For Microsoft 365 organizations, the choice between Exchange ActiveSync and CardDAV depends on where contacts are stored, how devices are managed, and who needs access to them. Exchange ActiveSync synchronizes supported mailbox data, including personal contacts, with compatible mobile clients. CardDAV provides a way to deliver centrally managed contact directories to devices through a compatible service and client. Both approaches can support enterprise contact synchronization, depending on the organization’s requirements and infrastructure.
The decision matters more in 2026. Exchange Online now blocks ActiveSync clients older than version 16.1, and Microsoft’s Exchange Team confirmed in August 2026 that the change is fully enforced (Microsoft Tech Community). Microsoft also lists ActiveSync, MAPI, Outlook on the web, IMAP and POP3 as the client access methods for Exchange Online mailboxes, and CardDAV is not among them (Microsoft Learn). So CardDAV for Microsoft 365 contacts always depends on a separate CardDAV service.
This guide compares both methods on the points IT teams actually decide on: what data each one moves, how it reaches iPhone and Android, who controls it, and what tends to break. It also covers a third path that many tenants already use, Outlook mobile contact sync.
Key takeaways
- ActiveSync syncs a mailbox. It delivers the contacts stored in each user’s mailbox Contacts folder. It does not turn the Global Address List (GAL) into saved phone contacts on its own.
- CardDAV syncs an address book. It is an open IETF standard. iPhone and iPad support it natively through an MDM Contacts payload, while Android needs an app to provide CardDAV sync.
- 2026 changed the baseline. Since March 1, 2026, Exchange Online rejects ActiveSync clients below version 16.1. Outlook for iOS and Android does not use ActiveSync and is not affected.
- Match the delivery method to the environment. Company contacts can be delivered through a mailbox-based model, where centrally managed contacts are synchronized into users’ Microsoft 365 contact folders and then reach supported devices through ActiveSync or Outlook mobile, or through a CardDAV-based model such as Mobile Direct. The better approach depends on device ownership, MDM coverage, Exchange mailbox availability, supported mobile clients and how IT wants company contacts managed on the device.
What is Exchange ActiveSync?
Exchange ActiveSync (EAS) is Microsoft’s protocol for synchronizing a mobile device with an Exchange mailbox. Microsoft describes it as an HTTP and XML based protocol designed for high-latency, low-bandwidth networks that gives users access to email, calendar, contacts and tasks, including while offline (Microsoft Learn). It is enabled by default on Exchange Online mailboxes.
How ActiveSync delivers contacts
ActiveSync syncs whatever is in the user’s mailbox. When the built-in Exchange account on an iPhone, or an Android mail app, connects over EAS, the contacts it receives are the ones stored in that user’s mailbox Contacts folder. On Apple devices, Exchange’s Direct Push feature delivers email, tasks, contacts and calendar events whenever a data connection is available (Apple Platform Deployment).
The Global Address List works differently. Apple devices query the Exchange GAL when a user searches Contacts or types an email address (Apple Platform Deployment), but that is a lookup, not a sync. A colleague who exists only in the GAL will not appear by name when they call. Our GAL sync guide explains this difference in detail.
What IT controls with ActiveSync
Microsoft lists these admin controls for ActiveSync in Exchange Online (Microsoft Learn):
- Enable or disable ActiveSync per user.
- Device password and encryption policies.
- Remote wipe of a lost or stolen device.
- Device access rules that allow or block specific device types.
- Reports on connected devices.
One caveat matters for planning. Microsoft states that support for these features is up to the device operating system and mail app vendor, and that it has no control over which EAS features iOS and Android implement.
Where ActiveSync falls short for company contacts
- It only syncs a mailbox. To get company contacts onto phones, someone first has to write them into every user’s mailbox Contacts folder. That is the job of a GAL sync tool.
- Behavior depends on the client. On Android, the mail app (Gmail, Samsung Email or another vendor’s app) implements EAS, so contact sync quality varies by vendor.
- Users need a mailbox. Microsoft’s documentation ties ActiveSync to users who have an Exchange mailbox. Frontline workers or contractors without one have nothing to sync.
What is CardDAV?
CardDAV is an open standard for accessing, managing and sharing contacts over HTTP. The IETF published it in 2011 as RFC 6352, an extension of WebDAV that stores each contact in vCard format. The specification requires CardDAV servers to support secure transport using TLS, and it allows address books that several users share, such as a sales team directory.
CardDAV handles contacts only. It does not carry email, device policies or calendars (calendars use a sister protocol, CalDAV).
How CardDAV reaches iPhone and iPad
Apple builds CardDAV into iOS, iPadOS and macOS. In a managed deployment, IT pushes a Contacts payload (payload identifier com.apple.carddav.account) through the MDM. According to Apple’s payload documentation, the payload carries:
- The CardDAV server hostname or IP address and port.
- An optional principal URL for the account.
- The account username and, optionally, the password.
- A Use SSL setting. If the server certificate is not from a certificate authority the device trusts, Apple says to add the needed root or intermediate certificates with a Certificates payload.
Once the profile installs, the company address book appears in the native Contacts app. The user does not install or configure anything.
How CardDAV reaches Android
Android does not generally provide native CardDAV account synchronization in the same way as iOS. Standard CardDAV deployments typically require a compatible synchronization app, such as DAVx5, to make contacts available through Android’s system Contacts provider. Enterprise solutions may use different deployment methods or device management integrations. IT teams should verify the requirements of their selected CardDAV service, Android version, and MDM platform before deployment.
Where CardDAV falls short
- Update frequency depends on the CardDAV implementation. The base CardDAV standard does not define a universal push notification mechanism. Most deployments rely on scheduled refreshes or device fetch intervals, although some implementations support additional notification capabilities. For CiraSync Mobile Direct, contact freshness depends on both the configured source synchronization schedule and the device’s retrieval settings.
- Microsoft 365 does not serve it. You need a CardDAV service that reads from your Microsoft 365 directory and publishes the result.
- Contacts only. Email and calendars still need ActiveSync, Outlook mobile or another client.
ActiveSync vs CardDAV: side-by-side comparison
The biggest difference is the source of the contacts: ActiveSync delivers each user’s own mailbox, while CardDAV delivers whatever address book a CardDAV server publishes.
| Factor | Exchange ActiveSync | CardDAV |
| Standard | Microsoft protocol based on HTTP and XML | Open IETF standard (RFC 6352) based on WebDAV and vCard |
| Data it syncs | Email, calendar, contacts and tasks | Contacts only |
| Where contacts come from | The user’s own mailbox Contacts folder | Any CardDAV address book, including a shared company directory |
| Built into Microsoft 365 | Yes, enabled by default on Exchange Online mailboxes | No, requires a separate CardDAV service |
| iPhone and iPad | Built in through the Exchange account | Built in through an MDM Contacts payload |
| Android | Through a compatible EAS client | Typically requires a compatible sync client or a supported enterprise delivery mechanism |
| How updates arrive | Direct Push | Device checks the server on an interval |
| Global Address List | Searchable lookup, not saved as contacts | Saved as contacts if the CardDAV service publishes the directory |
| Users without a mailbox | Not supported | Supported if the CardDAV service includes them |
| IT controls | EAS device policies, device access rules, remote wipe | MDM configuration profile that IT installs and removes |
| 2026 requirement | Exchange Online clients must use EAS 16.1 or later | No Microsoft version requirement |
In short, Exchange ActiveSync is suited to synchronizing supported mailbox data with compatible mobile devices, while CardDAV enables contact synchronization through a dedicated address book service. For company-wide contact synchronization, IT teams should evaluate whether a mailbox-based approach or a separately managed CardDAV directory best fits their existing Microsoft 365 environment, device management capabilities, and security requirements.
What changed for contact sync in 2026
Exchange Online now enforces a minimum ActiveSync version, and that pushes some organizations to rethink which path carries their contacts.
Exchange Online now requires ActiveSync 16.1
Microsoft announced in December 2025 that devices using ActiveSync versions lower than 16.1 would lose access to Exchange Online starting March 1, 2026. In an update dated August 4, 2026, the Exchange Team said the change was fully complete in all cloud environments (Microsoft Tech Community). The rule applies only to Exchange Online, not Exchange Server, and only to mobile devices using native email apps.
For most iPhones, nothing changed. Microsoft notes that the iOS Mail app adopted EAS 16.1 with iOS 10, and Apple lists Exchange Online with EAS 16.1 as its supported configuration (Apple Platform Deployment). Android is less predictable because each mail app vendor implements EAS. Microsoft said in its announcement that Gmail and Samsung Email were updating their apps to 16.1.
Android shows why vendor dependence matters. In May 2026, users reported that the Gmail app on Android was failing to authenticate Microsoft 365 and Exchange Online accounts, and some said work contacts disappeared from native apps. Google acknowledged the issue on its Workspace Status Dashboard and rolled out a fixed app version (PiunikaWeb).
To find devices still below 16.1, run a report in Exchange Online PowerShell. This version follows the approach Microsoft published:
Get-MobileDevice -ResultSize Unlimited | Where-Object { ($_.ClientType -eq 'EAS' -or $_.ClientType -match 'ActiveSync') -and $_.ClientVersion -and ([version]$_.ClientVersion -lt [version]'16.1') } | Sort-Object UserDisplayName | Select-Object UserDisplayName, Identity, DeviceId, DeviceModel, ClientVersion | Format-List
This report identifies Exchange ActiveSync device records that report a client version below 16.1. A device record does not necessarily mean that the device is still actively synchronizing. Before contacting users or taking remediation action, check recent device activity with Get-EXOMobileDeviceStatistics or Get-MobileDeviceStatistics and confirm that the device has synchronized recently. Microsoft recommends Get-EXOMobileDeviceStatistics for Exchange Online. Test the final reporting workflow in your own tenant before using it for remediation.
Outlook mobile is not affected, and it is a third contact path
Microsoft states that Outlook for iOS and Android does not use Exchange ActiveSync to connect to Exchange Online, so the EAS 16.1 requirement does not apply to Outlook mobile.
Contact behavior differs by platform.
On iOS, Outlook’s Save Contacts feature exports Outlook contacts to the native Contacts app. Microsoft recommends managing those contacts through Outlook rather than editing the exported copies in the native iOS Contacts app. Only one iOS device per account should export contacts at a time, and duplicate reconciliation can take up to 24 hours.
On Android, Outlook’s Sync Contacts feature can provide bidirectional synchronization for supported Microsoft 365, Outlook.com and hybrid-modern-authentication accounts. Changes made to supported contact fields in the native Android Contacts app can synchronize back to Outlook.
In both environments, administrator policy matters. Intune App Protection Policies can allow or block synchronization of managed Outlook data with native apps, and contact permissions must also be available on the device.
Neither Outlook mobile method automatically turns the organization’s GAL into saved native contacts. It works with contacts available through the user’s Outlook account.
ActiveSync or CardDAV: which should IT teams use?
Choose based on whose contacts you are delivering and whether IT manages the device, not on the protocol itself.
Choose ActiveSync or Outlook mobile when
- Users mainly need their own mailbox contacts alongside email and calendar.
- Devices are personally owned (BYOD) and you do not want to install configuration profiles on them.
- Company contacts already reach each user’s mailbox Contacts folder through a GAL sync tool, so the mailbox carries them to the phone.
Choose CardDAV when
- IT needs to distribute a centrally maintained contact directory to supported devices through a CardDAV service.
- The organization wants company contacts available in the native Contacts app for functions such as caller identification.
- The selected CardDAV solution supports the required users and devices, including scenarios where users may not have Exchange mailboxes.
- IT has a compatible deployment and management method, such as MDM configuration profiles for supported Apple devices or an appropriate contact synchronization client for Android.
Use both when
Mixed environments often need both paths: ActiveSync or Outlook mobile for each person’s mailbox, and CardDAV for the shared directory on managed devices. If you do this, deliver each set of contacts through only one path per device. Two mechanisms writing the same records is a common cause of duplicate contacts.
Quick recommendations by scenario
| Scenario | Approach to evaluate |
| Users already have Exchange mailboxes and company contacts are centrally synced into those mailboxes | Mailbox-based synchronization through ActiveSync or Outlook mobile |
| Managed iPhones need a separate IT-controlled company directory in native Contacts | CardDAV / Mobile Direct through MDM |
| Managed Android devices need a separate company directory | CardDAV / Mobile Direct with the managed CardDAV Direct companion app |
| Frontline users without Exchange mailboxes | CardDAV / Mobile Direct |
| BYOD environment | Evaluate mailbox-based synchronization first, then CardDAV where device-management policies support it |
| Mixed fleet | Use the appropriate delivery model per managed-device group and avoid delivering the same records through two paths |
These are recommendations based on how each protocol works, not rules. Test with a pilot group before rolling out to the whole fleet.
Checklist: what to confirm before you choose
Work through these eight checks before committing to either method.
- Inventory your mobile clients. Run the EAS version report above and confirm which users connect through native mail apps, Outlook mobile or neither.
- Define who needs which contacts. A regional field team may need dispatchers, managers and key vendors, not the entire GAL. Smaller, targeted contact sets are easier to keep accurate.
- Confirm device management coverage. CardDAV at scale assumes devices are enrolled in an MDM. List which devices are managed and which are not.
- Identify users without mailboxes. If frontline or contractor accounts need company contacts, ActiveSync alone cannot reach them.
- Pick one source of truth per contact set. Decide whether Microsoft 365, a CRM or another system is authoritative, and deliver each set through one path per device.
- Review data handling. A hosted CardDAV service usually keeps a copy of the directory outside your tenant. Check certifications, data residency and the permission scope it requests in Microsoft Entra ID.
- Agree on freshness. Decide how quickly a directory change must reach phones. With CardDAV, timing depends on both the service’s refresh schedule and the device’s check interval.
- Pilot and validate. Test with a small group. Confirm contacts appear in the native app, caller ID resolves names, and the account disappears when a test device is unenrolled.
Deployment notes for CardDAV
- iPhone and iPad: The Contacts payload needs the server hostname, port, username and, ideally, the principal URL and password so users are not prompted (Apple).
- Your MDM: Apple notes that each device management vendor implements these settings differently, so follow your MDM’s own documentation. Some CardDAV services, including CiraSync, provide a ready-made profile to upload as a custom configuration profile.
- Self-hosted CardDAV: Phones must reach the server from the internet, which typically means a public DNS name, a publicly trusted TLS certificate and port 443 open. The CiraSync On-Prem CardDAV guide walks through these requirements for an on-premises deployment.
- Android: Deploy the CardDAV sync app as a managed app and grant it contacts permission through policy.
Troubleshooting common contact sync problems
Most contact sync problems come from one of three layers: the source data, the sync path, or the device. Identify the layer first, then change settings.
| Symptom | Likely cause | What to check |
| Native mail app stopped syncing on Exchange Online in 2026 | ActiveSync client below version 16.1 | Run the EAS version report, update the OS or mail app, or move the user to Outlook mobile |
| A colleague is searchable in the GAL but shows only a number when calling | GAL lookup is not the same as sync | Sync the directory into mailbox contacts, or deliver it with CardDAV |
| Outlook contacts are missing from the native Contacts app | Save Contacts is off, contacts permission is denied, or an app protection policy restricts sharing with native apps | Turn on Save Contacts through app configuration, check the device’s contacts permission, and review your Intune app protection policy |
| Duplicate contacts on iPhone | Two mechanisms deliver the same records, or Outlook exports from two devices on one account | Keep one path per contact set, export from one device, and allow up to 24 hours for Outlook to reconcile |
| CardDAV profile installed but no contacts appear | Wrong hostname, principal URL or credentials, or an untrusted server certificate | Verify the payload values and add any needed certificates with a Certificates payload |
| CardDAV changes are slow to reach phones | The service’s refresh schedule or the device’s check interval | Compare the source refresh schedule with the device fetch setting |
| Android contacts missing on the CardDAV path | Sync app not installed, missing contacts permission, or background restrictions | Confirm the managed app, its permissions and its sync status |
| The EAS version report lists devices nobody uses | Stale device records | Check last sync dates with Get-MobileDeviceStatistics |
For Outlook-specific sync issues, see our Outlook not syncing fix-it guide.
How CiraSync supports both delivery paths
CiraSync supports different approaches to delivering Microsoft 365 company contacts to mobile devices. Its mailbox-based synchronization places selected company contacts into targeted users’ Microsoft 365 mailbox contact folders, where compatible mobile clients can synchronize them to devices. CiraSync Mobile Direct provides a separate CardDAV-based delivery option for supported managed-device environments. The appropriate method depends on the organization’s existing infrastructure, device types, security requirements and available CiraSync features.
Mailbox path. CiraSync syncs GAL or other source contacts into each targeted user’s Microsoft 365 mailbox Contacts folder. The phone then receives them through ActiveSync or Outlook mobile contact sync. The GAL sync guide explains this flow.
CardDAV path (Mobile Direct). Mobile Direct provides centrally managed CardDAV delivery of selected company contacts to native device contact apps, but deployment differs by platform. On iPhone and iPad, CardDAV is built into iOS, so IT can deploy the required CardDAV configuration through MDM without installing a separate contact-sync app. On Android, which does not provide the same native CardDAV support, CiraSync uses its CardDAV Direct companion app. IT deploys the app through device management, and the user opens it once to initialize synchronization; after that, contact synchronization runs automatically in the background.
Before you deploy Mobile Direct, note these points from CiraSync’s own documentation:
- Two freshness cycles. CiraSync refreshes its cache from the source on a schedule you set (daily, weekly or monthly). Each device then pulls from that cache on its own interval.
- Self-healing records. If a user edits or deletes a synced contact on the phone, the next cycle restores the authoritative record.
- No mailbox required. Users without an Exchange mailbox, such as field workers and contractors, can be targeted.
- Data location. The selected directory is cached in CiraSync Cloud, so contact data is processed outside your Microsoft 365 tenant. CiraSync states it is SOC 2 Type II certified and GDPR compliant, with audit logs and tenant-level data residency settings. Confirm these in your standard vendor review, and see Security at CiraSync.
For more platform guides, see syncing the GAL to Android devices and the Workspace ONE iOS contact sync guide.
Not sure which path fits your fleet?
Choosing between mailbox-based synchronization and CardDAV depends on your Microsoft 365 environment, device management setup and corporate contact requirements. CiraSync helps organizations keep company contacts available across supported mobile devices through its contact synchronization solutions.
Talk to a CiraSync specialist to discuss the right approach for your organization, or start a free trial to evaluate the available capabilities.
Frequently asked questions
Is ActiveSync better than CardDAV for contacts?
Neither is better in general. ActiveSync is better for syncing each user’s own mailbox, including email and calendar. CardDAV is better for pushing a shared company directory that IT controls to managed devices.
Does Microsoft 365 support CardDAV?
Not natively. Microsoft lists Exchange ActiveSync, MAPI, Outlook on the web, IMAP and POP3 as the client access methods for Exchange Online mailboxes. To deliver Microsoft 365 contacts over CardDAV, you need a separate service that reads your directory and publishes it as a CardDAV address book.
Is Exchange ActiveSync being retired in 2026?
No retirement has been announced in Microsoft’s 2026 update. The change set a minimum version: since March 1, 2026, Exchange Online blocks clients below EAS 16.1, and Microsoft confirmed full enforcement in August 2026. ActiveSync is still enabled by default on Exchange Online mailboxes.
Does Outlook for iOS and Android use ActiveSync?
No. Microsoft states that Outlook Mobile does not use the EAS protocol to connect to Exchange Online, so the 16.1 requirement does not affect it. Outlook mobile can still save mailbox contacts to the native address book through its Save Contacts setting.
Can ActiveSync sync the Global Address List to an iPhone?
Not as saved contacts. An iPhone can search the Exchange GAL when looking up a contact or addressing an email, but the GAL is not stored in the Contacts app. To get directory entries onto the phone, sync them into each user’s mailbox contacts or deliver them through CardDAV.
Does Android support CardDAV natively?
No. Android does not include a built-in CardDAV client. A sync app is needed to bring CardDAV contacts into Android’s system contacts, and on managed devices it is deployed through the MDM.
How quickly do CardDAV contacts update on a phone?
It depends on two schedules. The CardDAV service refreshes from the source on its own schedule, and the device checks the CardDAV server on its fetch interval. The base CardDAV standard does not include push notifications.
Can Microsoft Intune deploy CardDAV contacts?
Yes, as long as you have a CardDAV server. On iOS, a CardDAV account is a standard Apple Contacts payload, which an MDM can deliver in a configuration profile. CiraSync, for example, provides a ready-made profile that admins upload to Intune as a custom configuration profile.
