Google turned off password-based IMAP, SMTP and POP access in March 2025: move scanners and apps to OAuth

Google’s Workspace help says that starting March 14, 2025, users must use OAuth with third-party apps to access Gmail, Calendar and Contacts, and CalDAV, CardDAV, IMAP, SMTP and POP no longer work with legacy passwords. For scanners and other devices, Google lists OAuth, an alternative sending method or an app password.

Source facts

Google’s Workspace help article on moving from less secure apps to OAuth says that starting March 14, 2025, users must use OAuth with third-party apps to access Gmail, Google Calendar and Google Contacts, and that access to less secure apps, meaning non-Google apps that sign in with a username and password, is turned off. CalDAV, CardDAV, IMAP, SMTP and POP no longer work with legacy passwords, and existing Google Sync users can no longer connect.

For scanners or other devices using SMTP or less secure apps to send email, Google lists three options: configure the device to use OAuth, use an alternative way to scan or send email, or configure an app password, and suggests choosing replacement devices that send email using OAuth. If an app does not support OAuth, Google says to switch to one that does or ask the supplier to add it.

Mobile management pushes of password-based IMAP, CalDAV, CardDAV, POP and Exchange ActiveSync accounts stopped working for existing users in autumn 2024, and accounts must be pushed again so iOS devices re-add them using OAuth. Users who take no action receive an error that their username and password combination is incorrect.

Applicability

Use this for Google Workspace tenants; Google points to its Workspace Updates blog for exact dates. Microsoft 365 tenants follow separate SMTP AUTH changes covered elsewhere in the library.

DSE recommendation

DSE recommends inventorying every device and app that signs in to Google Workspace with a password and moving each to OAuth or another supported sending method. Prefer OAuth-capable firmware or replacements for scanners and security devices, treat any app password as a credential with an owner and rotation date, and test alarm and camera email notifications after each change.

Verification

Send a test message from each device after migration, check device logs for failed sign-ins, and keep a list of any app passwords with the device each one serves.

Official reference

Google Workspace Admin Help — Transition from less secure apps to OAuth. Reviewed October 18, 2026.