Windows Phone 7.5 ships with version 14.1 of the Exchange ActiveSync (EAS) protocol and supports synchronisation of email, calendar, task and contact information with Exchange 2003 SP2 and later, or Office 365.

Exchange ActiveSync also provides the ability to manage Windows Phone through the use of security-related policies that are configured by the IT department, called Exchange ActiveSync Mailbox Policy. Items that can be configured include:

• Password Required - requires the user to set a device-locking numeric PIN or password before the phone starts synchronising with Exchange.
• Complex Password Required - requires the user to define a complex (alphanumeric) device-locking password.
• Password Complexity - can be used to specify the degree of password complexity.
• Password Expiration - sets the validity period of a password, after which the password has to be renewed.
• Password History - prevents the user from re-using the same password repeatedly.
• Allow Simple Password - can be used to allow or prevent the user from using a simple password or PIN, such as 1111.
• Minimum Password Length - sets the minimal number of characters in the password.
• Idle Timeout Frequency Type - defines the time before a phone locks when not in use.
• Device Wipe Threshold - defines the number of times a wrong device PIN or password can be used before the phone wipes (erases its data) and resets.

IT administrators can also initiate a remote wipe of a Windows Phone device from the Exchange Management Console, or via Outlook Web Access.
In addition users can locate a lost phone, map its location, make it ring and wipe its data if necessary when they have registered the phone with windowsphone.live.com

Removable Storage

On devices that are fitted with an SD card slot, as a security measure, removing the SD card will reset the phone and wipe all user data on the internal phone memory unless the same SD card is reinserted. Inserting a different SD card will wipe the phone and reinitialise it using the new card.
SD cards are automatically access-locked using a 128-bit key that pairs the SD card to the phone.

Transport Security

All data is synchronised with Microsoft Exchange is secured using a SSL connection. No synchronisation of data, files or email is possible via a USB connection. The Microsoft Zune software can be used to transfer media such as photos, videos and music.

Information Rights Management

Information Rights Management (IRM) allows content creators to assign rights to documents they send to others. IRM-protected documents can only be viewed by authorised users. Further rights can be defined specifying whether the contents of the document can be edited, copied or printed.
Rights can also be applied to email messages specifying whether the mail can be sent outside of the organisation.
Windows Phone fully supports Information Rights Management-protected documents and email.