How to turn off POP and IMAP for new mailboxes

What this check looks at

Checks Exchange Online’s mailbox plans for whether new mailboxes are created with POP and IMAP turned on.

POP3 and IMAP4 are older mail protocols that let a mail client download or sync a mailbox. They support none of Outlook’s features and they are a route to mailbox data that sits outside Outlook’s own protections, such as app protection policies. Exchange Online gives each new mailbox the POP and IMAP settings of its mailbox plan, and by default both are on.

This check reads the Exchange Online mailbox plans (CAS mailbox plans), which set the client access defaults for new mailboxes. This check only warns, never fails: it raises a warning when any mailbox plan gives new mailboxes POP or IMAP. It does not look at existing mailboxes.

With POP and IMAP on by default, every new mailbox can be synced in full to any third-party mail app or script that its user, or an attacker with their credentials, chooses. Copies end up in personal mail apps outside the organisation’s control, and attackers use IMAP to download a whole mailbox quickly after a compromise.

Why it matters

POP and IMAP are rarely needed and are a route to mailbox data that bypasses Outlook’s protections. Turning them off for new mailboxes means nobody gets them by default; those who need them are given them deliberately.

After a phishing compromise at a 40-person firm, the attacker uses IMAP with the stolen credentials to download the operations director’s entire mailbox, ten years of mail, in under an hour. The firm has to treat everything in it as exposed. With IMAP off for that mailbox, the attacker would have been limited to reading mail in the browser, slowly and visibly.

Hardly anyone in a Microsoft 365 organisation needs POP or IMAP. Turning them off for new mailboxes, and for existing ones that do not use them, closes the route with no effect on Outlook users; the few who need them can be given them deliberately.

CIS Controls v8 safeguard 4.8 (uninstall or disable unnecessary services), ISO 27001 A.8.9 (configuration management), the NCSC 10 Steps architecture and configuration guidance and the NCSC CAF secure configuration outcome expect unused protocols to be turned off.

How to fix it

Before you start

• Check the sign-in logs for POP and IMAP clients, and whether any new mailbox type (shared helpdesk, scanner) needs them.

Step by step

1. 1Check who uses POP or IMAP. In the Microsoft Entra admin centre, Entra ID > Monitoring & health > Sign-in logs, filter Client app on POP and IMAP for the last 30 days. Note any mailboxes that genuinely need them, such as a helpdesk tool or a scanner app.
2. 2Turn them off in every mailbox plan. Connect to Exchange Online PowerShell and run Get-CASMailboxPlan | Set-CASMailboxPlan -PopEnabled $false -ImapEnabled $false. Mailboxes created from now on start with both off.
3. 3Turn them off on existing mailboxes. List existing mailboxes with either on: Get-CASMailbox -ResultSize Unlimited | Where-Object { $_.PopEnabled -or $_.ImapEnabled } | Select-Object Name, PopEnabled, ImapEnabled. For each that does not need them, run Set-CASMailbox -Identity <mailbox> -PopEnabled $false -ImapEnabled $false.
4. 4Allow them only where needed. For the mailboxes from the first step that need a protocol, turn just that one back on (for example Set-CASMailbox -Identity <mailbox> -ImapEnabled $true) and record why. In the Exchange admin centre the same switches are under Recipients > Mailboxes > the mailbox > Manage email apps settings.
5. 5Confirm the mailbox plans. Run Get-CASMailboxPlan | Format-Table Name, PopEnabled, ImapEnabled and check both are False for every plan. The warning clears at the next assessment.

With PowerShell

Get-CASMailboxPlan | Set-CASMailboxPlan -PopEnabled $false -ImapEnabled $false

What users will notice

None for Outlook users. Mail apps using POP or IMAP cannot connect to mailboxes created from now on.

How to confirm it worked

Get-CASMailboxPlan shows PopEnabled and ImapEnabled as False for every plan.

Frameworks and controls

This check maps to controls in 13 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.

The framework mappings were last checked against the published standards in October 2026.

Microsoft’s documentation

• Enable or disable POP3 or IMAP4 access (Microsoft Learn)

Related checks

• The SPF record for Microsoft 365, and how to check it
• How to set up and enforce DMARC for Microsoft 365
• How to block automatic email forwarding in Microsoft 365
• How to block sign-in to shared mailboxes

The full Microsoft 365 security checklist, worst first