What does error 550 5.1.8 mean in Microsoft 365?

That Microsoft 365 has blocked the sender from sending email, usually because too much or suspicious email was sent from the account. Receiving still works.

Does this mean my account was hacked?

Often, yes. A restricted sender is a strong sign that the account has been compromised. So always secure the account first, even if the cause seems to be a large mailing.

Can a member of staff lift the block themselves?

No. Only an admin with the right permissions can unblock the user, in the Microsoft Defender portal or with Exchange Online PowerShell.

How long until someone can send email again?

After unblocking usually within an hour, and according to Microsoft at most within 24 hours.

Can I send newsletters through Microsoft 365?

Microsoft advises against it: bulk email is not a supported use. Use a separate newsletter service, preferably on its own subdomain with SPF, DKIM and DMARC.

Mailbox blocked from sending: what an SME should do about error 5.1.8 in Microsoft 365

A member of staff calls: every email they send bounces back with an error about a ‘bad outbound sender’. Receiving still works, sending does not. Microsoft 365 has put the mailbox on a restricted list because too much or suspicious email was sent from it. Often that is a sign the account has been taken over. If you only lift the block quickly without securing the account, it will be back on the list within a day.

What exactly happens

Microsoft 365 scans all outbound email for spam and keeps track of how many messages an account sends. If a user exceeds the sending limits of the service or of the outbound spam policy, three things happen:

The user can no longer send email, but can still receive it.
The user is added to the Restricted entities page in the Microsoft Defender portal.
Every attempt to send returns a non-delivery report with the code 550 5.1.8 Access denied, bad outbound sender.

Microsoft deliberately does not publish the exact limits, so spammers cannot work around them. They are high enough that an ordinary office user never reaches them in practice. So if someone is blocked anyway, something unusual is going on.

The two most common causes

A compromised account: an attacker has obtained the password, for example through phishing, and uses the mailbox to send spam or new phishing emails to customers and contacts. This is by far the most important reason.
Mass mailing from Outlook: a member of staff sends a newsletter or mailing to a large list, for example via BCC. Microsoft 365 is not meant for bulk email. Use a separate newsletter service for that, preferably on its own subdomain with properly configured SPF, DKIM and DMARC.

When in doubt, assume the account has been compromised. An unnecessary password change costs little; an attacker who keeps access costs a lot.

Step 1: secure the account first

Microsoft explicitly advises regaining control of the account first and only then lifting the block. Work through the steps in our article on a compromised Microsoft 365 account:

Set a new, strong password and revoke all active sessions, so the attacker is signed out everywhere.
Check the user’s MFA methods. Remove unknown phone numbers or apps and turn on MFA if it was not on yet.
Look in the mailbox for suspicious inbox rules and forwarding. Attackers often hide replies or forward mail to an external address.
Check Sent Items and use message trace to see what was sent and to whom, so you can warn recipients if needed.

Step 2: lift the block

An admin with the right permissions, such as Security Administrator or a member of the Organization Management role group, lifts the block in the Microsoft Defender portal:

Go to Email & collaboration > Review > Restricted entities.
Select the user (entity Mailbox) and choose Unblock.
Read the recommendations in the flyout that opens, confirm that password and MFA are in order, and submit.

You can also do this in Exchange Online PowerShell: Get-BlockedSenderAddress shows who is blocked and Remove-BlockedSenderAddress -SenderAddress followed by the address lifts the block. Usually the user can send again within an hour. Transient technical issues can make it take longer, but never more than 24 hours.

Making sure you notice in time

Microsoft 365 has a default alert policy ‘User restricted from sending email’ that emails admins when someone is blocked. By default, that alert only goes to the Global Administrators. In the Defender portal, check under Policies & rules > Alert policy that the alert is on, and add your IT partner or fixed contact as a recipient. Read more in our article on alert policies in Microsoft 365. Note that such an alert only works if audit logging is on, which it is by default.

In the outbound spam policy you can also set your own limits per hour and per day, and choose what happens when someone exceeds them. By default the user is blocked until the following day (UTC). For most SMEs the default settings are enough, as long as the alert reaches the right person.

How Floor ICT handles this

With a blocked mailbox, Floor ICT first finds out whether the account has been compromised. We secure the account, clean up suspicious rules and sessions, map out which email was sent and then lift the block. In advance, we make sure alerts about restricted users reach us, so we are often already working on it before the member of staff calls. And for newsletters we help you with a separate sending service, so your regular business email is not put at risk.

View MSP packages Request an intake Microsoft 365