550 5.7.705: Microsoft 365 tenant over threshold
550 5.7.705Access denied, tenant has exceeded thresholdPermanent: retrying will not helpFrom Microsoft 365 and Outlook.com
550 5.7.705 Access denied, tenant has exceeded threshold
What it means
The 5.7.700 to 5.7.749 range, with 5.7.705 the one most people meet, means Microsoft blocked an entire Microsoft 365 tenant from sending. Most of the tenant’s recent traffic was judged suspicious, so instead of restricting one account, Exchange Online stopped outbound mail for the organization.
Every user in the tenant gets this NDR, which is the quickest way to tell it from 5.7.501, where one account is banned. 5.7.708 is a related but separate case about IP traffic, covered on its own page.
It typically follows a compromise that sent a large spam run, or a new tenant whose first traffic looked like abuse. The tenant admin has to clean up and then get Microsoft to lift it.
Likely causes
- Several mailboxes were compromised and used to send spam in a short time.
- A trial or newly created tenant sent bulk mail before building any reputation.
- An application or connector relayed large amounts of unwanted mail through the tenant.
How to fix it
- Identify compromised accounts with sign in logs and message trace, and reset their credentials with MFA.
- Remove malicious inbox rules, forwarding, and app consents, and disable any open relay connector.
- Check Restricted entities in the Defender portal and release users who are clean.
- Open a support case with Microsoft to restore tenant sending; you cannot lift a tenant ban yourself.
- After restoration, send bulk mail through a dedicated service rather than Exchange Online.
Checks that apply
- DMARC Report Analyzer Aggregate reports show the sudden spike in volume and the sources that triggered the tenant ban.
- Microsoft Compliance Confirms SPF, DKIM, and DMARC are in order before you resume sending.
- Domain Health A full domain grade catches weak spots in your setup that would make new mail look suspicious again.
FAQ
- Can I lift a 5.7.705 ban from the admin center?
- No. A tenant level threshold block needs Microsoft support to clear it after you show the cause is fixed.
- Does the delist portal help?
- No. sender.office.com removes IP listings, while 5.7.705 is attached to the tenant itself.