Security Policy Errors

How to Restore Outgoing Email after a Microsoft 365 Compromised Tenant Alert

Adam Davis Oct 13, 2026 869 views

Question details

The organization is unable to send external emails due to a Microsoft 365 tenant-wide restriction.

How to Restore Outgoing Email after a Compromised Tenant Alert

Product: Microsoft 365
Device & OS: not provided
Scenario: Responding to a high-severity alert for suspicious bulk sending that resulted in an organization-wide block on outbound emails.
Observed behavior: Microsoft 365 has restricted the entire organization from sending external emails, and the restriction persists even if the Restricted Entities page shows no data.

Before you start

Identify any potentially compromised user accounts immediately and revoke their sign-in sessions to prevent further unauthorized activity.

Solution 1Recommended

Secure Compromised Accounts and Contact Microsoft Support

Take immediate steps to secure your tenant and reach out to Microsoft Support to lift the organization-wide email restriction.

Identify the compromised account

Review your Microsoft 365 Defender alerts or audit logs to find the specific user account responsible for the suspicious bulk sending.

Secure the account

Force a sign-out for all sessions associated with the compromised user and immediately reset their password in the Microsoft 365 admin center.

Check the Restricted Entities page

Go to the Microsoft 365 Defender portal and navigate to the Restricted Entities page under Email & Collaboration > Review, to see if the user or tenant is listed.

Contact Microsoft Support

If the tenant remains restricted and no data appears on the Restricted Entities page, open a support ticket through the Microsoft 365 admin center or call Microsoft Phone Support.

Provide alert details

When speaking with support, provide the specific high-severity alert details and explain the security measures you have already taken on the suspected accounts.

Microsoft Phone Support: You can find localized phone support numbers for Microsoft 365 Admin on the official Microsoft Learn documentation page.

Free Microsoft Office alternative

Looking for a Secure and Lightweight Office Suite?

While resolving your Microsoft 365 tenant admin issues, consider WPS Office for your document creation needs. It is a free, highly compatible, and user-friendly alternative to Microsoft Office.

Fully compatible with Microsoft Office formats like .docx, .xlsx, and .pptx.Lightweight design that runs smoothly on almost any desktop or mobile device.Familiar user interface requiring zero learning curve for easy migration.Built-in PDF editing and document security features.

microsoft office alternative - wps office

Frequently Asked Questions

Why did Microsoft 365 block my entire tenant from sending emails?

Microsoft monitors outbound email traffic. If it detects suspicious patterns like bulk sending of spam or malware, it automatically restricts the compromised accounts. In severe cases, it blocks the entire tenant to protect its IP reputation.

Where can I find the Restricted Entities page?

You can find it in the Microsoft 365 Defender portal under Email & Collaboration > Review > Restricted Entities. This page lists individual users or domains that are restricted from sending emails.

What if the Restricted Entities page is empty but emails are still blocked?

This often happens with high-severity, tenant-wide blocks. You must contact Microsoft Support directly via phone or the admin center to have the restriction manually lifted by their backend team.

Microsoft Office Security Issues