Microsoft 365 user restricted from sending (550 5.1.8): how do you investigate and unblock it?

A user tells you their email keeps bouncing with "550 5.1.8 Access denied, bad outbound sender." Microsoft 365 has stopped that mailbox from sending. Most of the time, the cause is a compromised account that was used to send spam, so treat it as a security incident first and a mail problem second.

This guide covers what the error means, how to check for compromise, how to unblock the user, and how to stop it happening again.

What does 550 5.1.8 Access denied, bad outbound sender mean?

The full bounce message reads (Microsoft Learn):

Your message couldn't be delivered because you weren't recognized as a valid sender. The most common reason for this is that your email address is suspected of sending spam and it's no longer allowed to send email. Contact your email admin for assistance. Remote Server returned 550 5.1.8 Access denied, bad outbound sender.

Microsoft generates it when a user tries to send after their account exceeded the sending limits of the service or the limits in an outbound spam policy. At that point, Microsoft says (Microsoft Learn):

• The user is restricted from sending email, but can still receive it.
• The user is added to the Restricted entities page in the Microsoft Defender portal.
• The default alert policy User restricted from sending email notifies admins.

Only an admin can lift the block. Our 550 5.1.8 error reference summarizes the code itself; for other codes in this family, use the SMTP error code lookup.

Why does Microsoft 365 block a user from sending?

There are two broad causes, and the fix differs.

A compromised account

Microsoft says "a sender exceeding the outbound email limits is an indicator of a compromised account" (Microsoft Learn: restore restricted users). It also notes that "attackers often use a compromised user's mailbox to send to recipients inside and outside of the organization," which can trip these thresholds (Microsoft Learn: responding to a compromised account). Microsoft also blocks accounts that send too much spam or too much email too quickly, at an "undisclosed limit" (Microsoft Learn: outbound spam protection).

A legitimate send that hit a limit

Sometimes a real person sent a large mailing. These are the published per-user limits (Microsoft Learn):

Microsoft says bulk email through Microsoft 365 isn't a supported use of the service, and is permitted only on a "best-effort" basis. If a team needs to send newsletters, move them to a dedicated bulk email service.

If the whole tenant is blocked from sending to external recipients, the bounce differs: 550 5.7.233 for the tenant external recipient rate limit, or 5.7.705 when the tenant has sent too much spam. Our 550 5.7.708 page covers the tenant-level codes.

How do you check whether the account is compromised?

Don't unblock first. Unblocking a compromised account hands it straight back to the attacker. Microsoft lists these symptoms of a compromised mailbox (Microsoft Learn):

• The mailbox is blocked from sending email.
• Inbox rules that forward mail to unknown addresses, or move messages to Notes, Junk Email or RSS Subscriptions.
• Suspicious messages in Sent Items or Deleted Items.
• Recently added external forwarding.
• Changes to the user's contact details or email signature.
• Frequent password changes or unexplained lockouts.

If any of these apply, or you can't rule them out, treat the account as compromised.

How do you secure a compromised account?

Secure the account completely before you unblock it. Our compromised account recovery checklist is the full procedure, with the PowerShell for finding hidden inbox rules and forwarding. In short, following Microsoft's response steps:

1. Disable the account or reset the password from a clean device, and revoke all sessions.
2. Remove app passwords, and any MFA method, device, app consent or admin role the user doesn't recognize.
3. Remove malicious forwarding and inbox rules, including hidden ones.
4. Review sign-in logs, the audit log and message trace for what the attacker did and sent.
5. Turn on MFA if it wasn't on.

If a phishing message caused the compromise, find out who else received it. Our guide on what to do after clicking a phishing link covers the user side. If the attacker emailed customers or suppliers, warn them, because a compromised mailbox can be used to send convincing payment requests. See vendor invoice fraud.

How do you unblock a user on the Restricted entities page?

Once the account is secure:

1. In the Microsoft Defender portal, go to Email & collaboration > Review > Restricted entities, or open https://security.microsoft.com/restrictedentities directly.
2. Find the user. The Entity value is Mailbox.
3. Select the check box next to the user, then Unblock.
4. In the Unblock user flyout, read the Overview and Recommendations, then select Next.
5. Use the links to enable MFA and reset the password if you haven't already, then select Submit.
6. Confirm the warning with Yes.

Microsoft says "all restrictions should be removed from the user within one hour" in most cases, and no longer than 24 hours (Microsoft Learn).

You can do the same in Exchange Online PowerShell:

Get-BlockedSenderAddress
Remove-BlockedSenderAddress -SenderAddress jason@contoso.com

For a hosted mailbox, the identifier is the user principal name (UPN), which doesn't have to match the primary email address.

How do you stop users being blocked again?

Tune outbound spam policies

Open Email & collaboration > Policies & rules > Threat policies > Anti-spam and edit the outbound policy (Microsoft Learn):

• Message limits. Set external, internal and daily recipient limits that fit how your people really send. The default of 0 means Microsoft's service defaults apply.
• Restriction placed on users who reach the message limit. The default is Restrict the user from sending mail until the following day. Restrict the user from sending mail keeps them blocked until an admin acts. No action, alert only just notifies.
• Automatic forwarding rules. Choose Off - Forwarding is disabled unless you need external forwarding. Microsoft advises choosing On or Off explicitly instead of the system-controlled default. Turning it off disables inbox rules and mailbox forwarding to external addresses; a blocked forward can come back to the sender as 550 5.7.520.

Make sure someone sees the alert

The User restricted from sending email alert goes to the TenantAdmins group by default. Under Email & collaboration > Policies & rules > Alert policy, add the people who actually respond to incidents. Two related alerts, Email sending limit exceeded and Suspicious email sending patterns detected, are also on by default.

Reduce the chance of compromise

• Require MFA for everyone, and phishing-resistant MFA for admins.
• Filter inbound phishing well, so fewer credential-phishing emails reach users. Our guide on stopping phishing in Microsoft 365 covers the settings, and business email compromise prevention covers the payment-fraud side.
• Publish DMARC and move it to an enforcing policy, so receivers can reject mail that spoofs your domain. Check yours with the DMARC Checker.
• Move newsletters and bulk sends off user mailboxes.

A filtering layer in front of Microsoft 365, such as iBlockSpam, adds another check on inbound phishing before it reaches users. It doesn't replace MFA or the steps above.

Next steps

1. If a user is blocked right now, disable or reset the account and revoke sessions before anything else.
2. Check inbox rules and forwarding with the two PowerShell commands above.
3. Unblock the user on the Restricted entities page only once the account is secure.
4. Set automatic external forwarding to Off in your outbound spam policy.
5. Run an Email Health Check on your domain to confirm SPF and DMARC are in place.

Browse our other phishing and threat guides.