Your academic password works on webmail, but your mobile application suddenly refuses to sync your messages. This scenario affects many staff members of the Nancy-Metz academy since the gradual migration to the national messaging system hosted on the ministry’s servers. Strengthening the security of your PIAL messaging is not just about choosing a good password: you also need to adjust your settings so that each device remains connected without creating vulnerabilities.
Application password: the lock that changes everything on mobile
Before the migration, a single username-password pair was sufficient everywhere. With the national platform, third-party email clients (Thunderbird, Outlook, the Mail app on an iPhone) can no longer always connect with the main account password.
The principle is simple. You generate, from the webmail interface, a dedicated application password for each device. This password only works for IMAP synchronization or SMTP sending. It does not grant access to the web portal or other academic services.
Why does this constraint improve security? If your phone is stolen or compromised, you only revoke the application password linked to that device. The rest of your access remains intact. Configuring your PIAL messaging in Nancy-Metz on a smartphone or third-party client now goes through this step, which replaces the old shared unique password across all devices.
- Create a distinct application password for each device (work phone, personal laptop, tablet).
- Note the creation date of each password and delete those corresponding to devices you no longer use.
- If you have doubts about the security of a terminal, revoke the relevant password immediately from webmail, then regenerate a new one.
SMTP and IMAP settings: encryption and authentication on academic messaging
A strong password protects nothing if the connection between your device and the server is transmitted in plain text. Recent guides from the Nancy-Metz academy point towards stricter settings than in the past.
The sending server (SMTP) and the receiving server (IMAP) must be configured with an encrypted connection via SSL or TLS. Depending on the migration context, the server address may be smtp.ac-nancy-metz.fr or smtp.education.gouv.fr. Check the guidelines provided by your institution to see which one is active for your account.
Check your settings in three points
You may have already noticed that a poorly configured email client sometimes sends messages without encrypting them? Here’s what to check.
First, the connection port. Port 993 for IMAP and port 465 or 587 for SMTP are the secure standards. If your software uses port 143 (unencrypted IMAP) or 25 (open SMTP), the connection is vulnerable.
Next, the type of authentication. Select “normal password” or “encrypted password” according to the options provided, but never “no authentication.” With an application password, this authentication is mandatory.
Finally, disable the “allow insecure connections” option if your client offers it. Thunderbird and Outlook sometimes display this box when the server’s certificate changes after a migration.
Reducing the attack surface: archiving and managing stored data
The security of an email system is not only about the password or encryption. The amount of messages kept on the server or locally on a workstation also poses a risk.
Imagine that a shared workstation in a teachers’ lounge is compromised. If entire years of emails containing student data are stored locally, the impact is much more severe than if only the current semester’s messages are present.
Recent recommendations encourage archiving your email by school year. Specifically, at the end of the year, you export your messages to a file (in .mbox or .pst format depending on your client), then delete the old messages from the server. This habit limits exposure in case of an incident and speeds up synchronization on mobile devices.
Keep a server copy during the transition
As long as the migration to the national platform is not completed for your account, keep a copy of your messages on the academic server. Some staff members have lost access to emails by deleting their local copy too early before the transfer was finished. Ensure that synchronization is complete before purging anything.
Targeted phishing on academic accounts: recognizing common traps
National Education email accounts are regularly targeted by phishing campaigns. Fraudulent messages often mimic a notification from the rectorate or a security alert from webmail, with a link to a fake login page.
Two reflexes can help thwart the majority of these attempts. The first: never enter your NUMEN identifier or password after clicking on a link received by email. Always access webmail by typing the address directly into your browser.
The second: immediately report any suspicious message via the academic support service. A quick report can block the campaign before it affects other colleagues in the Nancy-Metz academy.
- Check the sender’s address: a domain that does not end exactly with ac-nancy-metz.fr or education.gouv.fr is suspicious.
- Beware of messages that create artificial urgency (“your account will be disabled in 24 hours”).
- Never download an unexpected attachment with an .exe, .zip, or .html extension.
The security of a PIAL messaging system relies on a combination of technical settings and daily habits. The application password protects mobile access, SMTP and IMAP encryption secures exchanges, regular archiving reduces data exposure, and vigilance against phishing completes the system. Each measure taken in isolation contributes little, but their combination makes an academic account significantly more resistant to compromises.