How to Remove an Office 365 Tenant Email Sending Restriction
Question details
The user needs to remove a domain-wide Microsoft 365 tenant restriction on sending emails after spam was sent through an unauthorized connector.
- Product
- Microsoft 365
- Device & OS
- not provided
- Scenario
- Attempting to delist an Office 365 tenant block when the restriction is not visible in the Defender portal.
- Observed behavior
- The entire tenant is blocked from sending outbound emails, and self-service delisting is unavailable because the block does not appear in the Restricted Entities page.
Ensure you have global administrator privileges in your Microsoft 365 environment, as you will need access to security settings, mail flow logs, and support ticket creation.
Secure Your Tenant and Contact Microsoft Support
When an entire tenant or domain is restricted, self-service delisting is disabled. You must secure the environment and have Microsoft Support manually remove the block.
Domain-wide restrictions occur when excessive spam or malicious activity is detected at the tenant level. Microsoft Support requires proof that the vulnerability has been completely remediated before they will lift the restriction.
Navigate to the Exchange admin center, check your mail flow connectors, and delete any unknown or unauthorized connectors used to relay spam.
Audit all administrator accounts in the Microsoft 365 admin center. Reset the passwords for any compromised accounts immediately.
Ensure MFA is enforced for all users, particularly global administrators, to prevent future unauthorized access to the tenant.
Run a message trace and review audit logs to determine the scope of the spam activity and confirm the source has been neutralized.
Go to the Microsoft 365 admin center, click on 'Support' followed by 'Help & support', and raise a ticket explaining the steps you have taken. A support technician will review your remediation actions and manually remove the restriction.
Explore WPS Office for Hassle-Free Offline Productivity
While Microsoft 365 tenant-level security issues require advanced admin-level troubleshooting and cloud support, WPS Office provides a reliable, lightweight, and offline alternative for your daily document tasks. Create and edit your files seamlessly without relying on complex cloud administration.
Frequently Asked Questions
Why doesn't the email restriction appear in the Microsoft 365 Defender portal?
When an email restriction is applied to an entire tenant or domain rather than an individual user account, it bypasses the standard Restricted Entities page. Because it is a broader security lockdown, it cannot be self-delisted by the administrator.
How long does it take for Microsoft Support to lift a tenant email restriction?
Once you raise a support ticket and provide proof that the unauthorized connectors and compromised accounts are secured, Microsoft Support typically reviews your actions and removes the restriction within a few hours to one business day.
What causes an Office 365 tenant to be restricted from sending emails?
The most common causes are compromised global admin accounts, massive volumes of bulk spam being sent through your domain, or the setup of unauthorized inbound/outbound connectors by malicious actors.
