550 5.4.1: Microsoft 365 recipient access denied

What it means

Exchange Online Protection answers 5.4.1 during the SMTP conversation, at RCPT TO, when Directory Based Edge Blocking (DBEB) is on and the address is not in the tenant’s directory. The message is refused at the edge, before it ever reaches a mailbox.

Because the domain is set to Authoritative, Microsoft knows every valid address and drops the rest. If the domain were Internal Relay, the message would be passed on to another system instead. That is the key setting when a hybrid or partly migrated domain starts bouncing mail.

The bracketed AS reference that sometimes follows the text identifies the internal check. For a sender the meaning is the same as an unknown user, but for the recipient admin it usually points at directory sync or domain type rather than a missing person.

Likely causes

• The address really does not exist in the tenant, for example a typo or a deleted user.
• The recipient lives on another mail system (on premises or another host) but the accepted domain is set to Authoritative.
• Directory sync has not yet created the mail user or contact for a new on premises address.
• The domain’s MX points to Microsoft but the domain was never added as an accepted domain in that tenant.

Checks that apply

• MX Lookup Shows whether the domain’s MX is the Microsoft 365 endpoint (mail.protection.outlook.com), which is where DBEB runs.
• SMTP Diagnostics Connects to the MX and shows the banner, so you can confirm the rejection came from Exchange Online Protection.
• SPF Check For a shared domain, confirms both mail systems are authorised in SPF once you route some mail through Microsoft.

FAQ

Is 5.4.1 a spam block?

No. Despite the words access denied, it is a recipient lookup failure at the edge, not a reputation block.

Why does only one person bounce?

That address is missing from the tenant directory, often because sync has not created it yet or it lives on another system.