550 5.1.8: access denied, bad outbound sender
Microsoft 365 has blocked this account from sending email because it exceeded the service's sending limits, which usually means it was sending spam after being compromised.
Your message couldn't be delivered because you weren't recognized as a valid sender. The most common reason for this is that your email address is suspected of sending spam and it's no longer allowed to send email. Contact your email admin for assistance. Remote Server returned 550 5.1.8 Access denied, bad outbound sender.
The complete NDR text, as given in Microsoft's article on 550 5.1.8.
What 550 5.1.8 means
Microsoft says this NDR is generated when a user tries to send a message after their account exceeds the sending limits in Exchange Online. Its NDR reference adds that the account was blocked for sending too much spam, and that this typically happens because the account was compromised (hacked) by phishing or malware. The bounce goes to your own user: it's your Microsoft 365 organization refusing to send, not the recipient refusing to receive.
When this happens, the user can still receive email but can't send it, and Microsoft adds the account to the Restricted entities page in the Microsoft Defender portal. A default alert policy named "User restricted from sending email" notifies admins.
Unblocking alone isn't the fix. Microsoft says exceeding the outbound limits is an indicator of a compromised account, and asks admins to regain control of the account before removing the restriction. Its compromised-account guide lists the usual signs: inbox rules that forward mail to unknown addresses or hide messages, suspicious messages in Sent Items or Deleted Items, new external forwarding, and unexplained password changes or lockouts. If you unblock without removing the attacker, the account is likely to be restricted again.
After an admin unblocks the account, Microsoft says restrictions are usually removed within one hour, and the total wait should be no longer than 24 hours.
Likely causes
- The account was compromised, typically through phishing or malware, and used to send spam.
- The account exceeded Exchange Online's sending limits or the limits in the organization's outbound spam policy.
- An app or script using the mailbox sent far more mail than normal.
How to fix it
If you sent the message
- As a user: check whether your account is compromised, then tell your email admin. You can't lift the block yourself.
- As an admin: secure the account first. Reset the password (don't email the new one to the user), revoke active sessions, review MFA methods, and remove suspicious inbox rules and forwarding.
- Then unblock the user in the Microsoft Defender portal under Email & collaboration > Review > Restricted entities, or with Remove-BlockedSenderAddress in Exchange Online PowerShell.
- Turn on multifactor authentication for the account, and check that the "User restricted from sending email" alert reaches the right people.
If you're the recipient or their admin
- No action needed by the recipient: the block is in the sender's Microsoft 365 organization. Treat any odd messages you received from that account with care, because it may have been compromised.
Frequently asked questions
Does a 550 5.1.8 block stop the mailbox receiving mail?
No. Microsoft says a restricted user can't send email but can still receive it. The account stays on the Restricted entities page until an admin removes it.
Why does the block keep coming back?
Usually because the attacker still has access, through a password they know, an active session, a rogue MFA method or app consent, or a forwarding rule. Work through Microsoft's compromised-account steps before you unblock again.
Sources
- Fix NDR error 550 5.1.8 in Exchange Online (Microsoft Learn)
- Remove blocked users from the Restricted entities page (Microsoft Learn)
- Respond to a compromised email account in Microsoft 365 (Microsoft Learn)
- Email nondelivery reports (NDRs) and SMTP errors in Exchange Online (Microsoft Learn)
Provider messages are quoted as the provider publishes them. Servers can change their wording, so the bounce you received may differ slightly.
Related codes
Related guides
Microsoft 365 user restricted from sending (550 5.1.8): how do you investigate and unblock it?
Fix 550 5.1.8 Access denied, bad outbound sender: why Microsoft 365 restricts users, how to check for compromise, unblock on Restricted entities, prevent it.
9 min read Phishing & threatsSigns your business email account has been compromised, and what to do
The warning signs of a hacked business mailbox, from hidden inbox rules to MFA prompts, and the step-by-step response for Microsoft 365 and Google Workspace.
10 min read Phishing & threatsHow to prevent business email compromise (BEC)
What business email compromise is, what the FBI's 2025 IC3 figures show, and the payment checks and technical controls that stop BEC fraud at small firms.
9 min read