RecrutFlo logoRecrutFlo
Create account
← All articles

Recruitment operations

IMAP Recruiting Setup: Connect a Shared CV Inbox Safely

By Andre · · 13 min read

IMAP Recruiting Setup: Connect a Shared CV Inbox Safely

Abstract illustration of a protected CV inbox

To set up IMAP for recruiting, you do four things: turn IMAP on at the mailbox or admin level, pick a sign-in method the provider still allows (OAuth, not a plain password), enter the right server and port, and test with a real application email. Most failed setups break at step one or two, not at the server settings. This guide walks through each step for a shared recruiting inbox such as jobs@ or careers@, and shows what to check when the connection fails.

Recrutflo
Make Your CV Inbox Searchable
RecrutFlo connects to IMAP mailboxes, identifies CV attachments and organizes candidate information into searchable profiles for your team.
Explore RecrutFlo

TL;DR

  • IMAP must be enabled on the mailbox or by an admin before any recruiting tool can read it. Exchange Online enables it by default for all users, but an admin may have turned it off.
  • Prefer OAuth (modern authentication) over passwords. Google Workspace no longer supports less secure apps that sign in with a username and password alone.
  • Reading mail is only half the job. If your team replies from the same tool, you also need SMTP settings.
  • Test with one real CV email, then check that the attachment, sender and date arrive intact.

Table of Contents

What IMAP does in a recruiting inbox

IMAP lets an application read a mailbox that stays on the mail server. Your messages are not downloaded and removed. That matters for recruiting: several people can look at the same inbox, folders and read states stay in sync, and the original email with the CV attached is still there if a candidate disputes what they sent.

A recruiting tool uses that connection to do three things:

  1. Watch the inbox for new messages.
  2. Pull the attachments (PDF, DOC, DOCX) and the sender details.
  3. Optionally send replies through the same mailbox, which needs SMTP on top of IMAP.

IMAP is not the only route. For Microsoft 365, some enterprise platforms are moving toward native APIs such as Microsoft Graph. Oracle’s recruiting documentation, for example, notes that Graph is an option over IMAP for Office 365 users, and Graph can also cover things IMAP cannot, such as calendars for interview scheduling. If all you need is to capture incoming CVs from a shared inbox, IMAP is simpler and does the job.

Before you start: what to gather

Save yourself a round trip to IT by collecting this first:

  • The exact mailbox address and whether it is a shared mailbox, a group address or a regular user mailbox with a license.
  • Admin access, or the name of the person who has it. In Microsoft 365 and Google Workspace, an admin can disable IMAP for the whole organization.
  • The sign-in method your provider allows. Ask whether multi-factor authentication is enforced on the mailbox and whether third-party app access is restricted.
  • A test email with a PDF CV attached, sent from a personal address, so you can see the full path.

If the mailbox is shared, also decide who may see what. Our short guide to shared inbox permissions recruiters must check covers which access levels matter before you connect anything.

Step 1: Turn IMAP on

Microsoft 365 and Exchange Online

Microsoft states that POP3 and IMAP4 are enabled by default for all users in Exchange Online, and that an admin can enable or disable them per user. So if a connection fails, the first thing to check is whether someone disabled IMAP for that specific mailbox. Ask your admin to confirm in the Exchange admin center or through PowerShell.

Google Workspace and Gmail

In Google Workspace, the admin has to allow it. Google’s instructions say to turn on IMAP in the Admin console before users can sync Gmail with third-party clients, and then each user makes sure IMAP is on for their own account. Google also publishes recommendations for admins setting up IMAP for an organization, including a troubleshooting section for users.

For a personal Gmail account used as a small recruiting inbox, the setting sits under Settings, then the Forwarding and POP/IMAP tab, then IMAP Access. Microsoft’s support page for connecting a Google account walks through the same click path.

Other IMAP providers

If your recruiting address lives on a web host, a regional provider or a company mail server, look for “IMAP” in the provider’s help pages or ask for the incoming server name, port and encryption type. Any standards-compliant IMAP server works the same way in principle.

Step 2: Choose how the tool signs in

This is where most recruiting setups now fail. There are three options, in order of preference:

Method What it is Verdict for a recruiting inbox
OAuth / modern authentication You approve access in a provider sign-in window; the tool gets a token, never your password Best choice. Revocable, works with MFA
App password A generated passcode for one app Fallback only. Often blocked by policy
Basic authentication Username and password sent to the tool Avoid. Increasingly unsupported

The providers are explicit. Google’s guidance is to use “Sign in with Google” rather than app passwords, calling app passwords unnecessary in most cases, and Workspace documentation says that from May 1, 2025, less secure apps are no longer supported when they ask for a Google Account password alone. Microsoft supports OAuth for IMAP, POP and SMTP connections to Exchange Online, including for shared mailboxes, where the application authenticates as a user who has access and addresses the shared mailbox.

The practical consequence: if a tool only asks for a username and password and your tenant has modern authentication enforced, it will fail with a vague “authentication failed” message. Your options are to use a tool that supports OAuth, or to ask your admin for a scoped exception, which is rarely a good idea for a mailbox full of personal data.

Step 3: Enter the server settings

If your tool asks for manual details instead of a sign-in button, you need the host name, port and encryption. For Microsoft 365 the incoming IMAP server is outlook.office365.com on port 993 with SSL/TLS, and outgoing mail uses smtp.office365.com on port 587 with STARTTLS, as listed in Microsoft’s Exchange Online IMAP documentation. For Gmail and other providers, copy the values from the provider’s own help page rather than from a forum post, since hosts and ports are exactly the kind of detail that gets changed.

A quick reference for what each field means:

  • Server / host: the address of the incoming mail server.
  • Port: 993 is the standard port for IMAP over SSL/TLS. Port 143 is the unencrypted default and should not be used for candidate data.
  • Encryption: SSL/TLS for port 993. Never choose “none.”
  • Username: usually the full email address.
  • Authentication: OAuth, app password or password, per Step 2.

Step 4: Don’t forget SMTP if you reply from the tool

A common pitfall is configuring only the incoming side. The tool then receives every CV but errors out the first time a recruiter tries to answer a candidate from inside it. If your tool only reads and extracts CVs, as ours does, SMTP is unnecessary and you can keep replying from Outlook or Gmail as before. If your applicant system also sends, set up outgoing mail with the provider’s SMTP host, port 587 and STARTTLS, and use the same authentication method.

Some enterprise recruiting platforms also ask for a separate no-reply address for automated messages, kept apart from the human recruiter inbox. That is a design choice of those systems, not a requirement of IMAP itself.

Step 5: Test with a real application

Don’t trust the green “connected” badge alone. Run this five-minute check:

  1. Send a CV as a PDF from a personal email address to the recruiting inbox.
  2. Send a second one as a DOCX, with the CV named something unhelpful like “scan001.docx.”
  3. Send an email with no attachment, only a cover note.
  4. Confirm that the tool picks up both attachments, ignores or flags the third message, and keeps the sender and received date correct.
  5. Send the first CV again from the same address and see whether duplicates are flagged.

If any step fails, the table in the next section usually explains why.

When the connection fails

Symptom Likely cause Fix
“Authentication failed” right away Password sign-in blocked; MFA or modern authentication enforced Switch to OAuth sign-in
“IMAP is disabled” or connection refused IMAP turned off for the user or organization Have an admin enable it (Step 1)
Works for the owner, fails for teammates Mailbox permissions differ per person Review who has access to the shared mailbox
Connects but no new emails appear Wrong folder selected, or messages auto-moved by a rule Check mailbox rules and the folder being watched
Mail arrives, replies fail SMTP not configured Add outgoing server settings
Worked for months, then stopped Token expired, password changed or admin policy updated Reconnect and re-approve access

Note that app passwords are a weak long-term fix. Google says they are not recommended, and enterprise policies often restrict them anyway.

Where our view differs from the usual advice

Most IMAP guides for recruiting come from big applicant tracking systems, where IMAP is one step in a long implementation project. That is not the situation of a five-person agency or a company that gets applications at jobs@. The question there is simpler: how do CVs already landing in an inbox become something you can search?

We built RecrutFlo around that. It connects to Microsoft 365, Outlook and IMAP mailboxes (Gmail is coming), spots CV attachments, extracts the details and builds searchable profiles. It does not ask you to move your hiring onto a new platform, and there is no onboarding call or implementation project. The inbox stays the front door.

Perspective: what we would do first

If we were setting this up for a small team on a Monday morning, we would skip any plan to “clean the inbox first.” We would enable IMAP, connect with OAuth, and let the tool read new mail going forward, then decide separately whether to import older CVs. Starting with live mail gives you proof within a day that the extraction is accurate on your real applications, not on sample files.

Perspective: what we would do first — overview diagram

We would also keep a human in the loop. Automation should take over the copy-paste work: names, contact details, skills, languages, location. Decisions about candidates stay with recruiters. And because CVs are personal data, we would treat access control as part of setup, not an afterthought: who sees the mailbox, who sees the database, and who can export.

One more honest point: IMAP is a legacy protocol, and providers keep tightening it. That is why we put OAuth first and why we would never recommend storing a shared password in any external tool.

— Marco

After the connection: make the inbox searchable

A working IMAP link is only the plumbing. The value comes from what happens to each CV afterward. A few habits make the difference:

  • Dedicate one address to applications. A separate jobs@ or careers@ inbox keeps invoices and newsletters out of the extraction.
  • Ask for attachments in standard formats. PDF, DOC and DOCX are the formats worth requesting in your job ads.
  • Search by facts, not filenames. Skills, languages, location and role beat trying to remember who sent “final_cv_v3.pdf.” Our article on searching CVs you already received by email shows what that looks like.
  • Decide on rules first, parsing second. If you are still on manual folders, the post on three Outlook rules to capture resumes explains where rules stop being enough.

For a longer walkthrough of the end result, see how to turn the CVs in your inbox into a searchable candidate database, and for the tradeoffs against a full system, recruitment inbox vs traditional ATS.

Try it on your own inbox

You can test the workflow on RecrutFlo’s free plan before paying anything. Paid plans are published on the pricing page: Starter at €19 per month, Professional at €49 per month and Business at €149 per month. If you run out of capacity, extra processing runs are one-off: +100 for €9, +500 for €29 and +1,000 for €49. There is no sales call required to see the limits. To see the steps in order, read how it works, or go to the RecrutFlo homepage to get started.

Data protection when you connect a mailbox

A recruiting inbox holds names, phone numbers, work histories and sometimes salary expectations. Before connecting any tool, check four things: where it stores data, whether each customer’s data is isolated from others, whether actions are logged, and whether you can limit access by role. RecrutFlo offers workspace isolation, an audit trail and team access control, and is designed around EU data protection principles. If you hire in the EU or handle candidates from there, involve your data protection contact early and document why you keep each CV and for how long.

Four checks for protecting recruiting inbox data

FAQ

Is IMAP or the Microsoft Graph API better for a recruiting inbox?

For simply reading incoming applications, IMAP is easier to configure and works across providers. Graph is an option for Microsoft 365 users and can also handle things like calendars, which IMAP cannot, as Oracle’s documentation points out. Choose Graph only if you need interview scheduling in the same integration.

Why does my recruiting tool say authentication failed when my password is correct?

Usually because the provider no longer accepts a plain password from that kind of app. Google Workspace has stopped supporting less secure apps, and Microsoft tenants can require modern authentication. Reconnect using OAuth, and ask your admin whether third-party app access is restricted.

Do I need SMTP as well as IMAP?

Only if you want to send email from inside the tool. IMAP handles receiving. If your team keeps replying from its normal mail client, you can leave SMTP out.

Can I connect a shared mailbox in Microsoft 365?

Yes. Microsoft documents OAuth for shared mailboxes: the application signs in as a user with access and specifies the shared mailbox address. Make sure that user has the right permissions on the mailbox first.

Sources

Recommended