Use Google's supported sign-in flow when connecting Google Workspace to email applications. Instructions that tell you to enable less secure apps or enter your main password into every third-party client are outdated. The organisation's security policy and the application's authentication support both matter.
IN THIS ARTICLE
01 Connect an approved application
- Check that the user can sign in to Gmail in a browser. Resolve account, license or administrator-policy issues there before rebuilding an email profile.
- Update the email application to a supported version. When adding an account, choose Google or Sign in with Google if available, and complete the Google-hosted authentication flow.
- Review the requested permissions and approve only the application you intended to connect. Organisation administrators may need to authorise the app or enable the relevant mail access.
- Complete multifactor authentication. Do not disable it merely because an older client cannot connect.
- If a device cannot use OAuth, follow Google's documented alternative for that device and the organisation's policy. Application passwords or a configured SMTP relay are specific options, not universal replacements.
- Send and receive test messages and verify Sent and other folders. For calendar and contacts, confirm the app's supported synchronisation method separately.
02 Protect the organisation
Use separate administrator accounts or carefully limited roles, secure recovery methods and more than one authorised recovery route where available. Review third-party app access and revoke unused connections. After a suspected compromise, address active sessions, forwarding rules and connected apps as well as the password.
How do I tell a Google sign-in failure from a delivery failure?
If the app cannot authenticate but browser Gmail works, investigate the app's OAuth support and administrator restrictions. If messages send but are rejected by recipients, inspect the rejection and domain authentication. SPF, DKIM and DMARC records belong at the authoritative DNS provider and need to cover other approved senders too.
03 Handle old Outlook profiles carefully
Office 2019 is outside its normal support lifecycle. Use a supported client and follow instructions for its actual version, because classic Outlook and new Outlook have different setup screens. Before removing a profile, preserve any local-only mail or archives. An account reset should not become accidental data loss.