# Remote Access

> Baselines that control which mail-access protocols and modern-authentication settings are available to a tenant or a group.

Remote Access controls which protocols can reach a mailbox (or SharePoint and OneDrive) from outside Outlook itself, and whether the tenant requires modern, OAuth-based sign-in before any of them work. Two of its ten baselines apply tenant-wide. The other eight apply per user or Azure group, so you can switch a client off for most of a tenant while the few accounts that still need it keep working, resolved as [Groups and priority](https://docs.octiga.io/baselines/groups-and-priority/) describes.

## Why it matters

Legacy mail protocols (POP3, IMAP, MAPI, EWS) predate modern authentication, so they can't be protected by MFA or Conditional Access the way a modern sign-in can. That makes them a favourite target for password-spray attacks: more than 99 percent of the attempts Microsoft sees use these protocols, because a stolen password alone is enough. Most users in most tenants don't need them, yet they're often left on tenant-wide by default, long after the client that needed one was retired.

## How Microsoft evaluates it

Modern Authentication underpins the whole category: a single tenant-wide Exchange Online toggle that decides whether Outlook 2013 and later can sign in with OAuth instead of a plain password, which is what lets MFA and Conditional Access apply to those sign-ins at all. Each protocol baseline (ActiveSync, EWS, IMAP, MAPI, Outlook Mobile, OWA, POP3, SMTP client authentication) is a per-mailbox Exchange Online switch, so it resolves per user or Azure group rather than as one tenant-wide setting. SharePoint's own legacy-authentication setting is the exception: a single tenant-wide SharePoint Online toggle, checked separately from anything in Exchange. ([Microsoft Learn: Enable or disable POP3, IMAP, MAPI, Outlook Web App or Exchange ActiveSync](https://learn.microsoft.com/troubleshoot/exchange/user-and-shared-mailboxes/pop3-imap-owa-activesync-office-365))

## What end users experience

Most of these changes go unnoticed until the client they govern tries to connect. Disabling IMAP, POP3 or MAPI stops whichever desktop or third-party mail client relied on it, with a generic authentication error rather than an explanation. Disabling ActiveSync or Outlook Mobile stops a phone's native mail app syncing. Disabling OWA blocks webmail in the browser, so anyone who used it moves to a desktop or mobile client. Turning on Modern Authentication breaks nothing, but Outlook 2013 and later users are asked to sign in again the next time they open it, on a visibly different, modern sign-in screen. SharePoint's legacy-authentication setting works the same way: nothing changes for anyone on a current browser or the SharePoint and OneDrive apps, but an old client gets an access-denied error the next time it tries.

| Baseline                                                                                                         | Scope  | Licence           |
| ---------------------------------------------------------------------------------------------------------------- | ------ | ----------------- |
| [ActiveSync Access](https://docs.octiga.io/baselines/remote-access/active-sync-enabled/)                         | Group  | —                 |
| [EWS Access](https://docs.octiga.io/baselines/remote-access/ews-enabled/)                                        | Group  | —                 |
| [IMAP Access](https://docs.octiga.io/baselines/remote-access/imap-enabled/)                                      | Group  | —                 |
| [MAPI Access](https://docs.octiga.io/baselines/remote-access/mapi-enabled/)                                      | Group  | —                 |
| [Modern Authentication](https://docs.octiga.io/baselines/remote-access/org-modern-auth/)                         | Tenant | —                 |
| [Outlook Mobile Access](https://docs.octiga.io/baselines/remote-access/outlook-mobile-enabled/)                  | Group  | —                 |
| [OWA Access](https://docs.octiga.io/baselines/remote-access/owa-enabled/)                                        | Group  | —                 |
| [POP3 Access](https://docs.octiga.io/baselines/remote-access/pop3enabled/)                                       | Group  | —                 |
| [SharePoint Modern Auth Enforced](https://docs.octiga.io/baselines/remote-access/legacy-auth-protocols-enabled/) | Tenant | SharePoint Online |
| [SMTP Client Authentication](https://docs.octiga.io/baselines/remote-access/smtp-client-auth-disabled/)          | Group  | —                 |