Office 365 – disable POP and IMAP access for (all) users

By default all users in Office 365 (Exchange Online) have POP and IMAP access enabled. This is not always required/desired but there is no simple method of turning it off (by which I mean a global check box in the Exchange Admin Center).

You can enable/disable protocols for existing users in the EAC by going into Recipients | Mailboxes, selecting the user(s) in question and then clicking Disable (or Enable!) for each protocol on the Bulk Edit pane.

However, any subsequent new users will have these protocols enabled so you would need to remember to disable each time. Alternatively a bit of Powershell script can set the default to be disabled.

First, connect to Exchange Online via Powershell, then run the following commands.

1. Identify the MailboxPlan in use: Get-MailboxPlan | Select Name,IsDefault

2. Check your CASMailboxPlan uses the same GUID: Get-CASMailboxPlan | fl Name
3. Now disable the protocol(s), for example: set-CASMailboxPlan ExchangeOnlineEnterprise-45a3b999-4f2a-4186-8eea-b192c9822424 -PopEnabled:$false -ImapEnabled:$false

As an aside, you can also check the current protocol status for a user via: Get-CASMailbox user@domain.com, and alter the status by using, for example, Set-CASMailbox user@domain.com -PopEnabled:$false