# POP3 Access

> Enable POP3 access to mailbox.

Enable POP3 access to mailbox. POP3 is considered an unsafe legacy protocol.

[Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/) — Add, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme.

## Configure it

This baseline applies per user, through a user-level scheme or an Azure group, rather than to
the tenant as a whole.

1. Add it directly to a user or an Azure group ([Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/)), or
   bundle it into a user-level scheme and deploy that to many users or groups at once
   ([Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)). See [Groups and priority](https://docs.octiga.io/baselines/groups-and-priority/) for how
   Octiga resolves which value a user gets when a Direct value, a scheme and a group all
   supply one.
2. Leave **POP3 access** set to Off; it's the only setting on this baseline. POP3 is an
   older mail-client protocol that doesn't support modern authentication well, and
   Octiga treats it as an unsafe legacy protocol, like IMAP.
3. Before turning this off for a user, check whether they still use a POP3-configured
   mail client. POP3 clients also need Authenticated SMTP switched on to send mail,
   which is a separate baseline.
4. Save. Turn on **Auto-remediation** and Octiga switches POP3 access back off automatically
   if it's re-enabled for a user it applies to.

> **Caution:** Anyone still using a POP3-configured mail client loses the ability to receive mail
> through it as soon as this applies. Confirm nothing still depends on POP3 for that user
> before you enforce it.

## Check it worked

Passing means the mailbox's POP3 access reports as disabled. Check it in the Exchange
admin centre under **Recipients → Mailboxes** → the user → **Manage email apps settings**,
where it appears as "POP3". On the user roster or a group's member list, Passing shows as
a green dot for this baseline; Deviated (red) means POP3 is currently on; Excluded (grey)
means the user or tenant isn't licensed for Exchange Online. A user who was relying on a
POP3 client stops receiving mail through it and needs to switch to Outlook, Outlook on the
web or another supported app.

**Doing this for every tenant?** Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time. [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)