Enforcing Email-Client-Only Access in Google Workspace Using App Passwords (No User Passwords)

Some organizations want to strictly prevent users from accessing Google Workspace accounts via browsers (Gmail web, Google login, Drive, etc.) and force email usage only through desktop or mobile email clients such as Outlook or Thunderbird.

One practical method—often used in accounting firms, shared-user environments, and compliance-sensitive setups—is:

Do not share the Google Workspace account password with users.
Enable App Passwords and configure only third-party email clients.
Disable user password reset and login recovery options.

This article explains how this approach works, its limitations, and the complete implementation process, along with security considerations and best practices.

Concept Overview

Core Idea

• Users never know the actual Google Workspace account password

• Email access is granted only via App Passwords

• App Passwords are configured in:

  • Outlook

  • Thunderbird

  • Other third-party email clients

• Browser login to Google services becomes practically impossible for users

• Users cannot reset or recover the password themselves

This creates a client-only email usage model without relying heavily on firewalls or CASB.

Technical Explanation

How App Passwords Work

An App Password is a 16-character, randomly generated password that:

• Bypasses interactive Google login

• Works only with legacy or third-party email clients

• Does not allow browser login

• Can be revoked anytime without changing the main account password

Key characteristics:

• Cannot be used at accounts.google.com

• Cannot bypass MFA enforcement

• Limited to specific protocols (IMAP/POP/SMTP)

Supported Third-Party Email Clients

You can configure App Passwords with many email clients, including:

Desktop Clients

• Microsoft Outlook (Windows / macOS)

• Mozilla Thunderbird

• eM Client

• Mailbird

• Apple Mail (macOS)

• Evolution Mail (Linux)

• The Bat!

• Pegasus Mail

Mobile Clients

• Apple Mail (iOS)

• Samsung Email

• BlueMail

• Aqua Mail

• FairEmail

Gmail mobile app will not work without interactive Google login.

Use Cases

Suitable Scenarios

• Accounting firms (Tally users)

• Call centers / shared desktops

• Compliance-driven environments

• Businesses standardizing on Outlook

• Organizations without advanced firewall/CASB

Not Recommended For

• Highly collaborative teams (Docs, Drive)

• Users needing Google SSO

• Environments requiring OAuth-based modern auth

• High-risk security environments without additional controls

Step-by-Step Implementation Guide

Step 1: Secure the Admin Password

1. Log in as Google Workspace Super Admin

2. Set a strong, random password for each user account

3. Do NOT share this password with users

4. Store credentials securely (password manager or sealed documentation)

Step 2: Disable User Password Reset & Recovery

1. Go to Admin Console → Security → Account recovery

2. Disable:

   • Secondary email recovery

   • Phone number recovery

3. Restrict password reset permissions:

   • Only Super Admin can reset passwords

Result:
Users cannot reset or recover passwords themselves.

Step 3: Enforce 2-Step Verification (Admin-Controlled)

1. Enable 2-Step Verification

2. Apply it only to admins

3. Exclude end users if they never log in interactively

This protects the account while avoiding user friction.

Step 4: Enable App Passwords

1. Go to Admin Console → Security → Authentication

2. Allow App Passwords

3. Restrict usage to required users only

Step 5: Generate App Passwords (Admin or Controlled Process)

1. Log in as the user (or via delegated admin access)

2. Generate App Password:

   • App: Mail

   • Device: Custom (e.g., “Outlook-PC-01”)

3. Copy the 16-character password

4. Store it securely

Step 6: Configure Email Client (Example: Outlook)

IMAP Settings

IMAP Server: imap.gmail.com
Port: 993
Encryption: SSL/TLS

SMTP Server: smtp.gmail.com
Port: 587
Encryption: STARTTLS

Authentication

• Username: full email address

• Password: App Password (not Google account password)

Repeat similarly for Thunderbird or other clients.

Step 7: Disable Browser Access Practically

Even without firewall rules, this setup ensures:

• Users cannot log in to:

  • Gmail web

  • Google Account

  • Google Drive

• They do not have the password

• Password recovery is disabled

Optionally:

• Block accounts.google.com via DNS or endpoint security for added assurance

Commands / Validation Examples

Test Browser Login

Attempt login at https://accounts.google.com
Expected: Login not possible (password unknown)

Test IMAP Connectivity

Test-NetConnection imap.gmail.com -Port 993

Expected result: Success

Common Issues & Fixes

Issue: Outlook Stops Syncing

Cause

• App Password revoked or changed

Fix

• Generate new App Password

• Update client settings

Issue: User Tries Gmail Mobile App

Fix

• Gmail app requires interactive login

• Not compatible with App Password–only model

Issue: Admin Forgot Main Password

Fix

• Always keep at least two Super Admin accounts

• Store credentials securely

Security Considerations (Important)

Advantages

• Browser access effectively blocked

• No phishing via Google login

• Simple enforcement without CASB

• Easy revocation of access

Risks

• App Passwords bypass modern OAuth protections

• IMAP/SMTP is less secure than modern APIs

• If App Password is leaked, email access is compromised

Mitigations

• Use device-specific App Passwords

• Revoke passwords immediately on exit

• Combine with endpoint security

• Restrict network access where possible

Best Practices

• Maintain App Password inventory

• Label passwords per device/user

• Revoke passwords during employee exit

• Rotate App Passwords periodically

• Use endpoint protection to restrict browser usage

• Keep Admin audit logs enabled

• Combine with email backup and retention policies

Limitations to Be Aware Of

• Not a true Zero-Trust model

• Does not protect Drive/Docs data (they’re inaccessible anyway)

• App Passwords are legacy authentication

• Google may restrict App Password usage in future plans

Conclusion

Using App Passwords without sharing Google Workspace account passwords is a practical, enforceable method to ensure users can only access email via Outlook or other third-party clients, while being unable to log in via browsers or Gmail web.

While this approach has security trade-offs, it is effective for:

• Controlled environments

• Accounting and operations teams

• Organizations prioritizing usage restriction over collaboration

For higher security maturity, this model should be combined with network controls, MFA for admins, and endpoint security.