The control layers (and our verdict's subject)
Per-PLAN defaults (CASMailboxPlan.PopEnabled/ImapEnabled — what new mailboxes get; the 4-of-4-plans-true finding our MC1293480 mapping fired on) → per-MAILBOX switches (CASMailbox) → org/auth posture (basic auth for POP/IMAP is already dead; OAuth-capable clients only — the retirements module's earlier chapter). The legacy-TLS retirement wave (our verdict's trigger) closed the old-cipher stragglers on top.
The design consequence: plan defaults should be FALSE — enable per-mailbox for the justified few. Plans defaulting true means every new hire ships with two legacy doors open that nobody will ever use legitimately; our verdict page has been making exactly this argument with your own plan data.
The legitimate-need list (it's short)
Shared-mailbox pollers that predate Graph (ticketing ingestion), scanners/copiers doing IMAP pickup (rarer than SMTP-out), the odd compliance-mandated retrieval tool, and users with niche clients (shrinking to hobbyist territory). Each survivor: OAuth-capable? (IMAP/POP OAuth flows exist for apps) → migrate auth; Graph-portable? → migrate API; neither? → per-mailbox enable + documented owner + review date. Everything else: off.
What to watch (proofs)
- The plan truth: Get-CASMailboxPlan | ft Identity, PopEnabled, ImapEnabled — nightly-scanned, verdict-watched; the change you make here shows in tomorrow's diff and flips the verdict to NOT_AFFECTED (the loop this site exists for).
- The per-mailbox survivors: Get-CASMailbox filtered to Pop/ImapEnabled true — the owned-and-dated exception list.
- Actual usage vs enablement: POP/IMAP sign-in activity (sign-in logs by protocol) — enabled-but-unused is free risk reduction; used-but-unowned is a finding.
- Post-change canaries: auth failures on the protocols after each tightening — the stragglers announce themselves; better to you than to the helpdesk.