Exchange Online: SMTP AUTH, POP and IMAP, the legacy protocols still left open
Many administrators believe legacy protocols are a solved problem since Microsoft retired basic authentication for most Exchange Online protocols. Yet SMTP AUTH, POP and IMAP are frequently still enabled on every mailbox, with nobody using them.
Where basic authentication stands
Microsoft has disabled basic authentication for most Exchange Online protocols (EWS, ActiveSync, POP, IMAP, remote PowerShell). SMTP AUTH was handled separately, with a retirement schedule that has been announced and adjusted several times. Check Microsoft's official communication for the exact status in your tenant, and do not treat the topic as closed.
More importantly, the end of basic authentication does not mean the end of the protocols: POP, IMAP and SMTP AUTH still work with OAuth. A protocol that is enabled but unused remains attack surface, notably for password spraying and for clients that escape some controls.
SMTP AUTH: a two-level setting
Authenticated SMTP submission (port 587) is controlled at the organisation level and can be overridden per mailbox. Best practice is to disable it globally, then allow it only for the few accounts that need it.
Set-TransportConfig -SmtpClientAuthenticationDisabled $true
Set-CASMailbox -Identity scanner@contoso.com -SmtpClientAuthenticationDisabled $false
Get-CASMailbox -ResultSize Unlimited | Where-Object { $_.SmtpClientAuthenticationDisabled -eq $false }
Note: an empty value at mailbox level means the organisation setting applies.
POP and IMAP per mailbox
POP and IMAP are enabled by default on new mailboxes. Disable them with Set-CASMailbox, and also update mailbox plans (Set-CASMailboxPlan) so that future mailboxes are created with these protocols closed.
Get-CASMailbox -ResultSize Unlimited | Set-CASMailbox -PopEnabled $false -ImapEnabled $false Get-CASMailboxPlan | Set-CASMailboxPlan -PopEnabled $false -ImapEnabled $false
Authentication policies and Conditional Access
Exchange Online authentication policies can block basic authentication per protocol and per user. They matter less since basic authentication was retired, but remain relevant as long as SMTP AUTH relies on it. In addition, a Conditional Access policy blocking "other clients" (legacy authentication) covers the whole tenant and gives visibility in sign-in logs.
Printers, scanners and apps: better alternatives
The most common reason for leaving SMTP AUTH open is a copier or a line-of-business application. The alternatives:
- SMTP relay through an inbound connector, restricted by public IP address or certificate.
- Microsoft Graph (send mail) for applications, with an app registration whose access is scoped to the sending mailbox only.
- A local relay that authenticates with OAuth or through a connector for the oldest devices.
Direct Send, often used by default, requires no authentication and can be abused to spoof internal addresses: it deserves to be assessed, or even restricted, rather than kept out of convenience.
Method. Before closing anything, check usage reports and sign-in logs to identify accounts that actually use SMTP AUTH, POP or IMAP. You will know whom to warn and which devices to migrate.
What an audit checks
- SMTP AUTH status at organisation level and per-mailbox exceptions.
- The number of mailboxes with POP or IMAP enabled, and mailbox plans.
- Whether a Conditional Access policy blocks legacy authentication.
- Relay connectors and their restrictions.