Security Policy Errors

How to Fix a Repeatedly Blocked Email Address in Microsoft 365

Maira Mehtab Sep 20, 2026 868 views

Question details

The user needs to resolve an issue where an email address continuously gets blocked from sending and receiving messages, even after resetting the password and lifting the initial block.

Product: Email
Device & OS: not provided
Scenario: Attempting to resume normal email communication after a security block, only to have the system re-apply the block shortly after.
Observed behavior: The email address is repeatedly restricted by security policies, preventing outbound and inbound mail flow due to suspected account compromise or spam activity.

Before you start

Ensure you have administrator privileges for your organization's email system (such as the Microsoft 365 Defender portal or Exchange admin center) to review security logs and adjust policies.

Solution 1Recommended

Investigate for Compromised Account Activity

Determine if unauthorized users are accessing the account to send spam, which is the most common reason for repeated automated blocks.

Even if a password was recently changed, an attacker might have left malicious mailbox rules or maintained active sessions. It is critical to secure the account comprehensively before requesting another unblock.

Review Sign-in Logs

Access your identity provider portal (e.g., Microsoft Entra ID) and check the sign-in logs for the affected user. Look for suspicious IP addresses, unfamiliar locations, or unexpected login times.

Check Inbox Rules and Forwarding

Open the affected user's mailbox settings in the Exchange Admin Center. Navigate to the Mailbox Features section and verify that no hidden forwarding rules or strange inbox rules were created by an attacker to intercept or redirect mail.

Revoke Sessions and Enforce MFA

Force a sign-out for all active sessions tied to the user. Then, ensure Multi-Factor Authentication (MFA) is strictly enforced for the account to prevent further unauthorized access.

Account Security: Unblocking an account without eliminating the root security breach will almost always result in the account being blocked again within hours.

Solution 2

Review Outbound Spam Policies and Sending Patterns

Ensure the user's legitimate sending behavior does not inadvertently trigger your organization's outbound spam filters.

Solution 3

Utilize Allow/Block Lists and Run Diagnostics

Use your tenant's security diagnostic tools to identify the exact policy triggering the block and manage it appropriately.

Free Microsoft Office alternative

Need a Reliable and Lightweight Office Suite?

While resolving email server restrictions requires your provider's admin tools, handling your daily documents shouldn't require complex troubleshooting. WPS Office provides a lightweight, entirely free, and highly compatible alternative to Microsoft Office for creating, editing, and sharing your important files.

1. Download the Installer: Visit the official WPS Office website and click the free download button for your operating system.
2. Install the Application: Run the downloaded setup file and follow the simple on-screen instructions to install the suite.
3. Start Creating: Open WPS Office to immediately start working with your existing Office documents, spreadsheets, and presentations.

Fully compatible with Microsoft Office formats like DOCX, XLSX, and PPTXFree and lightweight, consuming minimal system resourcesFamiliar user interface for seamless and easy migrationBuilt-in robust PDF editing, converting, and commenting tools

microsoft office alternative - wps office

Frequently Asked Questions

Why does my email keep getting blocked even after changing the password?

Changing the password prevents new unauthorized sign-ins, but an attacker may have already set up hidden inbox forwarding rules, or your account might have active sessions that were not revoked. Additionally, if the account's reputation was lowered due to previous spam activity, sending behavior may still be heavily filtered.

How long does a security block usually last?

Depending on the email provider, an automated block may lift automatically after 24 hours. However, if the system detects repeated violations or compromised activity, the account will be placed on a restricted users list requiring a permanent block until an administrator intervenes.

Should I whitelist my own email address to stop the blocking?

No. Broadly whitelisting your own domain or email address in your security portal bypasses critical anti-spoofing and anti-spam protections. It makes your organization extremely vulnerable to phishing attacks impersonating your internal staff.

What is the difference between a blocked sender and a restricted user?

A blocked sender typically means an external address is prevented from sending mail to your organization. A restricted user means an internal user within your organization has been blocked from sending outbound emails because the system suspects they are sending spam.

Microsoft Office Security Issues