{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/google-workspace-less-secure-apps-oauth-scanners-devices-march-2025/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/google-workspace-less-secure-apps-oauth-scanners-devices-march-2025/",
        "slug": "google-workspace-less-secure-apps-oauth-scanners-devices-march-2025",
        "url": "https://update.dsesecurity.com/updates/google-workspace-less-secure-apps-oauth-scanners-devices-march-2025/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/google-workspace-less-secure-apps-oauth-scanners-devices-march-2025.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/google-workspace-less-secure-apps-oauth-scanners-devices-march-2025/"
        },
        "title": "Google turned off password-based IMAP, SMTP and POP access in March 2025: move scanners and apps to OAuth",
        "summary": "Google’s Workspace help says that starting March 14, 2025, users must use OAuth with third-party apps to access Gmail, Calendar and Contacts, and CalDAV, CardDAV, IMAP, SMTP and POP no longer work with legacy passwords. For scanners and other devices, Google lists OAuth, an alternative sending method or an app password.",
        "format": {
            "slug": "briefing",
            "name": "Briefing"
        },
        "priority": {
            "slug": "advisory",
            "name": "Advisory"
        },
        "featured": false,
        "image": {
            "theme": "identity-cloud",
            "label": "Identity & cloud",
            "alt": "Governed cloud identity system with connected service and lifecycle nodes.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "cybersecurity",
                "name": "Cybersecurity",
                "url": "https://update.dsesecurity.com/topic/cybersecurity/"
            },
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-10-18T21:01:16+00:00",
        "modified_at": "2026-10-18T22:22:08+00:00",
        "reviewed_on": "2026-10-18",
        "reading_minutes": 2,
        "word_count": 380,
        "potentially_affected": "Google Workspace organizations with copiers, scanners, cameras, alarm panels or other devices that send email through Gmail, and users of older mail, calendar or contact apps that sign in with only a password.",
        "dse_recommendation": "DSE recommends inventorying every device and app that signs in to Google Workspace with a password and moving each to OAuth or another supported sending method.",
        "primary_source": {
            "name": "Google Workspace Admin Help — Transition from less secure apps to OAuth",
            "url": "https://support.google.com/a/answer/14114704?hl=en",
            "published_on": null,
            "authority": "support.google.com"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<p>Google’s Workspace help says that starting March 14, 2025, users must use OAuth with third-party apps to access Gmail, Calendar and Contacts, and CalDAV, CardDAV, IMAP, SMTP and POP no longer work with legacy passwords. For scanners and other devices, Google lists OAuth, an alternative sending method or an app password.</p>\n<h2>Source facts</h2>\n<p>Google’s <a href=\"https://support.google.com/a/answer/14114704?hl=en\">Workspace help article on moving from less secure apps to OAuth</a> says that starting March 14, 2025, users must use OAuth with third-party apps to access Gmail, Google Calendar and Google Contacts, and that access to less secure apps, meaning non-Google apps that sign in with a username and password, is turned off. CalDAV, CardDAV, IMAP, SMTP and POP no longer work with legacy passwords, and existing Google Sync users can no longer connect.</p>\n<p>For scanners or other devices using SMTP or less secure apps to send email, Google lists three options: configure the device to use OAuth, use an alternative way to scan or send email, or configure an app password, and suggests choosing replacement devices that send email using OAuth. If an app does not support OAuth, Google says to switch to one that does or ask the supplier to add it.</p>\n<p>Mobile management pushes of password-based IMAP, CalDAV, CardDAV, POP and Exchange ActiveSync accounts stopped working for existing users in autumn 2024, and accounts must be pushed again so iOS devices re-add them using OAuth. Users who take no action receive an error that their username and password combination is incorrect.</p>\n<h2>Applicability</h2>\n<p>Use this for Google Workspace tenants; Google points to its Workspace Updates blog for exact dates. Microsoft 365 tenants follow separate SMTP AUTH changes covered elsewhere in the library.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends inventorying every device and app that signs in to Google Workspace with a password and moving each to OAuth or another supported sending method. Prefer OAuth-capable firmware or replacements for scanners and security devices, treat any app password as a credential with an owner and rotation date, and test alarm and camera email notifications after each change.</p>\n<h2>Verification</h2>\n<p>Send a test message from each device after migration, check device logs for failed sign-ins, and keep a list of any app passwords with the device each one serves.</p>\n<h2>Official reference</h2>\n<p><a href=\"https://support.google.com/a/answer/14114704?hl=en\">Google Workspace Admin Help — Transition from less secure apps to OAuth</a>. Reviewed October 18, 2026.</p>",
        "content_text": "Google’s Workspace help says that starting March 14, 2025, users must use OAuth with third-party apps to access Gmail, Calendar and Contacts, and CalDAV, CardDAV, IMAP, SMTP and POP no longer work with legacy passwords. For scanners and other devices, Google lists OAuth, an alternative sending method or an app password.\nSource facts\nGoogle’s Workspace help article on moving from less secure apps to OAuth says that starting March 14, 2025, users must use OAuth with third-party apps to access Gmail, Google Calendar and Google Contacts, and that access to less secure apps, meaning non-Google apps that sign in with a username and password, is turned off. CalDAV, CardDAV, IMAP, SMTP and POP no longer work with legacy passwords, and existing Google Sync users can no longer connect.\nFor scanners or other devices using SMTP or less secure apps to send email, Google lists three options: configure the device to use OAuth, use an alternative way to scan or send email, or configure an app password, and suggests choosing replacement devices that send email using OAuth. If an app does not support OAuth, Google says to switch to one that does or ask the supplier to add it.\nMobile management pushes of password-based IMAP, CalDAV, CardDAV, POP and Exchange ActiveSync accounts stopped working for existing users in autumn 2024, and accounts must be pushed again so iOS devices re-add them using OAuth. Users who take no action receive an error that their username and password combination is incorrect.\nApplicability\nUse this for Google Workspace tenants; Google points to its Workspace Updates blog for exact dates. Microsoft 365 tenants follow separate SMTP AUTH changes covered elsewhere in the library.\nDSE recommendation\nDSE recommends inventorying every device and app that signs in to Google Workspace with a password and moving each to OAuth or another supported sending method. Prefer OAuth-capable firmware or replacements for scanners and security devices, treat any app password as a credential with an owner and rotation date, and test alarm and camera email notifications after each change.\nVerification\nSend a test message from each device after migration, check device logs for failed sign-ins, and keep a list of any app passwords with the device each one serves.\nOfficial reference\nGoogle Workspace Admin Help — Transition from less secure apps to OAuth. Reviewed October 18, 2026.",
        "content_markdown": "Google’s Workspace help says that starting March 14, 2025, users must use OAuth with third-party apps to access Gmail, Calendar and Contacts, and CalDAV, CardDAV, IMAP, SMTP and POP no longer work with legacy passwords. For scanners and other devices, Google lists OAuth, an alternative sending method or an app password.\n\n## Source facts\n\nGoogle’s [Workspace help article on moving from less secure apps to OAuth](https://support.google.com/a/answer/14114704?hl=en) says that starting March 14, 2025, users must use OAuth with third-party apps to access Gmail, Google Calendar and Google Contacts, and that access to less secure apps, meaning non-Google apps that sign in with a username and password, is turned off. CalDAV, CardDAV, IMAP, SMTP and POP no longer work with legacy passwords, and existing Google Sync users can no longer connect.\n\nFor scanners or other devices using SMTP or less secure apps to send email, Google lists three options: configure the device to use OAuth, use an alternative way to scan or send email, or configure an app password, and suggests choosing replacement devices that send email using OAuth. If an app does not support OAuth, Google says to switch to one that does or ask the supplier to add it.\n\nMobile management pushes of password-based IMAP, CalDAV, CardDAV, POP and Exchange ActiveSync accounts stopped working for existing users in autumn 2024, and accounts must be pushed again so iOS devices re-add them using OAuth. Users who take no action receive an error that their username and password combination is incorrect.\n\n## Applicability\n\nUse this for Google Workspace tenants; Google points to its Workspace Updates blog for exact dates. Microsoft 365 tenants follow separate SMTP AUTH changes covered elsewhere in the library.\n\n## DSE recommendation\n\nDSE recommends inventorying every device and app that signs in to Google Workspace with a password and moving each to OAuth or another supported sending method. Prefer OAuth-capable firmware or replacements for scanners and security devices, treat any app password as a credential with an owner and rotation date, and test alarm and camera email notifications after each change.\n\n## Verification\n\nSend a test message from each device after migration, check device logs for failed sign-ins, and keep a list of any app passwords with the device each one serves.\n\n## Official reference\n\n[Google Workspace Admin Help — Transition from less secure apps to OAuth](https://support.google.com/a/answer/14114704?hl=en). Reviewed October 18, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/google-workspace-less-secure-apps-oauth-scanners-devices-march-2025/",
                "url": "https://update.dsesecurity.com/updates/google-workspace-less-secure-apps-oauth-scanners-devices-march-2025/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-10-18"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/google-workspace-less-secure-apps-oauth-scanners-devices-march-2025/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Google turned off password-based IMAP, SMTP and POP access in March 2025: move scanners and apps to OAuth",
                        "item": "https://update.dsesecurity.com/updates/google-workspace-less-secure-apps-oauth-scanners-devices-march-2025/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/google-workspace-less-secure-apps-oauth-scanners-devices-march-2025/#article",
                "identifier": "https://update.dsesecurity.com/updates/google-workspace-less-secure-apps-oauth-scanners-devices-march-2025/",
                "url": "https://update.dsesecurity.com/updates/google-workspace-less-secure-apps-oauth-scanners-devices-march-2025/",
                "headline": "Google turned off password-based IMAP, SMTP and POP access in March 2025: move scanners and apps to OAuth",
                "description": "Google’s Workspace help says that starting March 14, 2025, users must use OAuth with third-party apps to access Gmail, Calendar and Contacts, and…",
                "abstract": "Google’s Workspace help says that starting March 14, 2025, users must use OAuth with third-party apps to access Gmail, Calendar and Contacts, and CalDAV, CardDAV, IMAP, SMTP and POP no longer work with legacy passwords. For scanners and other devices, Google lists OAuth, an alternative sending method or an app password.",
                "articleBody": "Google’s Workspace help says that starting March 14, 2025, users must use OAuth with third-party apps to access Gmail, Calendar and Contacts, and CalDAV, CardDAV, IMAP, SMTP and POP no longer work with legacy passwords. For scanners and other devices, Google lists OAuth, an alternative sending method or an app password.\nSource facts\nGoogle’s Workspace help article on moving from less secure apps to OAuth says that starting March 14, 2025, users must use OAuth with third-party apps to access Gmail, Google Calendar and Google Contacts, and that access to less secure apps, meaning non-Google apps that sign in with a username and password, is turned off. CalDAV, CardDAV, IMAP, SMTP and POP no longer work with legacy passwords, and existing Google Sync users can no longer connect.\nFor scanners or other devices using SMTP or less secure apps to send email, Google lists three options: configure the device to use OAuth, use an alternative way to scan or send email, or configure an app password, and suggests choosing replacement devices that send email using OAuth. If an app does not support OAuth, Google says to switch to one that does or ask the supplier to add it.\nMobile management pushes of password-based IMAP, CalDAV, CardDAV, POP and Exchange ActiveSync accounts stopped working for existing users in autumn 2024, and accounts must be pushed again so iOS devices re-add them using OAuth. Users who take no action receive an error that their username and password combination is incorrect.\nApplicability\nUse this for Google Workspace tenants; Google points to its Workspace Updates blog for exact dates. Microsoft 365 tenants follow separate SMTP AUTH changes covered elsewhere in the library.\nDSE recommendation\nDSE recommends inventorying every device and app that signs in to Google Workspace with a password and moving each to OAuth or another supported sending method. Prefer OAuth-capable firmware or replacements for scanners and security devices, treat any app password as a credential with an owner and rotation date, and test alarm and camera email notifications after each change.\nVerification\nSend a test message from each device after migration, check device logs for failed sign-ins, and keep a list of any app passwords with the device each one serves.\nOfficial reference\nGoogle Workspace Admin Help — Transition from less secure apps to OAuth. Reviewed October 18, 2026.",
                "datePublished": "2026-10-18T21:01:16+00:00",
                "dateModified": "2026-10-18T22:22:08+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/google-workspace-less-secure-apps-oauth-scanners-devices-march-2025/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/google-workspace-less-secure-apps-oauth-scanners-devices-march-2025/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Google turned off password-based IMAP, SMTP and POP access in March 2025: move scanners and apps to OAuth"
                },
                "articleSection": [
                    "Cybersecurity",
                    "IT"
                ],
                "keywords": [
                    "Cybersecurity",
                    "IT",
                    "Briefing",
                    "Advisory priority"
                ],
                "genre": "Briefing",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Cybersecurity",
                        "url": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    }
                ],
                "wordCount": 380,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Google Workspace Admin Help — Transition from less secure apps to OAuth",
                    "url": "https://support.google.com/a/answer/14114704?hl=en"
                }
            }
        ]
    }
}