User Connections

The User Connections page gives system administrators a real-time view of every session currently authenticated against the mail server, broken out by the protocol used to connect: Webmail, SMTP, IMAP, POP, XMPP, ActiveSync (EAS), MAPI & EWS (combined into a single tab), and WebDAV. It's the same underlying grid used on the domain administrator's Settings > User Connections page — the only difference is that, at the system administrator level, the grid spans every domain on the server rather than just one. Use this page to spot users who are consuming an unusual number of connections on a given protocol, to forcibly drop a stuck or abusive session, or to trigger a resync when a device's local cache has gotten out of sync with the mailbox on the server.

Each protocol is displayed on its own tab, and the tab header shows a running count of connections next to the total number of users on the server (or domain), e.g., “5 / 120”. It's important to understand that this count is a count of connections, not users — if the IMAP tab shows a “7”, that means there are 7 total IMAP connections open at that moment, which could be 7 different users each with one connection, or a single user with 7 connections open across multiple devices or folders.

The All Tab

The All tab aggregates every protocol into a single list. Because it's summarizing across protocols, its columns are intentionally minimal:

User – The user's email address (or username, when viewed from the domain administrator level).
Connections – The total number of active connections for that user, across all protocols combined.
Last Login – The date and time of the user's most recent login, with the specific protocol used for that login shown in parentheses next to the timestamp (e.g., 7/15/2026 9:14 AM (IMAP)).

Individual Protocol Tabs

The Webmail, SMTP, IMAP, POP, XMPP, ActiveSync, MAPI/EWS, and WebDAV tabs each show a more detailed, protocol-specific breakdown:

User – The address of the user connecting.
Enabled – A checkmark here means that this specific protocol is enabled for the user's account — not that the user or domain as a whole is enabled. For example, on the IMAP tab, a checkmark means the user's account has IMAP access turned on; it says nothing about whether their POP or ActiveSync access is enabled. A user can be fully enabled on the domain while having individual protocols selectively disabled (see Modify Protocol Access, below).
Connections – The number of active connections open for that user on that specific protocol. Multiple connections are common and expected: a user checking mail from a desktop client, a phone, and a webmail session simultaneously will show three separate connections, even though it's a single person.
Duration – (Webmail tab only.) The length of time the current webmail session has been open.
Last Login – The date and time the user last authenticated using the protocol being viewed.
Last Authenticated IP – The most recent IP address that successfully authenticated as this user on this protocol. This is extremely useful for tracking down where a set of suspicious login attempts, or an unexpectedly high connection count, is actually originating from.

Actions

The following actions are available from the Actions (⋮) menu. Which ones appear depends on whether you're on the All tab or an individual protocol tab:

Refresh – Reloads the connection list and counts.
Drop Connections – Immediately terminates the selected user's session(s) for the protocol in view (or, from the All tab, across every protocol). Use this when a client is stuck in a bad reconnect loop, when a compromised account needs to be cut off immediately, or when a former employee's device needs to be disconnected before their account is disabled.
Resync Devices – Forces a full resynchronization of the user's connected devices, either across all protocols (from the All tab) or for just the protocol currently in view. This is the standard first step for troubleshooting a mobile device or desktop client that's showing stale or duplicated data, since it forces the client to discard its local sync state and rebuild it from the server. Note that a maximum of 25 users can be resynced in a single request, to avoid putting an excessive, sudden sync load on the server.
Enable/Disable [Protocol] Access – Available on the individual protocol tabs (SMTP, IMAP, POP, XMPP, ActiveSync, MAPI/EWS, WebDAV). Turns that specific protocol on or off for the selected user(s) without touching their access to any other protocol.
Modify Protocol Access – Available only from the All tab. Rather than toggling one protocol at a time, this opens a dialog with an on/off switch for every protocol at once (Webmail, SMTP, IMAP, POP, XMPP, ActiveSync, MAPI/EWS, and WebDAV), letting an administrator reconfigure a user's entire protocol access profile in a single save. This is the fastest way to, for example, lock a user down to webmail-only access after a security incident.
View Authenticated IPs – Opens a window listing every IP address that has successfully authenticated with the selected user's credentials, grouped by IP (and, where available, the IP's geographic location), with the timestamp and protocol of each login shown underneath. This is the best tool for confirming whether a set of connections are all coming from the same place (e.g., a NAT'd office network) or from IPs scattered across different regions, which is a strong indicator of a compromised password.

Note: The actions on this page act directly on live connections and protocol access — they don't generate any kind of automated alert. To be notified automatically about account activity (such as a user being throttled or a mailbox nearing its size limit), set up a rule under Events instead.

Why Connections May Look Unusual

A few behaviors are expected and don't necessarily indicate a problem:

Long-lived SMTP connections behind a firewall or NAT gateway. If many people connect to the mail server from behind the same corporate firewall, they can appear to share a single source IP. Each person is still an individual, separate connection — the firewall is simply masking the fact that the traffic originates from many different internal machines.
MAPI and EWS counts frequently show 0. Unlike IMAP and ActiveSync, which hold an open connection and IDLE while waiting for new mail, MAPI and EWS clients (such as Outlook) generally poll the server rather than maintaining a persistent connection. Because of this, the MAPI/EWS tab's connection count will fluctuate and will often read 0 between polling intervals, even for users who are actively using the protocol.