How to Prevent Users from Being Added to Microsoft Defender Restricted Entities
Question details
An administrator needs to prevent a user from being repeatedly blocked and added to the Restricted Entities list after sending emails to large distribution groups.
- Product
- Microsoft Defender / Exchange Online
- Device & OS
- not provided
- Scenario
- A user regularly sends bulk emails or communications to large distribution groups within the organization.
- Observed behavior
- The user's email account is repeatedly flagged for outbound spam and added to the Microsoft Defender Restricted Entities list, preventing them from sending further emails.
Ensure you have Global Administrator or Security Administrator privileges in the Microsoft 365 Defender portal before attempting to modify outbound threat policies.
Adjust Outbound Spam Policies in Microsoft 365 Defender
Create or modify a custom anti-spam outbound policy to increase sending limits for specific users who need to email large distribution groups.
Microsoft 365 automatically restricts accounts that exceed standard outbound sending thresholds to prevent spam. By adjusting the outbound spam policy specifically for users who legitimately need to send bulk internal emails, you can prevent them from triggering the restriction without compromising global tenant security.
Log in to the Microsoft 365 Defender portal (security.microsoft.com). In the left navigation pane, go to Email & Collaboration > Policies & Rules > Threat policies.
Under the Policies section, click on Anti-spam. This will display a list of your current inbound and outbound spam filtering rules.
Select the 'Anti-spam outbound policy (Default)' to edit it, or click 'Create policy' > 'Outbound' to make a custom rule specifically for the affected user.
In the policy settings, expand the 'Protection settings' section. Adjust the 'External message limit', 'Internal message limit', and 'Daily message limit' to accommodate the user's distribution group size. Save the policy.
Utilize Dedicated Bulk Email Services
Migrate large distribution group communications to a third-party bulk mailing platform to bypass Exchange Online limits.
Seek Enterprise Support on Microsoft Q&A
Consult Microsoft engineers and enterprise administrators for complex tenant configurations.
Optimize Your Office Experience with WPS Office
While managing enterprise email security and Microsoft Defender policies requires specialized admin portals, optimizing your team's document productivity doesn't have to be complicated. WPS Office provides a free, lightweight, and highly compatible alternative to Microsoft Office for everyday document tasks.
- 1. Download the Installer: Visit the official WPS website and download the free installation package for your operating system.
- 2. Install WPS Office: Run the installer and follow the on-screen prompts to set up WPS Office on your computer.
- 3. Open Your Documents: Double-click any existing Microsoft Office file to instantly open and edit it in WPS Office without losing formatting.
Frequently Asked Questions
Why does Microsoft Defender block users sending to large distribution lists?
Microsoft Exchange Online enforces strict outbound spam limits to protect the server network's reputation. Sending too many emails at once, or to too many recipients, triggers automated security thresholds, subsequently moving the sender to the Restricted Entities list.
How do I remove a user from the Restricted Entities list?
Administrators can unblock users by visiting the Microsoft 365 Defender portal, navigating to 'Review' > 'Restricted entities', selecting the blocked user account, and clicking 'Unblock'.
Can I disable outbound spam scanning entirely in Microsoft 365?
No, Microsoft 365 does not allow administrators to completely disable outbound spam filtering. This is a hardcoded measure to protect the integrity of the Exchange network. You can only adjust the specific message limit thresholds via custom policies.
What is the default sending limit in Exchange Online?
By default, Exchange Online limits users to sending messages to a maximum of 10,000 recipients per day. However, automated outbound spam algorithms may trigger blocks at much lower thresholds if sudden bulk sending patterns are detected.
