How to Investigate Office 365 Restricted User and Duplicate Message IDs
Question details
A global administrator needs to unblock a user restricted from sending emails and investigate the root cause involving repeated message IDs.
- Product
- Office 365
- Device & OS
- not provided
- Scenario
- An Exchange Online user account has been blocked from sending outbound emails by Microsoft 365 Defender due to unusual message activity and duplicate message IDs.
- Observed behavior
- The user is unable to send emails. Message tracing reveals repeated message IDs associated with multiple network message IDs, triggering automated spam detection limits.
Ensure you are logged in with Global Administrator or Security Administrator privileges in your Microsoft 365 tenant to access the Defender portal and review restricted users.
Remove the User from the Restricted Users Portal
Unblock the affected account in the Microsoft 365 Defender portal so the user can resume sending legitimate emails.
When Office 365 detects suspicious activity, such as a high volume of duplicate message IDs, it automatically restricts the account to protect your tenant's email reputation. You must manually review and unblock the account.
Navigate to https://security.microsoft.com/restrictedusers and log in using your administrator credentials.
On the Restricted users page, find and select the specific user account that has been blocked from sending emails.
Click the 'Unblock' action. Review the provided recommendations regarding account security (such as resetting passwords or checking for forwarding rules) and confirm the unblock process.
Investigate Message Tracing for Duplicate IDs
Analyze the account's sending activity to determine why duplicate message IDs were generated and prevent future restrictions.
Switch to WPS Office for a Lightweight Document Workflow
While managing Microsoft 365 administrative tasks like Exchange restrictions can be highly complex, your daily document management doesn't have to be. WPS Office offers a free, lightweight, and streamlined alternative to Microsoft Office, ensuring high compatibility without the heavy administrative overhead.
Frequently Asked Questions
Why does Office 365 restrict a user from sending emails?
Office 365 automatically blocks users who exceed sending limits, generate excessive duplicate message IDs, or exhibit sending patterns typical of outbound spam. This is a built-in protection mechanism to prevent the organization's IP addresses from being blacklisted.
What causes duplicate message IDs in Exchange Online?
Duplicate message IDs are typically caused by misconfigured third-party email clients, faulty bulk mailing scripts, or malicious software operating from a compromised account attempting to bypass standard routing.
How long does it take for an Office 365 user to be unblocked?
Once a global administrator removes the account from the Restricted users portal, it usually takes between 30 to 60 minutes for the unblock command to fully replicate across Exchange Online servers.
