · Exchange Web Services | |
|---|---|---|
| Designed for | Phones and tablets on flaky networks | Desktop-class clients and services |
| Wire format | Compact binary XML (WBXML) | SOAP XML over HTTPS |
| Push mail | Direct Push heartbeat, near-instant | Streaming and pull notifications |
| Sweet spot | Fast, battery-friendly sync of mail, calendar and contacts | Out-of-office, free/busy, server search, shared mailboxes |
| Typical endpoint | /Microsoft-Server-ActiveSync | /EWS/Exchange.asmx |
| In BlueMail | The sync backbone | The feature enrichment layer |
You never choose a protocol. BlueMail does, per operation. New mail arrives the instant the server sees it, because EAS Direct Push keeps a lightweight heartbeat open. Set an out-of-office message, look up a colleague's availability or search three years of mail you never synced to the device, and BlueMail quietly switches to EWS for that call. One account, both dialects, zero configuration.
The two deployments also age differently, and BlueMail tracks both. On Exchange Online, Microsoft is steering clients toward its modern APIs, and BlueMail adopts them, including Microsoft Graph, as capabilities migrate. On-premises, EAS and EWS remain the native tongue of Exchange Server, and BlueMail will keep speaking both for as long as your servers do. For managed fleets, Exchange accounts deploy hands-free through your MDM too.
On-premises 2016, 2019 and Subscription Edition: standalone, hybrid or behind a VPN. The deployment most BlueMail Work fleets run.
Third-party hosted Exchange providers work out of the box via Autodiscover.
Microsoft 365 and Office 365 tenants, with modern OAuth authentication end to end.
Personal Microsoft accounts sync over the same battle-tested ActiveSync stack.
Yes. It's the deployment BlueMail is engineered around. Exchange Server 2016, 2019 and Subscription Edition are fully supported, standalone or hybrid, behind firewalls and VPNs. Autodiscover finds the right endpoints from just your email address, and advanced settings cover custom hosts, ports and certificates when your topology needs them.
No. BlueMail connects directly to your Exchange server over TLS, and message content syncs straight between device and server, so on-premises mail stays inside your network. Instant-push wake-ups are optional. When they're on, a small encrypted notification travels through Apple's or Google's push service to tell the app to sync. No cloud along the way can read it, and your mail never leaves the direct connection.
On desktop (Windows, Mac and Linux) BlueMail holds the EAS Direct Push connection itself. The app is running, so mail is simply there. Android and iPhone restrict long-lived background connections, so a small encrypted change event, never message content, wakes the app through Google's or Apple's push service, and the app syncs directly from your Exchange server. With PushRelay, that wake-up path reaches on-premises servers with no inbound exposure.
Not unless you want to. By default BlueMail picks the right protocol for each operation: EAS keeps mail, calendar and contacts in instant sync, and EWS handles out-of-office, free/busy, server-side search and shared mailboxes. The choice stays yours, though. If your environment needs a single protocol, say an older Exchange version or a policy that disables one of them, IT can pin the account to EAS or EWS.
That retirement applies to Exchange Online, where BlueMail authenticates with modern OAuth 2.0, so it doesn't affect you. On-premises servers keep working with your existing authentication setup, over fully encrypted TLS connections.
On Exchange Online, BlueMail adopts Microsoft's modern APIs, including Microsoft Graph, as capabilities migrate there. On-premises, EAS and EWS remain the native tongue of Exchange Server, and BlueMail keeps speaking both.
Yes. EAS carries server-side provisioning policies (PIN, encryption, remote wipe), and BlueMail layers app-level controls on top through your MDM or EMM platform.