Corporate email services often use web-based solutions like gmail or office365.
Is there any valid security concern in allowing third party email clients if two factor authentication is enabled on the email accounts?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
The most obvious problem is that, by allowing users to install email clients on their computers, the attack surface of the company's network is increased; the IT will have to (or even worse, they don't have to) maintain all the new software (email clients) that is installed to users' computers, which may or may not be done properly (allowing software vulnerabilities go unnoticed until otherwise).
Also, since the IT department has to allow access to IMAP/POP ports from everywhere, password spraying or plain brute force attacks may become an issue (attacking IMAP/POP servers is easier than a web based email service).
It's also a matter of company strategy against data leakage - they may not want you to have a copy of every email that reaches you by accident.
However, the biggest problem is that you weaken significantly any data breach protection mechanism you have in place. For example, several companies do not allow using USB sticks to trasfer data in and/or out of their users' computers. By allowing email clients, imagine how easy it is for every disgruntled employee to download sensitive or restricted company emails to any computer which is outside of the control of the company. This can go as far as corporate espionage, where an employee can find for example the next year's commercial plans, email the plans to themselves, download them to their computers and sell them to a competitor.
Although you can also do such things by using a web email client (e.g. by copying the email text or taking screen shots), it's a lot easier if you can download all available emails to your computer and go through them at the comfort of your home; a company can cut you out from their network at will, but they cannot raid your home and seize your computer in order to get back those emails you have (unless they have the legal right to - but at that point you know you did something wrong and you will have taken your counter measures). Plus, traffic analysis is far easier by monitoring selective downloading of attachments, than trying to figure out who has bad intentions when everyone downloads everything at their computer.
Is there any valid security concern?
Yes, the most obvious one being that there's now going to be third party clients having access to corporate email accounts, and by extension corporate data. Whatever browser/client you use can at the very least read your emails.
In a perfect world this wouldn't matter and it would be possible to completely handle security at the server side, since it will all boil down to some API calls and SMTP/IMAP connections, but realistically, these third party clients are their own programs, and may have their own vulnerabilities - it's not a realistic workload for your average IT department to handle.
The IT departments of most smaller orgs likely won't concern themselves with this kind of risk, since it's very generic and can basically happen anyway (ex. vulnerabilities in one browser vs. another, malicious extensions, etc.), but larger orgs will likely have policies in place enforcing that corporate email should only be accessed from corporate devices, which are ultimately administered by IT -- that way they can define what email clients/browsers have been vetted & approved, in addition to being able to force/centralize updates instead of leaving it up to the user.