{"id":4315,"date":"2022-08-24T07:12:41","date_gmt":"2022-08-24T14:12:41","guid":{"rendered":"https:\/\/SUMMALAI.COM\/?p=4315"},"modified":"2022-08-24T07:12:43","modified_gmt":"2022-08-24T14:12:43","slug":"how-to-disable-pop-and-imap-for-all-mailboxes-in-office-365","status":"publish","type":"post","link":"https:\/\/SUMMALAI.COM\/?p=4315","title":{"rendered":"How to Disable POP and IMAP for All Mailboxes in Office 365"},"content":{"rendered":"
\n
\"Disable<\/figure><\/div>\n\n\n

First of all, why disable IMAP or POP? Two reasons:<\/p>\n\n\n\n

  1. IMAP and POP are less secure mail protocols that are now around 30 years old.<\/li>
  2. In our experience, IMAP and POP is seldom used for legitimate purposes. In almost every breach we\u2019ve discovered, the attackers have used IMAP or POP protocols to download user mailboxes to another device.<\/li><\/ol>\n\n\n\n

    If you\u2019re looking for instances of unauthorised IMAP or POP access in your mailboxes, I recommend you also run this script<\/a>. Typically hackers will log into user mailboxes from an unexpected location. This script runs each IP address used to login to your tenant against an IP locator API. It then exports a list of unique IP addresses, their location and the user agent of the device that was logging in. The IMAP entries will usually display in the list with a user agent of CBAInProd.<\/p>\n\n\n

    \n
    \"Hacker<\/figure><\/div>\n\n\n

    In the above record from the Office 365 Unified Audit Log, an unauthorized user is accessing an account from an IP located in China.<\/p>\n\n\n

    \n
    \"Hacker<\/figure><\/div>\n\n\n

    You can confirm this by searching the Unified Audit Log for \u2018MailboxLogin\u2019 Operations, then filtering by that IP address.<\/p>\n\n\n

    \n
    \"Hacker<\/figure><\/div>\n\n\n

    In order to prevent attackers from downloading all of your user data in this way, you can disable IMAP and POP for all users via PowerShell.<\/p>\n\n\n\n

    There are two parts to this \u2013 you\u2019ll want to disable it for all existing mailboxes as well as all future mailboxes.<\/p>\n\n\n\n

    If you already have a connection to Exchange Online via PowerShell, you can copy and paste the following cmdlets, otherwise you can use the scripts further down.<\/p>\n\n\n\n

    Disabling IMAP and POP for all future mailboxes<\/h3>\n\n\n\n
    1<\/td>Get-CASMailboxPlan<\/code>-Filter<\/code>{ImapEnabled <\/code>-eq<\/code>\"true\"<\/code>-or<\/code>PopEnabled <\/code>-eq<\/code>\"true\"<\/code>} | <\/code>set-CASMailboxPlan<\/code>-ImapEnabled<\/code>$false<\/code>-PopEnabled<\/code>$false<\/code><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

    Disabling IMAP and POP for all existing mailboxes<\/h3>\n\n\n\n
    1<\/td>Get-CASMailbox<\/code>-Filter<\/code>{ImapEnabled <\/code>-eq<\/code>\"true\"<\/code>-or<\/code>PopEnabled <\/code>-eq<\/code>\"true\"<\/code>} | <\/code>Select-Object<\/code>@{n = <\/code>\"Identity\"<\/code>; e = {<\/code>$_<\/code>.primarysmtpaddress}} | <\/code>Set-CASMailbox<\/code>-ImapEnabled<\/code>$false<\/code>-PopEnabled<\/code>$false<\/code><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

    The following scripts will take care of the whole operation for you. The first one will disable POP and IMAP for a single Office 365 tenant. The second script is for Microsoft Partners and will disable IMAP and POP for all mailboxes in all customer tenants. Note that these scripts do not work with MFA on the admin account.<\/p>\n\n\n\n

    How to run these scripts to disable IMAP and POP in Office 365 via PowerShell<\/h2>\n\n\n\n
    1. Double click on either of the scripts below to select it all<\/li>
    2. Copy and paste it into Visual Studio Code and save it as a .ps1 file<\/li>
    3. To allow these scripts to work with an MFA enabled account, you may need to whitelist your current static IP for MFA<\/a>.<\/li>
    4. Run it by pressing F5<\/li>
    5. Enter the credentials of an Office 365 global admin, Exchange admin or delegated administrator<\/li>
    6. Wait for the script to complete. If you\u2019re running this across a number of tenants, you\u2019ll probably be waiting a while.<\/li><\/ol>\n\n\n\n

      How to disable IMAP and POP in a single Office 365 tenant via PowerShell<\/h2>\n\n\n\n
      12345678910111213141516171819202122232425<\/td>$credential<\/code>= <\/code>Get-Credential<\/code>$Session<\/code>= <\/code>New-PSSession<\/code>-ConnectionUri<\/code>https:\/\/outlook.office365.com\/powershell-liveid\/<\/a> `<\/code>    <\/code>-ConfigurationName<\/code>Microsoft.Exchange<\/code>-Credential<\/code>$credential<\/code>`<\/code>    <\/code>-Authentication<\/code>Basic<\/code>-AllowRedirection<\/code>Import-PSSession<\/code>$Session<\/code>-CommandName<\/code>Get-CASMailbox<\/code>, <\/code>Set-CasMailbox<\/code>, <\/code>Get-Casmailboxplan<\/code>, <\/code>set-casmailboxplan<\/code>, <\/code>Get-OrganizationConfig<\/code>Write-Host<\/code>\"Attempting IMAP and POP operations on $((Get-OrganizationConfig).DisplayName)\"<\/code>-ForegroundColor<\/code>Yellow<\/code>    <\/code>Write-Host<\/code>\"Disabling IMAP and POP for future mailboxes\"<\/code>-ForegroundColor<\/code>DarkYellow<\/code>Get-CASMailboxPlan<\/code>-Filter<\/code>{ImapEnabled <\/code>-eq<\/code>\"true\"<\/code>-or<\/code>PopEnabled <\/code>-eq<\/code>\"true\"<\/code>} | <\/code>set-CASMailboxPlan<\/code>-ImapEnabled<\/code>$false<\/code>-PopEnabled<\/code>$false<\/code>$confirmPlans<\/code>= <\/code>Get-CASMailboxPlan<\/code>-Filter<\/code>{ImapEnabled <\/code>-eq<\/code>\"true\"<\/code>-or<\/code>PopEnabled <\/code>-eq<\/code>\"true\"<\/code>}<\/code>if<\/code>(!<\/code>$confirmPlans<\/code>) {<\/code>    <\/code>Write-Host<\/code>\"IMAP and POP disabled for all future mailboxes\"<\/code>-ForegroundColor<\/code>Green<\/code>}<\/code>else<\/code>{<\/code>    <\/code>Write-Host<\/code>\"IMAP and POP not disabled for all existing mailboxes\"<\/code>-ForegroundColor<\/code>Red<\/code>}<\/code>Write-Host<\/code>\"Disabling IMAP and POP on all existing mailboxes\"<\/code>-ForegroundColor<\/code>DarkYellow<\/code>Get-CASMailbox<\/code>-Filter<\/code>{ImapEnabled <\/code>-eq<\/code>\"true\"<\/code>-or<\/code>PopEnabled <\/code>-eq<\/code>\"true\"<\/code>} | <\/code>Select-Object<\/code>@{n = <\/code>\"Identity\"<\/code>; e = {<\/code>$_<\/code>.primarysmtpaddress}} | <\/code>Set-CASMailbox<\/code>-ImapEnabled<\/code>$false<\/code>-PopEnabled<\/code>$false<\/code>$confirmMailboxes<\/code>= <\/code>Get-CASMailbox<\/code>-Filter<\/code>{ImapEnabled <\/code>-eq<\/code>\"true\"<\/code>-or<\/code>PopEnabled <\/code>-eq<\/code>\"true\"<\/code>}<\/code>if<\/code>(!<\/code>$confirmMailboxes<\/code>) {<\/code>    <\/code>Write-Host<\/code>\"IMAP and POP disabled on all existing mailboxes`n\"<\/code>-ForegroundColor<\/code>Green<\/code>}<\/code>    <\/code>Remove-PSSession<\/code>$Session<\/code><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

      How to disable IMAP and POP in all customer Office 365 tenants via PowerShell<\/h2>\n\n\n\n
      1234567891011121314151617181920212223242526272829303132<\/td>$credential= Get-CredentialConnect-MsolService-Credential$credential$customers= Get-MsolPartnerContract-Allforeach($customerin$customers) {\u00a0\u00a0\u00a0\u00a0Write-Host\"Attempting IMAP and POP operations on $($customer.name)\"-ForegroundColorYellow\u00a0\u00a0\u00a0\u00a0$InitialDomain= Get-MsolDomain-TenantId$customer.TenantId | Where-Object{$_.IsInitial}\u00a0\u00a0\u00a0\u00a0$DelegatedOrgURL= \"https:\/\/outlook.office365.com\/powershell-liveid?DelegatedOrg=<\/a>\"+ $InitialDomain.Name\u00a0\u00a0\u00a0\u00a0$EXODS= New-PSSession-ConnectionUri$DelegatedOrgURL-Credential$credential-AuthenticationBasic-ConfigurationNameMicrosoft.Exchange-AllowRedirection\u00a0\u00a0\u00a0\u00a0Import-PSSession$EXODS-CommandNameGet-CASMailbox, Set-CasMailbox, Get-Casmailboxplan, set-casmailboxplan\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Write-Host\"Disabling IMAP and POP for future mailboxes\"-ForegroundColorDarkYellow\u00a0\u00a0\u00a0\u00a0Get-CASMailboxPlan-Filter{ImapEnabled -eq\"true\"-orPopEnabled -eq\"true\"} | set-CASMailboxPlan-ImapEnabled$false-PopEnabled$false\u00a0\u00a0\u00a0\u00a0$confirmPlans= Get-CASMailboxPlan-Filter{ImapEnabled -eq\"true\"-orPopEnabled -eq\"true\"}\u00a0\u00a0\u00a0\u00a0if(!$confirmPlans) {\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Write-Host\"IMAP and POP disabled for all future mailboxes\"-ForegroundColorGreen\u00a0\u00a0\u00a0\u00a0}\u00a0\u00a0\u00a0\u00a0else{\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Write-Host\"IMAP and POP not disabled for all existing mailboxes\"-ForegroundColorRed\u00a0\u00a0\u00a0\u00a0}\u00a0\u00a0\u00a0\u00a0Write-Host\"Disabling IMAP and POP on all existing mailboxes\"-ForegroundColorDarkYellow\u00a0\u00a0\u00a0\u00a0Get-CASMailbox-Filter{ImapEnabled -eq\"true\"-orPopEnabled -eq\"true\"} | Select-Object@{n = \"Identity\"; e = {$_.primarysmtpaddress}} | Set-CASMailbox-ImapEnabled$false-PopEnabled$false\u00a0\u00a0\u00a0\u00a0$confirmMailboxes= Get-CASMailbox-Filter{ImapEnabled -eq\"true\"-orPopEnabled -eq\"true\"}\u00a0\u00a0\u00a0\u00a0if(!$confirmMailboxes) {\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Write-Host\"IMAP and POP disabled on all existing mailboxes`n\"-ForegroundColorGreen\u00a0\u00a0\u00a0\u00a0}\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Remove-PSSession$EXODS}<\/code>
      <\/td><\/tr><\/tbody><\/table><\/figure>\n","protected":false},"excerpt":{"rendered":"

      First of all, why disable IMAP or POP? Two reasons: IMAP and POP are less secure mail protocols that are now around 30 years old. In our experience, IMAP and POP is seldom used for legitimate purposes. In almost every breach we\u2019ve discovered, the attackers have used IMAP or POP protocols to download user mailboxes Read More<\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_bbp_topic_count":0,"_bbp_reply_count":0,"_bbp_total_topic_count":0,"_bbp_total_reply_count":0,"_bbp_voice_count":0,"_bbp_anonymous_reply_count":0,"_bbp_topic_count_hidden":0,"_bbp_reply_count_hidden":0,"_bbp_total_topic_count_hidden":0,"_bbp_total_reply_count_hidden":0,"_bbp_forum_subforum_count":0,"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[1230,10,18],"tags":[1288],"class_list":["post-4315","post","type-post","status-publish","format-standard","hentry","category-exchange","category-microsoft","category-microsoft-office","tag-disable-pop-and-imap-for-all-mailboxes-in-office-365"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\t