imap.rip

Even though the imap protocoll is a widely used standard, it is outdated, insecure, and inflexible. It has been good for it’s time when everyone hosted their own mail servers. With everyone moving to hosted cloud solutions like Gmail and Microsoft M365 / Outlook we should move towards their advanced API’s to access emails hosted on their services.

This is especially usefull and important for service providers that access an employees emails in display them in a separate interface. CRM’s, Task or Project Managers, and Service Desks are the primary culprits of only allowing for imap access. However these tools often also allow for SSO via Google or Microsoft and thus should directly use their API’s to access emails in an employees inbox.

We don’t ask you to. We ask you to support the two biggest API’s on the market.

This is a sign that your application does not fit basic security measures arount corporate data security and privacy. You may want to really look at your security practices here.

For one, many administrators have turned it off by default. Why? Because we can’t controll where emails end up. We don’t have controll over them in a secure and save manner. Allowing imap means that our employees may sign into our emails on insecure devices and download customer data to their personal, insecure devices. We don’t want to lose controll over those personal emails. That’s why we are turning imap off. Additionally imap has been proven insecure in transit and thus we like to have it turened off.

API access allows us as admins to monitor and allow list specific applications and add-ons while also being able to monitor their access using the build in logging tools.

Please feel free to submit a PR to this page, or reach out at sso @ myGitHubUsername dotcom. I only want this data to be accurate.