Account Security Problems

How to Unblock Microsoft 365 Mail Flow After an Account Compromise

Muhammad Talha Oct 15, 2026 869 views

Question details

Users are unable to send emails and receive error 550 5.7.1 after their Microsoft 365 account was compromised, due to mail-flow rules or spam policies blocking the messages.

How to Unblock Microsoft 365 Mail Flow After an Account Compromise

Product: Microsoft 365
Device & OS: not provided
Scenario: Attempting to restore normal email sending capabilities after an account security breach.
Observed behavior: Outgoing emails are blocked and return a bounce-back message with error code 550 5.7.1_ETR.

Before you start

Ensure you have Microsoft 365 administrator privileges, as resolving this issue requires access to the Exchange Admin Center and Microsoft Defender portal.

Solution 1Recommended

Investigate and Remove Blocks in the Exchange Admin Center

Identify the specific policy blocking your outbound emails by checking message traces, transport rules, and spam alerts.

When a Microsoft 365 account is compromised, Microsoft's automated security policies often block the user from sending further outbound emails to prevent spam. You need to identify which policy triggered the block.

Check Restricted Users

Go to the Microsoft 365 Defender portal, navigate to 'Email & collaboration' > 'Review' > 'Restricted users'. If the compromised account is listed, review the details and unblock it.

Run a Message Trace

Log in to the Exchange admin center and navigate to 'Mail flow' > 'Message trace'. Run a trace on the affected mailbox to see exactly which rule is blocking the message.

Review Transport Rules

In the Exchange admin center, check 'Mail flow' > 'Rules' for any unauthorized transport rules created by hackers during the compromise.

Check Outbound Spam Policies

Navigate to the anti-spam policies in the Defender portal to verify if the account has exceeded outbound sending limits that triggered an automatic block.

Investigate and Remove Blocks in the Exchange Admin Center

Recipient Blocks: If the message trace indicates the recipient's organization created the blocking rule, you must contact their administrator directly to remove it.

Solution 2

Escalate to Microsoft Support

If internal policies are clear but emails are still blocked, provide trace details to Microsoft Support for backend removal.

Free Microsoft Office alternative

Switch to WPS Office for a Secure, Streamlined Experience

While resolving Microsoft 365 server and Exchange routing issues requires administrator intervention, you can ensure your daily document workflow remains uninterrupted by switching to a reliable offline suite. WPS Office offers a highly secure, lightweight, and completely free alternative to Microsoft Office for creating and editing your important files.

Fully compatible with Microsoft Word, Excel, and PowerPoint formats (.docx, .xlsx, .pptx).A free, lightweight alternative to Microsoft 365 for offline document security.Built-in PDF editing, conversion, and signing tools.Familiar user interface requiring zero learning curve.

microsoft office alternative - wps office

Frequently Asked Questions

What does error 550 5.7.1 mean in Microsoft 365?

Error 550 5.7.1 indicates that the sender is not authorized to send messages to the recipient. In the context of a compromised account, it usually means a security setting, transport rule, or anti-spam policy has blocked the outbound message.

How long does it take to unblock a Microsoft 365 email account?

Once an administrator removes the account from the 'Restricted users' list in the Microsoft 365 Defender portal, it typically takes up to a few hours for the restriction to fully lift across Microsoft's servers and for mail flow to resume normally.

Can a standard user fix the 550 5.7.1 mail flow error themselves?

No, standard users cannot resolve this issue directly. It requires a Microsoft 365 administrator with access to the Exchange admin center and Microsoft 365 Defender portal to adjust security policies, run message traces, or remove the user block.

Microsoft Office Security Issues