IMAP Access
Enable IMAP access to mailbox. IMAP is considered an unsafe legacy protocol.
Adding a baselineConfigure it
This baseline applies per user, through a user-level scheme or an Azure group, rather than to the tenant as a whole.
-
Add it directly to a user or an Azure group (Adding a baseline), or bundle it into a user-level scheme and deploy that to many users or groups at once (Deploying a scheme). See Groups and priority for how Octiga resolves which value a user gets when a Direct value, a scheme and a group all supply one.
-
Leave IMAP access set to Off; it’s the only setting on this baseline. IMAP is an older mail-client protocol that doesn’t support modern authentication well, and Octiga treats it as an unsafe legacy protocol, like POP3.
-
Before turning this off for a user, check whether they still use an IMAP-configured mail client. Some phone mail apps and desktop clients default to IMAP rather than Exchange ActiveSync or MAPI. IMAP clients also need Authenticated SMTP switched on to send mail, which is a separate baseline.
-
Save. Turn on Auto-remediation and Octiga switches IMAP access back off automatically if it’s re-enabled for a user it applies to.
Check it worked
Passing means the mailbox’s IMAP access reports as disabled. Check it in the Exchange admin centre under Recipients → Mailboxes → the user → Manage email apps settings, where it appears as “IMAP”. On the user roster or a group’s member list, Passing shows as a green dot for this baseline; Deviated (red) means IMAP is currently on; Excluded (grey) means the user or tenant isn’t licensed for Exchange Online. A user who was relying on an IMAP client stops receiving mail through it and needs to switch to Outlook, Outlook on the web or another supported app.
Doing this for every tenant?
Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time.