Back to Checks
googleworkspace

POP and IMAP access is disabled for all users

gmail_pop_imap_access_disabled
Service: gmailSeverity: medium
OfficialBuilt-inVerified
Categories:email-security
Resource Type:NotDefined

POP and IMAP allow users to access Gmail through legacy or third-party email clients that may not support modern authentication mechanisms such as multifactor authentication. Disabling these protocols forces users to access email through approved clients only.

Prowler logoProwlerprowler-provider-googleworkspace

Risk

With POP and IMAP enabled, users can access email through legacy clients that rely on simple password authentication, bypassing multifactor authentication and other modern security controls. This significantly increases the risk of credential-based account compromise.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler googleworkspace --checks gmail_pop_imap_access_disabled

Recommendation

Disable both POP and IMAP access to prevent users from using legacy email clients that bypass modern authentication controls.

Remediation

Other

1Sign in to the Google **Admin console** at https://admin.google.com
2Navigate to **Apps** > **Google Workspace** > **Gmail**
3Click **End User Access** > **POP and IMAP Access**
4Uncheck **Enable IMAP access for all users**
5Uncheck **Enable POP access for all users**
6Click **Save**

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportGoogleWorkspace
from prowler.providers.googleworkspace.services.gmail.gmail_client import gmail_client


class gmail_pop_imap_access_disabled(Check):
    """Check that POP and IMAP access is disabled for all users.

    This check verifies that the domain-level Gmail policy disables both
    POP and IMAP access, preventing users from accessing email through
    legacy clients that may not support modern authentication.
    """

    def execute(self) -> List[CheckReportGoogleWorkspace]:
        findings = []

        if gmail_client.policies_fetched:
            report = CheckReportGoogleWorkspace(
                metadata=self.metadata(),
                resource=gmail_client.policies,
                resource_id="gmailPolicies",
                resource_name="Gmail Policies",
                customer_id=gmail_client.provider.identity.customer_id,
            )

            pop_enabled = gmail_client.policies.enable_pop_access
            imap_enabled = gmail_client.policies.enable_imap_access

            if pop_enabled is False and imap_enabled is False:
                report.status = "PASS"
                report.status_extended = (
                    f"POP and IMAP access are both disabled "
                    f"in domain {gmail_client.provider.identity.domain}."
                )
            else:
                report.status = "FAIL"
                enabled_protocols = []
                not_configured = []

                if pop_enabled is True:
                    enabled_protocols.append("POP")
                elif pop_enabled is None:
                    not_configured.append("POP")

                if imap_enabled is True:
                    enabled_protocols.append("IMAP")
                elif imap_enabled is None:
                    not_configured.append("IMAP")

                details = []
                if enabled_protocols:
                    details.append(
                        f"{' and '.join(enabled_protocols)} access is enabled"
                    )
                if not_configured:
                    details.append(
                        f"{' and '.join(not_configured)} access is not explicitly configured"
                    )

                report.status_extended = (
                    f"{'; '.join(details)} "
                    f"in domain {gmail_client.provider.identity.domain}. "
                    f"Both POP and IMAP access should be disabled to prevent use of "
                    f"legacy email clients."
                )

            findings.append(report)

        return findings

References