How should I block BIS connections from accessing my Exchange Server

Question

BIS is a technology from Blackberry that allows end users to connect to an Exchange server without a BES server.

The problem is that BES asserts a security policy on the devices, and BIS does not recognise this, or support remote wipe functionality, local encryption (etc.).

• How do I block (and optionally detect) BIS connections from my server?

Answer 1

The IP addresses for blocking BIS service are listed here (updated 11/10/11)

http://www.blackberry.com/btsc/KB11036

Preventing these IPs from accessing the OWA servers will prevent end users from bypassing security policy via BIS.