550 5.7.708: Access Denied, Traffic Not Accepted From This IP (Microsoft 365)

550 5.7.708 means Exchange Online refused to send mail out of your Microsoft 365 organization because it came from an IP address with low reputation. Microsoft says it mostly hits new customers, especially tenants on a Microsoft 365 trial. There's no self-service delisting: an admin has to contact Microsoft Support, and on a trial, request an IP address exception until Exchange Online licenses are assigned.

A real bounce, as posted to Microsoft Q&A:

550 5.7.708 Service unavailable. Access denied, traffic not accepted
from this IP. For more information please go to
http://go.microsoft.com/fwlink/?LinkId=526653 AS(7230)

Microsoft's documentation gives the core text as 5.7.708 Access denied, traffic not accepted from this IP.

What it means

Most Microsoft bounce codes in this series are about mail coming into Microsoft 365. 5.7.708 is different: it's Exchange Online stopping mail going out of your own tenant. Your users send, and the NDR comes back from Microsoft, not from the recipient's server. That's why it hits every recipient domain at once, Gmail and Yahoo included.

Microsoft groups it with a family of outbound blocks in the 5.7.700 to 5.7.750 range:

Microsoft's NDR reference lists 5.7.705 and 5.7.708 in the same row with a shared explanation (most of the tenant's traffic looks suspicious, so its sending ability is banned), while the dedicated troubleshooting article separates them as in the table. Either way, it's an outbound restriction on your organization.

Microsoft doesn't say exactly which IP it judges. If an on-premises Exchange server, application or scan-to-email device relays through Exchange Online via a connector, that connecting IP is a likely candidate, since Microsoft doesn't own its reputation.

Common causes

Most likely first:

1. A new or trial tenant. Microsoft names this directly. Brand-new organizations have no sending history for Microsoft to go on.
2. Relaying through a connector from a low-reputation IP. A hybrid server, line-of-business app or printer on a residential, recycled or previously abused IP.
3. Suspicious outbound traffic. A compromised account or connector pushing spam. If the tenant is actually sending spam, you may also see 5.7.705 or users restricted with 550 5.1.8.

How to fix it

Only a Microsoft 365 admin in your organization can fix this.

1. Confirm it's outbound. Check that the NDR came from Exchange Online for mail your users sent, and that multiple recipient domains are affected.
2. Rule out a compromise first. Look for mailboxes with unusual sent volume, new inbox or forwarding rules, unfamiliar sign-ins, and connectors nobody remembers creating. If you find one, secure it (reset credentials, revoke sessions, enforce MFA) before anything else. Microsoft won't lift a block on a tenant that's still sending spam.
3. Check your connectors. If on-premises servers or devices relay through Exchange Online, note their public IPs and check them against public blocklists. The blocklist overview explains which matter.
4. If you're on a trial, assign licenses or ask for an exception. Microsoft's documented fix is to contact Microsoft Support and request an IP address exception until you assign Exchange Online licenses.
5. Otherwise, open a Support case. Include the full NDR, the affected senders and what you've checked. There's no portal; sender.office.com is for external senders blocked by Microsoft 365, not for your own tenant's outbound restrictions.

How to confirm it's fixed

After Support confirms the change, send test messages from an affected mailbox to a few outside domains (a Gmail address, a Microsoft 365 address at another company) and check they're delivered. Then watch message trace in the Exchange admin center for further 5.7.708 NDRs over the next few days.

How to keep it from coming back

• Enforce multifactor authentication for every account, admins first. A compromised admin who creates connectors is one of Microsoft's named causes of outbound blocks.
• Review connectors and their source IPs periodically, and remove ones nobody uses.
• Don't run bulk marketing mail through Microsoft 365. Use an ESP with its own IPs and authentication.
• Add and verify every domain your users send as, to stay clear of 5.7.750.

When to get help

If Support lifts the block and it returns, or you can't tell whether the tenant was compromised, it's worth having someone review the setup with you. A recurring outbound block usually has a cause you haven't found yet.

FAQ

Is 5.7.708 a blocklist I can check?

No. It's an internal Exchange Online restriction on your tenant, not a public DNS blocklist. Checkers won't show it.

Can I use the delist portal?

No. The sender.office.com portal is for external senders blocked from reaching Microsoft 365 mailboxes, which is 550 5.7.606-649. 5.7.708 is resolved through Microsoft Support.

Why did it start right after we moved to Microsoft 365?

New tenants have no reputation, and Microsoft says 5.7.708 is more likely to affect new customers, particularly on trials. Assigning licenses and contacting Support is the documented path.

Does it affect inbound mail?

5.7.708 is about mail your organization sends. Microsoft's documentation describes it only as an outbound block, so inbound mail problems likely have a separate cause.