Can I unblock the user myself?

Yes, an admin with the right role can release the account from Restricted entities in the Defender portal. It can take up to an hour or so before sending works again.

Why does every message bounce, even to colleagues?

The restriction applies to the mailbox, not to a destination. Until it is released, Exchange Online refuses all outbound submission from that account.

Will Microsoft block the account again?

If the attacker still has a session token or a rule is still forwarding spam, yes. Clean the account fully before releasing it.

550 5.1.8: Microsoft 365 blocked your outbound sender

550 5.1.8Access denied, bad outbound senderPermanent: retrying will not helpFrom Microsoft 365 and Outlook.com

Example

550 5.1.8 Access denied, bad outbound sender

What it means

A 5.1.8 from Exchange Online is about the sender, not the recipient. Microsoft 365 has put the sending mailbox on its restricted users list because it detected outbound spam or a sudden burst of suspicious mail from it. Every message that mailbox tries to send now bounces back to it with this code, whoever the recipient is.

The NDR is generated inside your own tenant, so you only see it for mail you sent. Compare it with the generic 5.1.8 (bad sender’s system address) defined in RFC 3463, which a remote server uses when it dislikes your envelope sender domain. Here the remote side never saw the message at all.

In most cases the root cause is a compromised account: a phished password or a malicious inbox rule used to blast spam. Treat the block as a security incident first and a delivery problem second.

Likely causes

The account password was phished and an attacker sent spam or phishing through it.
An OAuth app or device with access to the mailbox sent mail in bulk without your knowledge.
A legitimate user sent a large mail merge that crossed Microsoft’s outbound spam thresholds.
Forwarding rules pushed a high volume of spammy inbound mail back out to external addresses.

How to fix it

Reset the user’s password, revoke active sessions, and confirm MFA is enforced for the account.
Check the mailbox for unfamiliar inbox rules, forwarding addresses, and delegated permissions, and remove anything you did not create.
In the Microsoft Defender portal, open Restricted entities (restricted users), find the account, and release it once you are sure it is clean.
Review the outbound spam policy and alert settings so you hear about the next block before users do.
If the user really needs to send bulk mail, move that traffic to a dedicated bulk sending service instead of a normal mailbox.

Checks that apply

Your domain or sending IP (fills in the checks below)

Blacklist Check Shows whether the spam that triggered the block also got your domain listed on public DNSBLs while the account was sending.
Domain Health Grades your SPF, DKIM, and DMARC so you can confirm attackers could not abuse a weak policy to spoof the domain as well.
Email Header Analyzer Paste a copy of one of the sent spam messages to see which client and IP actually submitted it.

FAQ

Can I unblock the user myself?: Yes, an admin with the right role can release the account from Restricted entities in the Defender portal. It can take up to an hour or so before sending works again.
Why does every message bounce, even to colleagues?: The restriction applies to the mailbox, not to a destination. Until it is released, Exchange Online refuses all outbound submission from that account.
Will Microsoft block the account again?: If the attacker still has a session token or a rule is still forwarding spam, yes. Clean the account fully before releasing it.

Microsoft 365 delist portal Outlook.com SNDS

All 191 bounce codes