How to Fix Microsoft 365 Email Repeatedly Restricted or Blacklisted
Question details
The user's Microsoft 365 Exchange Online mailbox keeps getting added to the Restricted entities list and blocked from sending emails, even after temporary unblocking.
- Product
- Microsoft 365 Exchange Online
- Device & OS
- not provided
- Scenario
- The user is attempting to send outbound emails but their account is repeatedly flagged for anomalous sending patterns.
- Observed behavior
- Outgoing messages fail to send, and the system reports the sender is restricted due to suspected spam or a potentially compromised account.
Ensure you have administrator access to the Microsoft 365 Defender portal and the Exchange admin center before attempting to investigate or unblock the restricted user.
Secure the Account and Remove Suspicious Activities
Since recurring restrictions usually indicate a compromised account, you must secure the user credentials and environment before unblocking.
When an account is flagged for anomalous sending patterns, it often means attackers have gained unauthorized access to send spam. You must eliminate the root cause before unblocking, otherwise the system will automatically restrict the mailbox again.
Log in to the Microsoft 365 admin center, go to Users > Active users, select the affected user, and click 'Reset password' to force an immediate sign-out of all active sessions.
In the Microsoft 365 admin center, navigate to the active users list, click on 'Multi-factor authentication' at the top, and enforce MFA for the compromised user.
Open the Exchange admin center, go to Mailboxes, select the user, and check 'Manage mail flow settings' to delete any unknown forwarding or inbox rules created by attackers.
Run a comprehensive antivirus and anti-malware scan on the user's computer and mobile devices to ensure no background software is hijacking the email client.
Adjust Outbound Spam Policies and Check Sending Limits
Legitimate bulk email campaigns can trigger Exchange Online's outbound spam protections if sending limits are exceeded.
Switch to WPS Office for a Seamless, Cost-Effective Experience
While resolving complex Exchange Online server and email restrictions requires Microsoft support, managing your daily documents doesn't have to be complicated or expensive. WPS Office provides a free, lightweight, and highly compatible alternative to Microsoft Office, letting you effortlessly edit Word, Excel, and PowerPoint files without the costly subscription fees.
Frequently Asked Questions
Why does my Microsoft 365 account say 'anomalous sending patterns detected'?
This alert triggers when Microsoft's spam filters detect your account sending an unusually high volume of emails, suspecting it might be compromised by malware or actively used by hackers for distributing spam.
Can I permanently whitelist my email address to stop the restrictions?
No, Microsoft does not allow permanent whitelisting of internal mailboxes that violate outbound spam policies. Doing so would risk the reputation of Microsoft's entire email infrastructure and cause legitimate emails to go to junk.
How do I unblock a user in the Restricted entities page?
An administrator must log in to the Microsoft 365 Defender portal, navigate to Email & Collaboration > Review > Restricted entities, select the blocked user account, and click the 'Unblock' action.
What are the typical sending limits for Exchange Online?
Typically, Exchange Online limits users to sending messages to a maximum of 10,000 recipients per day and 30 messages per minute. However, specific outbound spam policies configured by your organization's admin may impose much stricter limits.
