One user suddenly can't send any mail. Every message bounces with 5.1.8, yet mail still arrives in their inbox. Exchange Online has placed the account on the Restricted entities list because it sent more than the outbound limits allow, and Microsoft treats that as a sign of compromise. In this post I'll go through the order that matters: secure the account, find out what it sent, lift the block, then tune limits and alerts so you hear about it first next time.
Errors this guide fixes
550 5.1.8 Access denied, bad outbound senderNDRYour message couldn't be delivered because you weren't recognized as a valid sender.NDR (user text)User restricted from sending emailMicrosoft Defender portal (alert)+1 more guideEmail sending limit exceededMicrosoft Defender portal (alert)Suspicious email sending patterns detectedMicrosoft Defender portal (alert)5.1.90 Your message can't be sent because you've reached your daily limit for message recipientsNDRThe message can't be submitted because the sender's submission quota was exceededNDR
Symptoms#
Every message the user sends comes back with this non-delivery report (NDR), as Microsoft documents it:
Your message couldn't be delivered because you weren't recognized as a valid sender. The most common reason for this is that your email address is suspected of sending spam and it's no longer allowed to send email. Contact your email admin for assistance.
Remote Server returned 550 5.1.8 Access denied, bad outbound sender- The user still receives mail. Only sending is blocked.
- The account appears on the Restricted entities page in the Microsoft Defender portal.
- Admins may have received the default alerts User restricted from sending email, Email sending limit exceeded or Suspicious email sending patterns detected. By default they go to Global Administrators.
- Related NDRs for the same sending limits are
5.1.90 Your message can't be sent because you've reached your daily limit for message recipientsorThe message can't be submitted because the sender's submission quota was exceeded. Microsoft notes that both can mean the account was compromised.
Why it happens#
When a user exceeds the service's outbound sending limits or the limits in an outbound spam policy, Microsoft 365 restricts the account from sending and adds it to Restricted entities. Suspicious outbound mail is also routed through a separate high-risk delivery pool to protect the service's reputation. Microsoft documents the per-user recipient rate limit as 10,000 recipients per day. It and the message rate limit are hard limits that can't be raised.
Microsoft's position is that a sender exceeding outbound limits indicates a compromised account. Usually that's true: a phished account sends spam until the limit trips. Sometimes the volume is legitimate, for example a scanner or line-of-business app that sends through a user's mailbox with SMTP AUTH, or a user sending a large mailing by hand. Inbound connectors can be restricted too, and they show the entity type Connector on the same page.
How to fix it#
- Secure the account before you unblock it. Microsoft requires this step. Reset the password, revoke sessions, review MFA methods and app consents, and remove any forwarding or Inbox rules you didn't expect. The compromised mailbox guide walks through it with scripts.
- See what was sent. Message trace shows whether it was spam or a legitimate burst:
PowerShell
Connect-ExchangeOnline Get-MessageTraceV2 -SenderAddress adele@contoso.com -StartDate (Get-Date).AddDays(-2) -EndDate (Get-Date) -ResultSize 5000 | Group-Object Subject | Sort-Object Count -Descending | Select-Object -First 10 Count, NameHundreds of copies of an invoice or a password-reset lure point to compromise. Identical alert mails from an app point to a device using the mailbox.
- Remove the restriction. In the Microsoft Defender portal, go to Email & collaboration › Review › Restricted entities (or open
security.microsoft.com/restrictedentities), select the user and unblock it. You need Organization Management or Security Administrator permissions. In Exchange Online PowerShell:PowerShellGet-BlockedSenderAddress Remove-BlockedSenderAddress -SenderAddress adele@contoso.com -Reason "Password reset, sessions revoked, rules cleaned"Microsoft says the restrictions are usually removed within an hour. The number of times you can unblock an account is limited. Beyond that limit, you get an error and only Microsoft Support can unblock the user.
- If the volume was legitimate, move it off the mailbox. For apps and devices that send a lot, Microsoft recommends SMTP relay through a connector or a non-Microsoft bulk email service instead of SMTP AUTH with a user account (relay options). Otherwise, the same account will be blocked again.
- Review the outbound spam policies. In Email & collaboration › Policies & rules › Threat policies › Anti-spam, each outbound policy sets hourly external and internal recipient limits, a daily limit, and what happens when a user reaches one. The options are alerting only, blocking until the next day, or blocking until an admin unblocks the user. A policy with lower limits can produce this NDR without any compromise.
PowerShell
Get-HostedOutboundSpamFilterPolicy | Format-List Name, RecipientLimitExternalPerHour, RecipientLimitInternalPerHour, RecipientLimitPerDay, ActionWhenThresholdReached
Watch out: unblocking a compromised account without securing it first puts the attacker straight back in business. Because the unblock count is limited, a second block may leave you waiting for Microsoft Support.
Verify the fix#
Get-BlockedSenderAddressno longer lists the user, and the Restricted entities page is clear.- A test message to an external mailbox shows Delivered in message trace:
PowerShell
Get-MessageTraceV2 -SenderAddress adele@contoso.com -StartDate (Get-Date).AddHours(-1) -EndDate (Get-Date) | Format-Table Received, RecipientAddress, Subject, Status - The user's sign-ins show only known devices and locations, and no new restriction alerts arrive over the following days.
Two other blocks look similar but don't clear from Restricted entities. If the NDR says 5.7.501 Access denied, spam abuse detected or 5.7.502/5.7.503 Access denied, banned sender, the account was banned for spam. Microsoft's guidance is to resolve the account issues, reset its credentials and contact Microsoft Support to restore sending. If the whole tenant can't send rather than one user, you are looking at a tenant-level block such as 5.7.705 or 5.7.708, which only Microsoft Support can lift.
Prevent it next time#
- Require MFA for every user, and phishing-resistant methods for admins. Most restricted users are compromised users.
- Microsoft recommends the default alert policies over the notification settings in outbound spam policies. Under Email & collaboration › Policies & rules › Alert policy, make sure they reach a monitored mailbox, not only the Global Administrators.
- Keep bulk mail, newsletters and app notifications off user mailboxes.
- Check the outbound mail flow reports in the Exchange admin center regularly, so a sending spike stands out before the service blocks it.
