Account Security Problems

How to Fix Microsoft Defender Restricted Mailboxes for High-Volume Email

Kushani Nimanthika Sep 25, 2026 869 views

Question details

User mailboxes have been blocked and placed in restricted entities, preventing single sign-on (SSO) authentication and the ability to send high-volume email.

Resolving Microsoft Defender Restricted Mailboxes and High-Volume Email Issues

Product: Microsoft 365 Defender
Device & OS: not provided
Scenario: Administrators need to unblock the restricted user mailboxes, determine if existing accounts can be used for high-volume email (HVE), and check if warning notifications precede these restrictions.
Observed behavior: Mailboxes are placed in restricted entities by Microsoft Defender, blocking user access and SSO logins, typically triggered by exceeding outbound sending limits or unusual account activity.

Before you start

Ensure you are logged in with Microsoft 365 Global Administrator credentials, as standard users cannot access security logs or unblock restricted entities.

Solution 1Recommended

Submit a Microsoft Support Service Request to Unblock Accounts

Since restricted entity blocks are enforced at the tenant level by Microsoft Defender, a Global Administrator must review account health and formally request unblocking via Microsoft Support.

Community members and standard support agents cannot access private account data or security tools. Only official Microsoft Support can investigate the backend logs to determine if the block was caused by policy violations, compromised-account protection, or Conditional Access.

Verify restricted status

Log in to the Microsoft 365 admin center, navigate to the Security portal (Microsoft Defender), and check the 'Restricted users' page under the Email & collaboration section to confirm the affected mailboxes are blocked.

Open a service request

In the Microsoft 365 admin center, go to Support > Help & support, and open a new service request to have Microsoft Support review your security logs and account health.

Request account unblocking

Provide the details of the affected users and request that Microsoft unblock the accounts, confirming that the high-volume email activity is legitimate.

Submit a Microsoft Support Service Request to Unblock Accounts

Reseller Managed Subscriptions: If your Microsoft 365 subscription is managed by a third-party reseller (CSP), you must contact the reseller directly to open the support ticket on your behalf.

Solution 2

Set Up Dedicated Accounts for High-Volume Email (HVE)

If existing user accounts frequently hit standard Exchange Online sending limits and become restricted, setting up separate, dedicated HVE accounts is necessary.

Free Microsoft Office alternative

Looking for a Hassle-Free Office Suite? Try WPS Office

While Microsoft 365 handles complex enterprise email routing and security policies, you might want a lightweight, cost-effective alternative for your daily document productivity. WPS Office offers a powerful, free solution for creating, editing, and sharing documents without heavy administrative overhead.

Fully compatible with Microsoft Office formats, including .docx, .xlsx, and .pptx.Lightweight design that installs quickly and runs smoothly on almost any device.Familiar, intuitive user interface ensuring a seamless transition for your team.Built-in PDF editing, document conversion, and secure cloud collaboration tools.

microsoft office alternative - wps office

Frequently Asked Questions

Why did Microsoft Defender place my mailbox in restricted entities?

Mailboxes are typically restricted due to unusual sign-in activity, sending email volumes that exceed Exchange Online limits (High-Volume Email), compromised-account protection algorithms, or specific Conditional Access policy violations.

Do administrators receive a warning before a mailbox is restricted for high-volume email?

Standard limits usually trigger a block immediately when exceeded to prevent potential spam or malicious activity. Administrators should confirm their specific alert thresholds and notification behaviors with Microsoft Support.

Can users sign in with SSO if their mailbox is restricted?

If an account is restricted due to compromised-account protection or severe policy violations, authentication mechanisms like single sign-on (SSO) are often blocked to secure the tenant until a Global Administrator resolves the underlying issue.

Can I use my existing Microsoft 365 account for High Volume Email?

If your existing account consistently gets restricted due to standard sending limits, you will likely need to set up a separate, dedicated account specifically configured for High Volume Email (HVE).

Microsoft Office Security Issues