550 5.7.501: Microsoft 365 account banned for spam
550 5.7.501Access denied, spam abuse detectedPermanent: retrying will not helpFrom Microsoft 365 and Outlook.com
550 5.7.501 Access denied, spam abuse detected
What it means
This rejection comes from Exchange Online’s own outbound protection, not from the far side of the conversation. Microsoft decided that a mailbox or account inside a Microsoft 365 tenant sent spam, and it stopped that account from sending to anyone. The 5.7.501 detail is the most common form; 5.7.502 and 5.7.503 sit in the same small family and are handled the same way.
You see it as the person who tried to send, in an NDR from your own tenant. It differs from 5.7.606, where an outside sending IP is banned from reaching Microsoft, and from 5.7.705, where the whole tenant has crossed a threshold. Here the scope is the account, and it is permanent until an administrator acts.
The usual story is a compromised mailbox: a phished password, a rogue inbox rule or an OAuth app that pushed a burst of junk through Exchange Online before anyone noticed.
Likely causes
- A user’s password was phished and the attacker sent bulk spam or phishing from the mailbox.
- A malicious app was granted mail send permission and abused it.
- A legitimate marketing blast went out from a normal user mailbox and looked like spam to the outbound filter.
- A script or device using SMTP AUTH with that account was hijacked or misconfigured into a loop.
How to fix it
- Treat the account as compromised: reset its password, revoke sessions, and require MFA before it signs in again.
- Review inbox rules, forwarding settings, mailbox delegates, and consented enterprise apps for anything you did not create, and remove it.
- In the Microsoft Defender portal, open Restricted entities, find the user, and release it once you are sure the cause is gone.
- If the account does not appear there or release fails, open a support case with Microsoft through your normal admin channel and quote the full NDR.
- Move bulk or marketing mail to a dedicated sending service instead of a user mailbox so it does not happen again.
Checks that apply
- Email Header Analyzer Paste one of the spam messages the account sent to see the client, IP, and route it took, which tells you how the attacker got in.
- Microsoft Compliance Grades your domain against Microsoft sender requirements once the account is clean, so outgoing mail is not judged harshly afterwards.
- DMARC Report Analyzer Aggregate reports for the window of the incident show which IPs sent as your domain and how much volume left.
FAQ
- Will Exchange Online lift the 5.7.501 ban by itself?
- Sometimes a restriction expires after about a day, but you should not wait for it. An admin release after cleaning the account is faster and safer.
- Does the recipient need to do anything?
- No. The block is on your account inside Microsoft 365, so only your administrator or Microsoft support can lift it.