Microsoft 365 F1 has exchange k1

Microsoft 365 F1 users are not licensed to use the Exchange mailbox provisioned by the Exchange Online K1 service plan, so disable both Outlook on the web and POP rather than relying on the OWA block alone.

The K1 service plan can provision a mailbox to support Teams, but it does not grant an F1 user rights to use that mailbox. Microsoft specifically recommends disabling Outlook on the web and instructing F1 users not to access the mailbox by any other method.^1^

Disable POP and OWA

Connect to Exchange Online PowerShell with an account that has permission to change mailbox client-access settings, and then run:

$user = "[Email]"

Set-CASMailbox -Identity $user `
  -OWAEnabled $false `
  -PopEnabled $false

Get-CASMailbox -Identity $user |
  Format-List DisplayName,OWAEnabled,PopEnabled

The expected result is:

OWAEnabled : False
PopEnabled : False

OWAEnabled and PopEnabled are independent controls; disabling OWA does not disable POP. Microsoft documents Set-CASMailbox for disabling each protocol separately.^2^ POP and IMAP are otherwise enabled by default for Exchange Online users.^3^

If these users must have no mailbox access through any client, assess and disable every applicable mailbox protocol, not only POP and OWA:

Set-CASMailbox -Identity "[Email]" `
  -OWAEnabled $false `
  -PopEnabled $false `
  -ImapEnabled $false `
  -MAPIEnabled $false `
  -ActiveSyncEnabled $false `
  -EWSEnabled $false

Be careful with shared mailboxes: protocol access follows the authenticated user, so disabling a protocol only on a shared mailbox does not prevent access by a user for whom that protocol remains enabled.^2^

If users require email

Assign a subscription that explicitly includes Exchange mailbox-use rights instead of using the F1-provisioned K1 mailbox. Confirm the exact subscription assigned under Microsoft 365 admin center → Users → Active users → select user → Licenses and apps, because Microsoft 365 F1, Microsoft 365 F3/Office 365 F3, and standalone Exchange Online Kiosk do not have identical entitlements. The Exchange service description explicitly states that Microsoft 365 F1 does not include rights to an Exchange mailbox.^4^

What action might Microsoft take?

The public documentation supplied here does not specify a particular automatic penalty, suspension, or enforcement sequence for F1 users who access the provisioned mailbox through POP. Therefore, no specific Microsoft action should be assumed.

Treat current POP use as use outside the documented F1 rights:

1. Disable POP and other mailbox-access protocols for affected F1 users.
2. Preserve an internal record of the correction.
3. Assign an eligible Exchange license where mailbox access is required.
4. Ask your Microsoft licensing provider or Microsoft Support to assess any past-use or contractual implications under your organization’s agreement.

References

1. Microsoft 365 and Office 365 plan options
2. Enable or disable POP3, IMAP, MAPI, Outlook Web App or Exchange ActiveSync in Microsoft 365
3. POP3 and IMAP4 in Exchange Online
4. Exchange Online service description