550 5.1.8: account blocked for sending spam

What it means

Exchange Online adds an account to its Restricted entities list when it sends spam or exceeds the outbound sending limits, and from then on its messages bounce with 550 5.1.8. Most of the time the account was compromised through phishing or malware and used to send spam. The block is on the sender's own mailbox; recipients and other users are not affected. An admin has to secure the account and then release it in the Microsoft Defender portal, after which Microsoft says restrictions are usually removed within one hour.

Common causes

• The account was compromised and used to send spam.
• The user, or an application sending as the account, exceeded the Exchange Online sending limits.

How to fix it

1. 01Tell your admin and stop retrying.
2. 02Admins: secure the account first by resetting the password, checking sign-in activity, and removing inbox rules or forwarding added by an attacker.
3. 03Unblock the user on the Restricted entities page in the Microsoft Defender portal (security.microsoft.com/restrictedusers).
4. 04Turn on multifactor authentication for the account to prevent a repeat.

Sources

What this page rests on, checked on 20 Oct 2026. The explanation is ours; the reply text is the server's.

• Fix NDR error "550 5.1.8" in Exchange Onlinelearn.microsoft.com
• Remove blocked users from the Restricted entities pagelearn.microsoft.com
• Email nondelivery reports and SMTP errors in Exchange Onlinelearn.microsoft.com

Further reading

• The standard meaning of 5.1.8: sender domain cannot receive mail