A Practical Guide to Online Accounts in elementary OS
elementary OS can connect your email, calendars, and contacts to the desktop through its Online Accounts settings. Once configured, supported applications can use the same account without requiring separate credentials in each program. This creates a smoother workflow for people who rely on webmail, shared calendars, address books, or hosted productivity services.
The feature is especially useful with standards-based services. IMAP handles email synchronization, while CalDAV and CardDAV provide calendar and contact access. These protocols are common among providers such as Fastmail, mailbox.org, Nextcloud, self-hosted servers, and many business hosting platforms.
The exact screens and provider options can vary between elementary OS releases and installed applications. Some services offer a convenient sign-in window with OAuth, while others require manual server details. Understanding what each protocol does makes setup and troubleshooting much easier.
What Online Accounts Connect
Online Accounts acts as a central account configuration layer in elementary OS. You usually open it from System Settings, choose an account type, and enter either a web-based login or the connection details supplied by your provider. The account can then become available to mail, calendar, and contacts applications that support the corresponding service.
IMAP is used for email synchronization. It keeps messages on the server and lets a mail application display folders, read status, flags, and drafts across multiple devices. IMAP does not send outgoing messages, so SMTP settings are also needed for composing and sending mail. Many modern providers configure SMTP automatically, but manual accounts may require both incoming and outgoing server information.
CalDAV is the protocol used for calendars. It supports events, reminders, recurring appointments, and, depending on the service, shared calendars. CardDAV performs a similar role for contacts and address books. A single hosted account may expose all three services, although each endpoint can have a different address.
Adding an account does not necessarily install a new application. It gives compatible desktop tools access to the account. For example, a mail client may use IMAP, a calendar application may use CalDAV, and a contacts application may use CardDAV through the system’s account services.
Before Adding An Account
Collect the details provided by your email or hosting company before opening the account panel. For a manual setup, you may need the username, password, IMAP hostname, SMTP hostname, ports, encryption method, CalDAV URL, and CardDAV URL. In many cases, the username is the complete email address rather than the part before the “@” symbol.
Secure connections should be the default. IMAP commonly uses port 993 with SSL/TLS, while SMTP often uses port 465 with SSL/TLS or port 587 with STARTTLS. CalDAV and CardDAV normally use HTTPS, usually through port 443. Providers can use different settings, so their documentation should take priority over generic port numbers.
Two-factor authentication changes the login process. A normal account password may be rejected by IMAP, CalDAV, or CardDAV when the provider blocks basic authentication. In that situation, create an app-specific password if the provider offers one. Treat it as a real credential: store it in the desktop keyring, do not paste it into forum posts, and revoke it if the device is lost.
It is also worth checking whether the provider uses OAuth. Google, Microsoft, and some other large services may open a browser-based authorization page instead of asking the account panel for a password. OAuth tokens can expire, be revoked, or require renewed permission, so a sign-in prompt does not always mean the account password has changed.
Adding IMAP Email
Open System Settings and select Online Accounts. Choose the generic IMAP or email option if your provider does not have a dedicated entry. Enter the account name and email address, then provide the incoming mail server information. Select SSL/TLS whenever it is available and use the full mailbox address as the username unless the provider specifies another format.
The outgoing server is configured separately in many mail applications. Enter the SMTP hostname, select the recommended encryption method, and choose password authentication if required. Port 587 with STARTTLS is a common choice, but port 465 with direct SSL/TLS is also widely used. Avoid unauthenticated SMTP unless you are on a tightly controlled internal network and understand the consequences.
After saving the account, open the installed mail application and allow time for the first synchronization. Large mailboxes may take several minutes to build local indexes. Check whether folders such as Sent, Drafts, Archive, and Trash are mapped correctly. A provider may use nonstandard folder names, and some applications let you select the correct special folders manually.
IMAP synchronization is not the same as a backup. Deleting a message in a synchronized mailbox can delete it from the server and every other connected device. For important mail, maintain a separate backup strategy, such as exporting messages or using a provider with retention and recovery features.
Configuring CalDAV And CardDAV
For calendars and contacts, select the relevant CalDAV or CardDAV option in Online Accounts. Some providers present one account that automatically exposes both services. Others require separate entries or application-specific URLs. Copy the address exactly, including the path after the domain name. A server hostname alone may connect successfully but still fail to locate the actual calendar or address book.
The first synchronization may ask which calendars or address books should be enabled. Keep personal and shared resources separate if you want clearer organization. A read-only calendar may be available for viewing but reject event creation, while a shared address book may allow edits only to selected users.
Calendar time zones deserve attention. Set the correct local time zone in elementary OS and verify the calendar’s default zone in the calendar application. A mismatch can make events appear shifted, particularly when an account contains appointments created by people in different regions. Recurring events should be tested as well because they can expose timezone or daylight-saving problems.
CardDAV synchronization can behave differently from local contacts. Duplicate entries may appear if the same people are stored in more than one address book. Before importing a large contact collection, review the destination address book and export a backup if the provider supports it. Test creating, editing, and deleting one contact before moving your entire address book.
| Service | Protocol | Typical purpose | Common secure connection | Frequent issue |
|---|---|---|---|---|
| Email reception | IMAP | Messages, folders, read status, drafts | Port 993 with SSL/TLS | Wrong username or disabled IMAP |
| Email sending | SMTP | Outgoing mail | Port 587 with STARTTLS or 465 with SSL/TLS | App password or authentication rejected |
| Calendars | CalDAV | Events, reminders, shared calendars | HTTPS, usually port 443 | Incorrect collection URL or timezone |
| Contacts | CardDAV | Address books and contact records | HTTPS, usually port 443 | Duplicate contacts or wrong address-book path |
| Modern sign-in | OAuth | Browser-based authorization and tokens | Provider-managed HTTPS flow | Expired or revoked permission |
Understanding Application Access
An account may appear in System Settings while remaining invisible in a particular application. This usually means the application does not support that account service, the necessary desktop integration component is missing, or the account has not been enabled for that application. Online Accounts is a shared configuration point, not a guarantee that every program will consume every protocol.
elementary OS applications commonly use desktop services to share credentials and synchronized data. The mail client may access a mail account through IMAP, while a calendar app reads events through the system’s calendar data service. Contacts integration can depend on the address-book backend and on whether the application supports system contacts rather than only its own database.
Permissions may be presented during setup or the first application launch. Grant only the services you need. If you want email but do not want a calendar or address book synchronized locally, disable those components where the account settings provide that choice. Reducing enabled services also makes troubleshooting easier.
An account name is only a label. You can rename “Work Mail” or “Personal” without changing the server, username, or remote data. Clear names are useful when several accounts use the same provider, especially when calendars and contacts from different organizations are present together.
Troubleshooting Synchronization Problems
Start by identifying which protocol is failing. If receiving mail works but sending does not, inspect SMTP rather than deleting and recreating the entire account. If calendars are visible but contacts are missing, check CardDAV separately. Narrowing the problem prevents a working service from being disrupted unnecessarily.
Authentication errors usually point to an incorrect password, a blocked legacy login, a missing app password, or an expired OAuth authorization. Visit the provider’s security page and look for blocked sign-ins, device approval requests, or application-password controls. Re-entering the same ordinary password will not solve a provider policy that requires OAuth or an app-specific credential.
Connection errors can result from a wrong hostname, port, encryption mode, firewall, VPN, or system clock. An incorrect clock can invalidate secure certificates and OAuth tokens. Test the account on a different network and check whether the provider’s web interface is available. If webmail works but the protocol does not, review whether IMAP, CalDAV, or CardDAV access has been enabled for the account.
A calendar or address book that fails to load may have an incomplete URL. Providers often publish separate instructions for desktop clients, mobile apps, and third-party software. Do not guess the collection path from the website address. Copy the documented endpoint and check whether it includes a user ID, mailbox name, or unique calendar identifier.
When an account is stuck after several failed attempts, remove it only after confirming that all unsent drafts and locally created events are safe. Removing a connection normally removes the local account configuration, not the remote mailbox, but unsynchronized changes can be lost. Re-add the account with the correct authentication method and allow the data service to rebuild its local cache.
Keeping Accounts Secure And Reliable
The desktop keyring protects saved credentials from being stored as plain text in ordinary application settings. Use a strong login password for the computer and avoid saving account credentials on shared machines. If you use an app password, give it the narrowest permissions available and remove it from the provider when it is no longer needed.
Regularly review connected applications in the security dashboard of each provider. Revoke tokens for devices you no longer use, old installations, and applications that have been replaced. This is particularly important for OAuth accounts, because removing an application locally does not always revoke its server-side authorization.
A dependable setup benefits from small, deliberate tests:
- Send a message to yourself and verify both delivery and the Sent folder.
- Create a test calendar event, synchronize it, and confirm it appears on the provider’s web interface.
- Add a temporary contact and check whether changes travel in both directions.
- Confirm that shared calendars and address books have the permissions you expect.
- Record provider-specific server details in a secure password manager rather than in plain notes.
Keep elementary OS and its mail, calendar, contacts, and account components updated. Updates can improve OAuth compatibility, certificate handling, protocol support, and synchronization reliability. When reporting a problem, include the elementary OS release, application name, protocol, provider, and exact error message, while removing email addresses, tokens, and server credentials.
Making The Most Of Standards-Based Accounts
The main advantage of IMAP, CalDAV, and CardDAV is portability. Your data is not tied entirely to one desktop application, so it can be used from elementary OS, a phone, a browser, or another Linux distribution. This makes standards-based hosting attractive for users who want control over their provider or who maintain a personal Nextcloud or mail server.
There are trade-offs. A provider’s proprietary features may not appear through standard protocols, and some services offer better integration through their dedicated OAuth connector. Labels, advanced search, server-side filters, video meeting links, and task lists may require a browser or specialized application. The basic protocols still cover the central functions reliably, but they do not promise identical behavior across every client.
Use the web interface when you need account administration, recovery tools, advanced filtering, or provider-specific features. Use elementary OS applications for everyday reading, composing, scheduling, and contact lookup. This division keeps the desktop workflow convenient while preserving access to controls that are outside IMAP, CalDAV, and CardDAV.
Once an account is working, avoid changing several settings at once. Test one protocol, confirm its behavior, and then enable the next service. That method gives you a clear record of what works and makes future migrations or troubleshooting considerably less disruptive.
Set up one account carefully, verify mail, calendars, and contacts independently, and then apply the same method to additional services. If a provider’s documentation conflicts with generic instructions, follow its published server addresses and authentication requirements. For unusual configurations, share sanitized error details with the elementary OS community through the forums so others can help diagnose the connection without exposing private credentials.
