Microsoft 365 Blocked Your Mailbox From Sending: Fixing a Restricted User

When Microsoft 365 rejects outgoing mail with "550 5.1.8 Access denied, bad outbound sender," the mailbox has usually been restricted for suspected outbound spam. An admin can release the user from the Restricted entities page in the Microsoft Defender portal, but you should fix the cause first, which in cold outreach usually means too much volume from a new mailbox, too many bounces, or spam complaints.

Confirm what happened

Symptom	Likely cause
Bounce: 550 5.1.8 Access denied, bad outbound sender	User restricted for outbound spam
User listed on Restricted entities in Defender	Outbound spam policy limit hit
Bounces mentioning a recipient or message rate limit	Exchange Online sending limits
Admin received an alert about a user restricted from sending	Outbound spam policy alert

Paste the bounce text into the bounce message analyzer to confirm the code.

How an admin releases the user

1. Sign in to the Microsoft Defender portal with an admin account.
2. Go to Email & collaboration, then Review, then Restricted entities.
3. Select the blocked user and choose to unblock them.
4. Follow any prompts. Microsoft's documentation explains how long the release takes to apply and how often it can be done.

Microsoft can limit repeated releases, so treat each one as a last chance.

Find the cause before releasing

Look at what the mailbox sent in the day or two before the block:

• Volume. How many messages and recipients per day, including sequence follow-ups? A new mailbox going straight to high volume looks like a compromised account.
• Bounces. Export bounces from the sequencer. If many say the recipient does not exist, the list was the problem.
• Complaints. Replies asking to be removed or angry responses suggest targeting or frequency issues.
• Content and links. Shortened URLs and link-heavy templates do not help.

Why cold emails bounce covers the list-side causes.

Fix it before sending again

1. Stop the campaign for that mailbox in your sequencer.
2. Suppress everyone who bounced so no other mailbox picks them up.
3. Verify the remaining leads. Send only to valid addresses first; keep catch-all addresses in a separate, low-volume step.
4. Lower the daily cap for that mailbox and restart gradually. See the warm-up schedule.
5. Check authentication. Confirm SPF, DKIM and DMARC pass for the domain. Our Microsoft 365 DKIM setup guide walks through it, and the Microsoft sender requirements checker tests the domain.

Stay well under the limits

Microsoft publishes Exchange Online sending limits, including a daily recipient limit per mailbox. Those are ceilings for normal business use, not targets for cold email. Spread volume across mailboxes and domains instead of pushing one mailbox hard.

Planning question	Where to work it out
How many emails per mailbox per day is sensible?	Cold emails per day per inbox
How many mailboxes do I need for my target volume?	Email sending limits calculator
How many domains?	How many domains for cold email

Microsoft recipients are a separate problem

If your own mailbox is fine but mail to Outlook and Hotmail addresses is being rejected or going to junk, that is the receiving side. See Microsoft's bulk sender requirements, Outlook 550 5.7.515 and why emails land in Outlook junk.

Prevent the next restriction

• Verify every list before it reaches a Microsoft 365 mailbox.
• Warm new mailboxes for a few weeks before full cold volume.
• Keep a bounce pause rule in your sequencer; see when to pause for bounces.
• Watch replies for complaints and remove those people immediately.

Communicating with your team

A blocked mailbox affects the person who uses it for everything, not only outreach. While the block is in place:

• Tell the user what happened and that normal mail will also fail until it is released.
• Pause every sequence connected to that mailbox, including ones run by other team members.
• Agree on who decides when to release the user, so it is not done in a hurry without the fixes in place.
• Write down what caused the block and what changed, so the next person setting up a mailbox does not repeat it.

Separate outreach from day-to-day mail

Many teams run cold outreach from the same Microsoft 365 mailboxes they use for customers and colleagues. A restriction then stops business mail as well. A safer setup is dedicated outreach mailboxes on secondary domains, warmed up gradually, with your main domain kept for normal business mail. Setting up secondary domains for cold email explains how this protects your primary domain, and how many domains you need helps size it.

Outbound spam policies in Microsoft 365 can also be reviewed by your admin. Do not raise limits just to keep a campaign running; a limit that blocks outreach is usually doing its job.

Verify before you resume

Upload the leads still queued for that mailbox on the verify page and restart with valid addresses only. You get 100 free email checks when you sign in with Google, no card.