Remote Access
Remote Access controls which protocols can reach a mailbox (or SharePoint and OneDrive) from outside Outlook itself, and whether the tenant requires modern, OAuth-based sign-in before any of them work. Two of its ten baselines apply tenant-wide. The other eight apply per user or Azure group, so you can switch a client off for most of a tenant while the few accounts that still need it keep working, resolved as Groups and priority describes.
Why it matters
Legacy mail protocols (POP3, IMAP, MAPI, EWS) predate modern authentication, so they can’t be protected by MFA or Conditional Access the way a modern sign-in can. That makes them a favourite target for password-spray attacks: more than 99 percent of the attempts Microsoft sees use these protocols, because a stolen password alone is enough. Most users in most tenants don’t need them, yet they’re often left on tenant-wide by default, long after the client that needed one was retired.
How Microsoft evaluates it
Modern Authentication underpins the whole category: a single tenant-wide Exchange Online toggle that decides whether Outlook 2013 and later can sign in with OAuth instead of a plain password, which is what lets MFA and Conditional Access apply to those sign-ins at all. Each protocol baseline (ActiveSync, EWS, IMAP, MAPI, Outlook Mobile, OWA, POP3, SMTP client authentication) is a per-mailbox Exchange Online switch, so it resolves per user or Azure group rather than as one tenant-wide setting. SharePoint’s own legacy-authentication setting is the exception: a single tenant-wide SharePoint Online toggle, checked separately from anything in Exchange. (Microsoft Learn: Enable or disable POP3, IMAP, MAPI, Outlook Web App or Exchange ActiveSync)
What end users experience
Most of these changes go unnoticed until the client they govern tries to connect. Disabling IMAP, POP3 or MAPI stops whichever desktop or third-party mail client relied on it, with a generic authentication error rather than an explanation. Disabling ActiveSync or Outlook Mobile stops a phone’s native mail app syncing. Disabling OWA blocks webmail in the browser, so anyone who used it moves to a desktop or mobile client. Turning on Modern Authentication breaks nothing, but Outlook 2013 and later users are asked to sign in again the next time they open it, on a visibly different, modern sign-in screen. SharePoint’s legacy-authentication setting works the same way: nothing changes for anyone on a current browser or the SharePoint and OneDrive apps, but an old client gets an access-denied error the next time it tries.
| Baseline | Scope | Licence |
|---|---|---|
| ActiveSync Access | Group | — |
| EWS Access | Group | — |
| IMAP Access | Group | — |
| MAPI Access | Group | — |
| Modern Authentication | Tenant | — |
| Outlook Mobile Access | Group | — |
| OWA Access | Group | — |
| POP3 Access | Group | — |
| SharePoint Modern Auth Enforced | Tenant | SharePoint Online |
| SMTP Client Authentication | Group | — |