Turn off IMAP and POP access in Google Workspace for Australian SMEs

What does turning off IMAP and POP access do?

This setting disables the ability for email clients to connect to Google Workspace Gmail accounts using the Internet Message Access Protocol (IMAP) or Post Office Protocol (POP). It blocks these mailbox retrieval methods regardless of whether the client uses OAuth. It does not disable SMTP sending or Gmail API access, and it does not remove email already downloaded to a device.

Why disable unused IMAP and POP access?

Turning off access your business does not need reduces the number of ways an app can retrieve mailbox data. This is useful when staff already work in Gmail on the web or the official Gmail app and no approved integration needs POP or IMAP.

IMAP and POP are email protocols, not authentication methods. Both can use OAuth, so an IMAP connection is not automatically an insecure username-and-password connection. Google Workspace no longer supports ordinary username-and-password sign-in for less secure apps; disabling these protocols is a separate control, not the way to retire that sign-in method.

Keep 2-Step Verification, preferably with phishing-resistant methods such as security keys or passkeys, and review third-party app access as well. Disabling POP and IMAP does not enforce those controls or stop phishing messages reaching staff.

What risks remain when mailbox access is unnecessary?

An unnecessary mail client or integration can become another place where sensitive customer records, payroll details or invoice conversations are accessed and stored. If an attacker obtains a usable OAuth token or another permitted credential, an enabled protocol may provide a route to mailbox data. Turning off that protocol closes that route, but leaves other access methods to manage.

For an Australian SME, a mailbox compromise can lead to invoice fraud, data exposure and business disruption. It does not automatically mean a regulatory penalty or an invalid insurance policy. Privacy obligations depend on the business and incident, while insurance cover depends on the policy wording and circumstances.

How do you turn off IMAP and POP safely?

Use a pilot organisational unit before changing access for the whole business. Google's instructions for controlling POP and IMAP access explain the available settings: https://support.google.com/a/answer/105694.

An audit can review the configuration and any access exceptions.

1. Inventory mail clients, mailbox-reading integrations and users that rely on POP or IMAP.
2. Tell affected staff what will change and arrange a supported replacement for each dependency.
3. Sign in to admin.google.com with an administrator account authorised to manage Gmail settings.
4. Go to Apps > Google Workspace > Gmail > End User Access > POP and IMAP access.
5. Select the pilot organisational unit and check whether its settings are inherited.
6. Disable both POP and IMAP access for that unit, save the change and allow for propagation.
7. Test affected clients and normal Gmail access, then expand the rollout to other units without approved dependencies.

Does this Google Workspace setting need an extra licence?

For Google Workspace subscriptions that include Gmail, the POP and IMAP admin control normally needs no additional licence or paid add-on. The practical cost is staff time: identifying dependencies, helping users change clients and testing the rollout. A small business using only Gmail on the web may have fewer dependencies than one with desktop clients and mailbox-reading integrations.

Which rollout mistakes can disrupt an Australian business?

The biggest mistake is switching access off before identifying who uses it. Outlook profiles configured for IMAP or POP, older desktop clients and CRM tools that read mail through these protocols will be affected. An OAuth-enabled IMAP client still needs IMAP enabled; changing its authentication method does not bypass the block.

Do not assume every scan-to-email printer depends on POP or IMAP. Most send mail using SMTP, which this setting does not disable. Some devices use POP-before-SMTP authentication or retrieve messages, so check the actual configuration rather than treating all printers the same.

Where a business dependency remains, consider moving it to a supported alternative. If an exception is necessary, limit it to a dedicated organisational unit, use OAuth where supported, document the owner and review date, and check which additional users could inherit that access. Advise staff before the rollout and provide clear instructions for the replacement workflow.

How can you check the change worked?

Check that the saved policy applies to the test user's organisational unit, including any inheritance or overrides. Allow up to 24 hours for propagation, although changes typically apply sooner.

Use an approved test account and a client that successfully retrieved mail before the change. After propagation, start a fresh connection and confirm that new POP and IMAP retrieval is blocked. A connection error alone is not proof: expired credentials, network faults and client problems can also cause failures.

Confirm that Gmail on the web and the official Gmail app still work, and test any critical sending or mailbox integrations separately. Previously downloaded messages may remain visible in a client even after new retrieval is blocked. Keep a record of the test results and review exceptions after the rollout.

How does this fit a broader Google Workspace security audit?

Disabling unused POP and IMAP access is one part of a broader review. A Google Workspace security audit can also examine 2-Step Verification, administrator privileges, third-party OAuth access, app passwords, email authentication and Google Drive sharing. Each control addresses a different risk.

This change supports broader cybersecurity controls but alone does not establish compliance with the Privacy Act or the Notifiable Data Breaches scheme. It is also not a substitute for assessing the applicable ACSC Essential Eight requirements.

Learn what SecureMyEmail reviews in an email-security audit.