Exchange mail flow guides › Authentication and SMTP errors
Fetching Gmail and Google Workspace mail into Exchange over IMAP with OAuth2
Google requires OAuth 2.0 for third-party access to Gmail and Google Workspace mailboxes; a connector signs in once through a Google consent page and then downloads from imap.gmail.com on port 993 with a token that it refreshes itself, instead of a stored password. This guide explains what Google switched off and when, what that means for a POP3/IMAP connector that feeds an on-premises Exchange Server, and the eight steps that connect a Gmail or Google Workspace mailbox with OAuth2.
Updated on 2026-09-24
What Google switched off
Google calls an application that signs in to a Google account with only a username and password a “less secure app”. For Google Workspace accounts the administrator help page Control access to less secure apps states it in one sentence: starting 1 May 2025, Workspace accounts no longer support less secure apps, third-party apps or devices that sign in with a username and password, and OAuth must be used instead. The companion page Transition from less secure apps to OAuth gives the first cut-off — since 14 March 2025 users must use OAuth with third-party apps to access Gmail — and names the one exception: app passwords. Google’s advice there for anything else is short: ask the app developer to update the app to OAuth 2.0.
For a personal Google account the rules are softer but point the same way. Google’s page Less secure apps & your Google Account tells users to switch to a type of access that does not share password data, and says Google might block anyone trying to sign in from an app that does not meet its security standards. Its page on app passwords describes them as 16-digit codes available only with 2-Step Verification turned on, and adds that they are not recommended and unnecessary in most cases. Since January 2025 IMAP is always on for personal Gmail accounts; the old “Enable IMAP” switch is gone (Gmail IMAP help).
| Sign-in method | Google Workspace account | Personal @gmail.com account | Where Google documents it |
|---|---|---|---|
| Username and password in the app (“less secure app”) | Not supported since 1 May 2025 (first-time connections refused since March 2025) | Discouraged; Google may block the sign-in | Control access to less secure apps; Less secure apps & your Google Account |
| App password (16 digits, needs 2-Step Verification) | Still possible for devices that only speak SMTP/IMAP/POP3, by the administrator’s choice | Possible, “not recommended and unnecessary in most cases” | Transition page; Sign in with app passwords |
| OAuth 2.0 (“Sign in with Google”) | Required | Recommended | Transition page; Gmail IMAP help |
| IMAP access itself | Available | Always on since January 2025 | Gmail IMAP help |
What this means for a connector
A POP3/IMAP connector is exactly the kind of “third-party app” Google means: a Windows service that logs in to the mailbox on a schedule, downloads what is new and hands it to Exchange over SMTP. If it does that with a stored password, a Workspace mailbox has refused it since May 2025 and a personal mailbox may refuse it at any time. With OAuth 2.0 the sequence is different, and the difference is what makes the setup a one-time event rather than a recurring support ticket:
- The sign-in happens once, in a browser on the connector’s machine. Google shows its consent page, names the application, lists what it may do with the mailbox — read, compose and delete email — and asks the account owner to agree.
- The connector keeps a token, not a password. After the consent the connector stores an OAuth token and refreshes it automatically. Changing the Google password does not touch it, and nothing password-shaped is written into the connector’s configuration.
- The token is presented instead of a password when the connector logs in to imap.gmail.com. Everything else about IMAP is unchanged: folders, downloading, the delete-after-download or leave-on-server behaviour set for the account, and the schedule.
- The Exchange side does not change at all. Delivery into Exchange runs over SMTP through the receive connector, as for every other account; see How to download POP3 and IMAP mailboxes into Exchange Server 2016, 2019 and SE.
The same pattern applies to Microsoft 365 with a Microsoft sign-in; the mechanics of tokens and consent are described in Basic authentication is gone: fetching a Microsoft 365 mailbox by IMAP or POP3 with OAuth2 into Exchange.
Step by step: a Gmail or Google Workspace mailbox in POPcon
The steps below are the ones from the knowledge-base article How to connect to Gmail with modern authentication / OAuth2, which carries a screenshot of each screen. POPcon has supported OAuth 2.0 for Google and Microsoft accounts since version 4.8.1 (September 2024).
- Add the mailbox as IMAP on imap.gmail.com, port 993. In the connector, add a new mailbox account, set the server type to IMAP, the server address to imap.gmail.com and the port to 993. The port for Gmail IMAP with OAuth2 is 993, not the plain-IMAP default 143.
- Click “Connect OAuth2” next to the authentication field. Leave the password field empty. The connector opens a browser window on that machine.
- Sign in to the Google account. Use the Google account that owns the mailbox to be fetched: a personal @gmail.com address or a Google Workspace user.
- Grant the connector permission to access the mailbox. Google lists what the application will be able to do with the mailbox: read, compose and delete email. The application is named “POPcon email forwarding”. Tick the permission and click Continue.
- If Google shows an “unverified app” warning, click Advanced and proceed. The knowledge-base walkthrough notes that Google may show this warning while its verification of the application is pending. Click Advanced, then “Go to POPcon email forwarding (unsafe)” to continue.
- Complete the authentication flow. Google shows the requested permissions once more; confirm. A confirmation page appears and the browser window can be closed.
- Check that the status reads “Authenticated”. Back in the connector the account status changes to Authenticated. The OAuth token is stored and refreshed automatically from now on.
- Run “Test access”. The test logs in to Gmail with the token. If it passes, the account is ready and the schedule takes over.
No password is entered at any point; the OAuth token is stored securely and refreshed automatically. The walkthrough contains no step in which you register anything in your Google account or in the Google Workspace admin console: the sign-in consents to the connector’s own registered application, which is why Google’s consent page says “POPcon email forwarding” rather than the name of your organisation.
IMAP or POP3 at Google?
Google offers both. The POPcon walkthrough with OAuth2 uses IMAP; the older knowledge-base article Can POPcon download email from Gmail accounts? describes the legacy POP3-SSL setup with a password or app password and points to the OAuth2 walkthrough as the recommended path.
| IMAP with OAuth2 (recommended) | POP3 with a password or app password (legacy) | |
|---|---|---|
| Server and port | imap.gmail.com, 993, IMAP-SSL | pop.gmail.com, 995, POP3-SSL (Google’s POP settings) |
| Authentication | OAuth2 Google — one sign-in, token refreshed by the connector | Gmail password or a 16-digit app password (2-Step Verification required) |
| Google Workspace | Works | Password refused since 1 May 2025; app password only where the administrator allows it |
| What happens to the copy at Google | Set per account in the connector: delete after download or leave on the server | Google’s POP settings decide: keep the copy in the inbox, mark it as read, archive it or delete it; “recent mode” (recent: before the user name) shows the last 30 days |
| Availability of the protocol | Always on for personal accounts since January 2025 | Enabled in Gmail’s Forwarding and POP/IMAP settings |
Symptoms, and what each one really means
| What you see | Cause | What to do |
|---|---|---|
| Login to a Google Workspace mailbox fails although the password is correct | Google no longer accepts a username and password from a third-party app (since 1 May 2025) | Set the account to IMAP, imap.gmail.com, 993, click Connect OAuth2 and sign in once. |
| Google shows “This app isn’t verified” during the sign-in | Google’s verification of the application is pending, as the walkthrough notes | Click Advanced, then Go to POPcon email forwarding (unsafe), and finish the consent. |
| An app password cannot be created in the Google account | App passwords exist only for accounts with 2-Step Verification turned on | Do not go that way: use Connect OAuth2; no app password is needed. |
| The sign-in succeeded, but the status does not read Authenticated | The browser flow was not completed, or the wrong Google account was chosen | Click Connect OAuth2 again, pick the account that owns the mailbox, complete every consent page, then run Test access. |
| Mail arrives in Exchange but stays in the Gmail inbox as well | The account is set to leave messages on the server | Intended during a migration; otherwise change the account’s delete / leave-on-server setting in the connector. |
Frequently asked questions
Do I need a Google app password for the connector?
No. With OAuth2 the connector never sends a password to Google; it signs in once through Google’s consent page and works with a token afterwards. Google itself says app passwords are not recommended and unnecessary in most cases; they are 16-digit codes that exist only for accounts with 2-Step Verification turned on, and Google’s own instruction to app developers is to update the app to OAuth 2.0. The older POPcon article for Gmail with a password or app password over POP3 still exists, but the OAuth2 walkthrough is the recommended path.
Which server and port does the connector use for Gmail?
IMAP on imap.gmail.com, port 993 (IMAP over SSL/TLS), with the authentication set to OAuth2 Google. Google’s POP3 endpoint is pop.gmail.com on port 995 with SSL; the POPcon walkthrough with OAuth2 uses IMAP.
Does this work for Google Workspace as well as a personal Gmail account?
Yes, the sign-in is the same. For Google Workspace it is the only path: Google’s administrator help states that since 1 May 2025 Workspace accounts no longer support apps that sign in with only a username and password, and that OAuth must be used. For a personal Google account Google steers to “Sign in with Google” in the same way and may block sign-ins from an app that does not meet its security standards.
Will the connector ask me to sign in again later?
Not as part of normal operation. The knowledge-base walkthrough states that the OAuth token is stored securely and refreshed automatically, and no password is entered at any point. A new sign-in is needed only when the consent no longer exists, for example after the account owner has removed the application’s access in the Google account settings, or when the mailbox is moved to a different Google account.
Can I keep using POP3 with Gmail instead of IMAP?
Google still documents POP on pop.gmail.com, port 995 with SSL, including its “recent mode” (the user name prefixed with recent:) that shows the last 30 days of mail. The POPcon walkthrough with OAuth2, however, is written for IMAP on imap.gmail.com, port 993; the older POP3-SSL article for Gmail relies on a password or app password. For a new setup, take IMAP with OAuth2.
More in the Exchange mail flow guides, on the POPcon product page, the download page or in the knowledge base. Auf Deutsch: Gmail und Google Workspace per IMAP mit OAuth2 nach Exchange abholen.