So we are trying to allow our mobile users to get email on the their phone - this is currently working fine using  a firewall layer7 rule (limited to only a few management employees).   We do NOT want to allow our employees to be able to have MSFT office on a laptop and have outlook client connecting to exchange on the laptop.  But because of the rule above its allowing outlook clients to connect outside our network.   We have a VPN that our users connect to to get mail to the client etc.   Is there a way to allow our mobile user to connect (that we allow via activesync) while not allowing any devices or clients connect to exchange outside our network ?   ... View more