550 5.1.8: Access Denied, Bad Outbound Sender (Microsoft 365)

A 550 5.1.8 means Microsoft 365 has stopped one of your users from sending email. The account tripped Microsoft's outbound spam protection, almost always because it was compromised and used to send spam, or because the person sent far more mail than Microsoft 365 allows. The user can still receive mail. Only an admin can fix it: secure the account, then unblock it in the Microsoft Defender portal.

This is about your own outgoing mail, not your reputation at someone else's server. The recipient's system never saw the message.

What the bounce says

Microsoft's documentation quotes the full NDR:

Your message couldn't be delivered because you weren't recognized as a
valid sender. The most common reason for this is that your email address
is suspected of sending spam and it's no longer allowed to send email.
Contact your email admin for assistance.
Remote Server returned 550 5.1.8 Access denied, bad outbound sender.

You'll often see it with a suffix like AS(42004) or AS(42003). Microsoft doesn't document what those mean, and the fix is the same.

What it means

When a user exceeds Microsoft 365's sending limits, or the limits in your outbound spam policy, Microsoft adds them to the Restricted entities page and blocks them from sending. Microsoft defines a restricted entity as a user or connector "blocked from sending email due to indications of compromise." Admins also get an alert called User restricted from sending email, if alert policies are on (they are by default).

The block protects Microsoft's shared outbound IPs. If a hijacked mailbox could keep sending, every other tenant's mail would suffer for it.

Common causes, most likely first

1. A compromised account. Someone phished the password, signed in, and used the mailbox to send spam or phishing. This is the case Microsoft's documentation leads with.
2. A legitimate bulk send. Someone tried to email a big list from Outlook. Exchange Online mailboxes are limited to 10,000 recipients a day and 30 messages a minute, and Microsoft says Exchange Online isn't meant for bulk mail.
3. An outbound spam policy limit. Your tenant's outbound spam policy can set hourly external, hourly internal and daily recipient limits. If the policy's action is "Restrict the user from sending mail," the user lands on Restricted entities until an admin removes them.
4. An app or device sending as the user. A scanner, CRM or script that sends through a user's mailbox counts against that user's limits.

How to fix it

If you're the user: check whether your account may be compromised (unexpected sent items, password reset emails you didn't ask for, sign-in alerts) and tell your admin. You can't remove the block yourself.

If you're the admin:

1. Find out why the user was restricted. Microsoft suggests checking sign-in logs for suspicious activity, looking for unknown inbox rules or forwarding rules, and reviewing recent sent items.
2. If it's compromised, secure the account. Reset the password, sign the user out of all sessions, turn on multifactor authentication, and remove any inbox or forwarding rules the attacker created. Microsoft's guide to responding to a compromised account covers the full list.
3. Unblock the user. In the Microsoft Defender portal, go to Email & collaboration > Review > Restricted entities, select the user, and choose Unblock. The flyout lets you require MFA and reset the password as part of the unblock. In Exchange Online PowerShell, the equivalent is Remove-BlockedSenderAddress -SenderAddress user@example.com.
4. Wait. Microsoft says restrictions are usually removed within an hour, and should take no longer than 24 hours.
5. If it was a legitimate bulk send, move that mail to a proper sending platform. Microsoft points bulk senders to Azure Communication Services Email or a third-party bulk provider.

How to confirm it's fixed

Have the user send a test to an external address and check it arrives. Confirm the user no longer appears on the Restricted entities page. If the test still bounces with 5.1.8 after 24 hours, check that you unblocked the right account (for a hosted mailbox, PowerShell expects the user principal name) and open a support case in the Microsoft 365 admin center.

Then look at what the account sent while it was compromised. If it sent phishing to customers or partners, they may need a heads-up. If the attacker's mail went out with your domain in the From address, watch your DMARC reports for the following days.

How to keep it from coming back

• Require MFA for every account. It's the single biggest defense against the compromise that causes most 5.1.8s.
• Keep the User restricted from sending email and Email sending limit exceeded alert policies on, and make sure someone actually reads them.
• Review your outbound spam policy limits and action. "Restrict the user from sending mail until the following day" is the default.
• Keep bulk and marketing mail off Microsoft 365 mailboxes. Use a dedicated sending service on its own subdomain with SPF, DKIM and DMARC set up; the email checker will confirm they pass.

Related Microsoft 365 errors: 550 5.7.511 (a banned sender) and 550 5.7.708 (traffic not accepted from an IP). If outgoing mail is delivering but landing in spam, see why business emails go to spam.

When to get help

If accounts keep getting restricted after you've reset passwords and turned on MFA, or you need to send volume that Microsoft 365 won't allow, it's worth getting help setting up the right sending setup. Get in touch.

FAQ

Can the user still receive email while restricted?

Yes. Microsoft's documentation says a restricted user can still receive mail. Only sending is blocked.

How long does a 550 5.1.8 block last?

It depends on your outbound spam policy. With "Restrict the user from sending mail until the following day," it clears the next day (UTC). With "Restrict the user from sending mail," it lasts until an admin removes the user from Restricted entities.

Does 550 5.1.8 mean my domain is blocklisted?

No. It's a restriction on one account inside your own Microsoft 365 tenant. Your domain and other users can still send.

What are Microsoft 365's sending limits?

Microsoft documents 10,000 recipients a day and 30 messages a minute per mailbox, and up to 1,000 recipients per message. Outbound spam detection has separate thresholds that Microsoft deliberately doesn't publish.