# IMAP Access

> Enable IMAP access to mailbox.

Enable IMAP access to mailbox. IMAP is considered an unsafe legacy protocol.

[Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/) — Add, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme.

## Configure it

This baseline applies per user, through a user-level scheme or an Azure group, rather than to
the tenant as a whole.

1. Add it directly to a user or an Azure group ([Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/)), or
   bundle it into a user-level scheme and deploy that to many users or groups at once
   ([Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)). See [Groups and priority](https://docs.octiga.io/baselines/groups-and-priority/) for how
   Octiga resolves which value a user gets when a Direct value, a scheme and a group all
   supply one.
2. Leave **IMAP access** set to Off; it's the only setting on this baseline. IMAP is an
   older mail-client protocol that doesn't support modern authentication well, and
   Octiga treats it as an unsafe legacy protocol, like POP3.
3. Before turning this off for a user, check whether they still use an IMAP-configured
   mail client. Some phone mail apps and desktop clients default to IMAP rather than
   Exchange ActiveSync or MAPI. IMAP clients also need Authenticated SMTP switched on to
   send mail, which is a separate baseline.
4. Save. Turn on **Auto-remediation** and Octiga switches IMAP access back off automatically
   if it's re-enabled for a user it applies to.

> **Caution:** Anyone still using an IMAP-configured mail client loses the ability to receive mail
> through it as soon as this applies. Confirm nothing still depends on IMAP for that user
> before you enforce it.

## Check it worked

Passing means the mailbox's IMAP access reports as disabled. Check it in the Exchange
admin centre under **Recipients → Mailboxes** → the user → **Manage email apps settings**,
where it appears as "IMAP". On the user roster or a group's member list, Passing shows as
a green dot for this baseline; Deviated (red) means IMAP is currently on; Excluded (grey)
means the user or tenant isn't licensed for Exchange Online. A user who was relying on an
IMAP client stops receiving mail through it and needs to switch to Outlook, Outlook on the
web or another supported app.

**Doing this for every tenant?** Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time. [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)