diff --git a/apps/portal/pages/admin/users.vue b/apps/portal/pages/admin/users.vue
index d1607d5..79d1705 100644
--- a/apps/portal/pages/admin/users.vue
+++ b/apps/portal/pages/admin/users.vue
@@ -768,6 +768,9 @@ async function submitCreateMailbox() {
                 <template v-if="hasMailbox">This is the member’s workspace mailbox. To add another address that delivers to the same inbox, add an alias below.</template>
                 <template v-else>This member signs in with an external address and has no inbox. Create a mailbox on your domain to give them one — and to enable aliases.</template>
               </p>
+              <p v-if="hasMailbox" class="ud-hint">
+                On iPhone and Android the mailbox can also be added as an <strong>Exchange</strong> account — mail, calendar and contacts in one go. Server <Mono>{{ mailHost }}</Mono>, username is the mailbox address. Works in the built-in mail apps (not the Outlook app); on Windows, Outlook syncs the calendar via the free CalDAV Synchronizer add-in.
+              </p>
             </div>
           </section>
 
diff --git a/apps/portal/server/api/apple-mailconfig.get.ts b/apps/portal/server/api/apple-mailconfig.get.ts
index d9350ed..771f885 100644
--- a/apps/portal/server/api/apple-mailconfig.get.ts
+++ b/apps/portal/server/api/apple-mailconfig.get.ts
@@ -1,7 +1,9 @@
 // Apple configuration profile (.mobileconfig) for one-click Mail setup on
 // macOS/iOS — the Apple answer to autodiscovery (Apple Mail ignores RFC 6186
-// SRV records, and "Microsoft Exchange" needs EWS/EAS which Stalwart doesn't
-// speak). The profile carries server settings + the address but NO password:
+// SRV records). On iOS adding the mailbox as an "Exchange" account also
+// works now (the Z-Push EAS gateway, services/zpush), but this profile stays
+// the preferred Apple path: native IMAP+DAV, no protocol translation layer.
+// The profile carries server settings + the address but NO password:
 // profiles are plaintext XML, so Apple prompts for the password on install.
 //
 // Session-gated like every portal API. The mail host comes from runtime