# Microsoft 365 user restricted from sending (550 5.1.8): how do you investigate and unblock it?

URL: https://iblockspam.com/blog/microsoft-365-user-blocked-from-sending
Last updated: 2026-10-09
Published: 2026-10-09
Topic: Phishing & threats
Author: iBlockSpam Team

> Fix 550 5.1.8 Access denied, bad outbound sender: why Microsoft 365 restricts users, how to check for compromise, unblock on Restricted entities, prevent it.

## Short answer

550 5.1.8 Access denied, bad outbound sender means Microsoft 365 restricted the user from sending, usually because the account exceeded sending limits or sent spam, often after being compromised. Secure the account first: reset the password, revoke sessions, check MFA methods, inbox rules and forwarding. Then remove the user on the Restricted entities page in the Defender portal.

A user tells you their email keeps bouncing with "550 5.1.8 Access denied, bad outbound sender." Microsoft 365 has stopped that mailbox from sending. Most of the time, the cause is a compromised account that was used to send spam, so treat it as a security incident first and a mail problem second.

This guide covers what the error means, how to check for compromise, how to unblock the user, and how to stop it happening again.

## What does 550 5.1.8 Access denied, bad outbound sender mean?

The full bounce message reads ([Microsoft Learn](https://learn.microsoft.com/en-us/troubleshoot/exchange/email-delivery/ndr/fix-error-code-550-5-1-8)):

> Your message couldn't be delivered because you weren't recognized as a valid sender. The most common reason for this is that your email address is suspected of sending spam and it's no longer allowed to send email. Contact your email admin for assistance. Remote Server returned 550 5.1.8 Access denied, bad outbound sender.

Microsoft generates it when a user tries to send after their account exceeded the sending limits of the service or the limits in an outbound spam policy. At that point, Microsoft says ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/outbound-spam-restore-restricted-users)):

- The user is restricted from sending email, but can still receive it.
- The user is added to the **Restricted entities** page in the Microsoft Defender portal.
- The default alert policy **User restricted from sending email** notifies admins.

Only an admin can lift the block. Our [550 5.1.8 error reference](https://iblockspam.com/smtp-errors/550-5-1-8) summarizes the code itself; for other codes in this family, use the [SMTP error code lookup](https://iblockspam.com/tools/smtp-error-codes).

## Why does Microsoft 365 block a user from sending?

There are two broad causes, and the fix differs.

### A compromised account

Microsoft says "a sender exceeding the outbound email limits is an indicator of a compromised account" ([Microsoft Learn: restore restricted users](https://learn.microsoft.com/en-us/defender-office-365/outbound-spam-restore-restricted-users)). It also notes that "attackers often use a compromised user's mailbox to send to recipients inside and outside of the organization," which can trip these thresholds ([Microsoft Learn: responding to a compromised account](https://learn.microsoft.com/en-us/defender-office-365/responding-to-a-compromised-email-account)). Microsoft also blocks accounts that send too much spam or too much email too quickly, at an "undisclosed limit" ([Microsoft Learn: outbound spam protection](https://learn.microsoft.com/en-us/defender-office-365/outbound-spam-protection-about)).

### A legitimate send that hit a limit

Sometimes a real person sent a large mailing. These are the published per-user limits ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/outbound-spam-sending-limits-troubleshoot)):

| Limit | Value | Notes |
|---|---|---|
| Recipient rate limit | 10,000 recipients per day (24-hour sliding window) | Messages rejected until the count drops; the user may appear on Restricted entities |
| Message rate limit | 30 messages per minute | Excess is throttled and sent over the following minutes |
| Recipients per message | 500 by default | Admins can change it from 1 to 1,000 per mailbox |
| Outbound spam policy limits | 0 to 10,000 per hour or day, set by you | The action you chose: restrict, restrict until next day, or alert only |

Microsoft says bulk email through Microsoft 365 isn't a supported use of the service, and is permitted only on a "best-effort" basis. If a team needs to send newsletters, move them to a dedicated bulk email service.

If the whole tenant is blocked from sending to external recipients, the bounce differs: `550 5.7.233` for the tenant external recipient rate limit, or `5.7.705` when the tenant has sent too much spam. Our [550 5.7.708 page](https://iblockspam.com/smtp-errors/550-5-7-708) covers the tenant-level codes.

## How do you check whether the account is compromised?

Don't unblock first. Unblocking a compromised account hands it straight back to the attacker. Microsoft lists these symptoms of a compromised mailbox ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/responding-to-a-compromised-email-account)):

- The mailbox is blocked from sending email.
- Inbox rules that forward mail to unknown addresses, or move messages to Notes, Junk Email or RSS Subscriptions.
- Suspicious messages in Sent Items or Deleted Items.
- Recently added external forwarding.
- Changes to the user's contact details or email signature.
- Frequent password changes or unexplained lockouts.

If any of these apply, or you can't rule them out, treat the account as compromised.

## How do you secure a compromised account?

Secure the account completely before you unblock it. Our [compromised account recovery checklist](https://iblockspam.com/blog/signs-email-account-compromised) is the full procedure, with the PowerShell for finding hidden inbox rules and forwarding. In short, following Microsoft's response steps:

1. Disable the account or reset the password from a clean device, and revoke all sessions.
2. Remove app passwords, and any MFA method, device, app consent or admin role the user doesn't recognize.
3. Remove malicious forwarding and inbox rules, including hidden ones.
4. Review sign-in logs, the audit log and message trace for what the attacker did and sent.
5. Turn on MFA if it wasn't on.

If a phishing message caused the compromise, find out who else received it. Our guide on [what to do after clicking a phishing link](https://iblockspam.com/blog/what-to-do-after-clicking-phishing-link) covers the user side. If the attacker emailed customers or suppliers, warn them, because a compromised mailbox can be used to send convincing payment requests. See [vendor invoice fraud](https://iblockspam.com/blog/vendor-invoice-fraud-payment-redirection).

## How do you unblock a user on the Restricted entities page?

Once the account is secure:

1. In the Microsoft Defender portal, go to **Email & collaboration** > **Review** > **Restricted entities**, or open `https://security.microsoft.com/restrictedentities` directly.
2. Find the user. The **Entity** value is **Mailbox**.
3. Select the check box next to the user, then **Unblock**.
4. In the **Unblock user** flyout, read the **Overview** and **Recommendations**, then select **Next**.
5. Use the links to enable MFA and reset the password if you haven't already, then select **Submit**.
6. Confirm the warning with **Yes**.

Microsoft says "all restrictions should be removed from the user within one hour" in most cases, and no longer than 24 hours ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/outbound-spam-restore-restricted-users)).

You can do the same in Exchange Online PowerShell:

```powershell
Get-BlockedSenderAddress
Remove-BlockedSenderAddress -SenderAddress jason@contoso.com
```

For a hosted mailbox, the identifier is the user principal name (UPN), which doesn't have to match the primary email address.

## How do you stop users being blocked again?

### Tune outbound spam policies

Open **Email & collaboration** > **Policies & rules** > **Threat policies** > **Anti-spam** and edit the outbound policy ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/outbound-spam-policies-configure)):

- **Message limits.** Set external, internal and daily recipient limits that fit how your people really send. The default of 0 means Microsoft's service defaults apply.
- **Restriction placed on users who reach the message limit.** The default is **Restrict the user from sending mail until the following day**. **Restrict the user from sending mail** keeps them blocked until an admin acts. **No action, alert only** just notifies.
- **Automatic forwarding rules.** Choose **Off - Forwarding is disabled** unless you need external forwarding. Microsoft advises choosing On or Off explicitly instead of the system-controlled default. Turning it off disables inbox rules and mailbox forwarding to external addresses; a blocked forward can come back to the sender as [550 5.7.520](https://iblockspam.com/smtp-errors/550-5-7-520).

### Make sure someone sees the alert

The **User restricted from sending email** alert goes to the TenantAdmins group by default. Under **Email & collaboration** > **Policies & rules** > **Alert policy**, add the people who actually respond to incidents. Two related alerts, **Email sending limit exceeded** and **Suspicious email sending patterns detected**, are also on by default.

### Reduce the chance of compromise

- Require MFA for everyone, and phishing-resistant MFA for admins.
- Filter inbound phishing well, so fewer credential-phishing emails reach users. Our guide on [stopping phishing in Microsoft 365](https://iblockspam.com/blog/stop-phishing-emails-microsoft-365) covers the settings, and [business email compromise prevention](https://iblockspam.com/blog/business-email-compromise-prevention) covers the payment-fraud side.
- Publish DMARC and move it to an enforcing policy, so receivers can reject mail that spoofs your domain. Check yours with the [DMARC Checker](https://iblockspam.com/tools/dmarc-checker).
- Move newsletters and bulk sends off user mailboxes.

A filtering layer in front of Microsoft 365, such as iBlockSpam, adds another check on inbound phishing before it reaches users. It doesn't replace MFA or the steps above.

## Next steps

1. If a user is blocked right now, disable or reset the account and revoke sessions before anything else.
2. Check inbox rules and forwarding with the two PowerShell commands above.
3. Unblock the user on the Restricted entities page only once the account is secure.
4. Set automatic external forwarding to Off in your outbound spam policy.
5. Run an [Email Health Check](https://iblockspam.com/tools/email-health-check) on your domain to confirm SPF and DMARC are in place.

Browse our other [phishing and threat guides](https://iblockspam.com/blog/topic/threats).

## Frequently asked questions

### How long does it take for a user to be able to send again after unblocking?

Microsoft says that under most circumstances all restrictions are removed within one hour of an admin unblocking the user on the Restricted entities page. Transient issues can make it take longer, but the total wait should be no more than 24 hours.

### Can a user blocked with 550 5.1.8 still receive email?

Yes. A restricted user can't send email, but Microsoft keeps delivering inbound mail to the mailbox. That's also why an attacker with access to the account can keep reading new messages, so secure the account before you unblock it.

### What are the Exchange Online sending limits per user?

Microsoft lists a recipient rate limit of 10,000 recipients per day over a 24-hour sliding window, a message rate limit of 30 messages per minute, and 500 recipients per message by default. Admins can set lower hourly and daily limits in outbound spam policies, up to 10,000.

### Can I unblock a restricted user with PowerShell?

Yes. In Exchange Online PowerShell, Get-BlockedSenderAddress lists restricted senders, and Remove-BlockedSenderAddress -SenderAddress followed by the user's UPN removes the restriction. Do it only after you've secured the account, the same as in the portal.

### Why would Microsoft block a user who only sent a normal newsletter?

Microsoft says bulk email isn't a supported use of Microsoft 365 and its limits are designed to stop mass mailing as well as compromised accounts. A large Bcc send or a newsletter to a big list can trip them. Use a dedicated bulk email service for that mail instead.

## Sources

- [Microsoft Learn: Fix error code 550 5.1.8 in Exchange Online](https://learn.microsoft.com/en-us/troubleshoot/exchange/email-delivery/ndr/fix-error-code-550-5-1-8)
- [Microsoft Learn: Remove blocked users from the Restricted entities page](https://learn.microsoft.com/en-us/defender-office-365/outbound-spam-restore-restricted-users)
- [Microsoft Learn: Responding to a compromised email account](https://learn.microsoft.com/en-us/defender-office-365/responding-to-a-compromised-email-account)
- [Microsoft Learn: Troubleshoot outbound sending limits in Exchange Online](https://learn.microsoft.com/en-us/defender-office-365/outbound-spam-sending-limits-troubleshoot)
- [Microsoft Learn: Configure outbound spam policies](https://learn.microsoft.com/en-us/defender-office-365/outbound-spam-policies-configure)
- [Microsoft Learn: Outbound spam protection](https://learn.microsoft.com/en-us/defender-office-365/outbound-spam-protection-about)
- [Microsoft Learn: Exchange Online limits](https://learn.microsoft.com/en-us/office365/servicedescriptions/exchange-online-service-description/exchange-online-limits)

## Free tools for this guide

- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [SMTP Error Code Lookup](https://iblockspam.com/tools/smtp-error-codes): Paste a bounce or type a code like 550 5.7.26: plain-English meaning, likely causes and fixes, with sources.
- [Blacklist Checker](https://iblockspam.com/tools/blacklist-checker): Check an IPv4 or IPv6 address, or your mail servers, against public spam blocklists, with policy and delisting links.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.

---

Source: iBlockSpam, https://iblockspam.com/blog/microsoft-365-user-blocked-from-sending (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt