Remove blocked users from the Restricted Users portal in Office 365

If a user exceeds one of the outbound sending limits as specified in the service limits or in outbound spam policies, the user is restricted from sending email, but they can still receive email.

The user is added to the Restricted Users portal in the Office 365 Security & Compliance Center. When they try to send email, the message is returned in a non-delivery report (also known as an NDR or bounce messages) with the error code 5.1.8 and the following text:

"Your message couldn't be delivered because you weren't recognized as a valid sender. The most common reason for this is that your email address is suspected of sending spam and it's no longer allowed to send email. Contact your email admin for assistance. Remote Server returned '550 5.1.8 Access denied, bad outbound sender."

Admins can remove users from the Restricted Senders portal in the Security & Compliance Center or in Exchange Online PowerShell.

What do you need to know before you begin?

Use the Security & Compliance Center to remove a user from the Restricted Users list

  1. In the Security & Compliance Center, go to Threat management > Review > Restricted users.

  2. Find and select the user that you want to unblock. In the Actions column, click Unblock.

  3. A fly-out will go into the details about the account whose sending is restricted. You should go through the recommendations to ensure you're taking the proper actions in case the account is actually compromised. Click Next when done.

  4. The next screen has recommendations to help prevent future compromise. Enabling multi-factor authentication (MFA) and changing the passwords are a good defense. Click Unblock user when done.

  5. Click Yes to confirm the change.

    Note

    It may take 30 minutes or more before restrictions are removed.

Verify the alert settings for restricted users

The default alert policy named User restricted from sending email will automatically notify admins when users are blocked from sending outbound mail. You can verify these settings and add additional users to notify. For more information about alert policies, see Alert policies in the security and compliance center.

Important

For alerts to work, audit log search must to be turned on. For more information, see Turn Office 365 audit log search on or off.

  1. In the Security & Compliance Center, go to Alerts > Alert policies.

  2. Find an select the User restricted from sending email alert.

  3. In the flyout that appears, verify or configure the following settings:

    • Status: Verify the alert is turned on Toggle on.

    • Email recipients: Click Edit and verify or configure the following settings in the Edit recipients flyout that appears:

      • Send email notifications: Verify the check box is selected (On).

      • Email recipients: The default value is TenantAdmins (meaning, Global admin members). To add more recipients, click in a blank area of the box. A list of recipients will appear, and you can start typing a name to filter and select a recipient. You can remove an existing recipient from the box by clicking Remove icon next to their name.

      • Daily notification limit: The default value is No limit but you can select a limit for the maximum number of notifications per day.

      When you're finished, click Save.

  4. Back on the User restricted from sending email flyout, click Close.

Use Exchange Online PowerShell to view and remove users from the Restricted Users list

To view this list of users that are restricted from sending email, run the following command:

Get-BlockedSenderAddress

To view details about a specific user, replace <emailaddress> with their email address and run the following command:

Get-BlockedSenderAddress -SenderAddress <emailaddress>

For detailed syntax and parameter information, see Get-BlockedSenderAddress.

To remove a user from the Restricted Users list, replace <emailaddress> with their email address and run the following command:

Remove-BlockedSenderAddress -SenderAddress <emailaddress>

For detailed syntax and parameter information, see Remove-BlockedSenderAddress.