...
Part of the Skype external access / Mobile mobile deployment includes opening access to the internal Exchange in order to allow Skype to server so Skype can view Calendar info. This is done by a services service named EWS (Exchange Web ServiceServices).
EWS protector is designed to restrict access to the EWS services only to devices that are accessing from Skype for Business and from a managed device.
The risk handled is that someone can get access to company Exchange via EWS by only having a user name and password.
Note that some systems require access to EWS which are not from S4B . You can add some exceptions to the filter in order to bypass the EWS control
...