Exchange Online Protection Limits

The following limits currently exist for Exchange Online Protection. These limits are not configurable, unless specified otherwise.

Tip

For more information about limits in Exchange Online, see Exchange Online Limits. The transport rule limits also apply to EOP standalone customers. The recipient rate and message rate limits for Exchange Online are not applicable for EOP standalone customers.

  • Domain limit You can add up to 900 domains per tenant. Subdomains can be included in this 900 limit, or if necessary, as part of a catch-all option, match subdomains. For more information, see Manage Accepted Domains in EOP.

  • Message size limit The maximum message size for EOP standalone customers, including attachments, is 150 MB.

  • Number of outbound messages sent The limit for the number of outbound messages sent through EOP is high enough to ensure that normal email communication is not treated as spam. If you want to send commercial bulk email messages, rather than sending outbound messages through EOP, we recommend that you either use a third-party email service provider (ESP) or send them through your on-premises email servers.

  • Recipient limit As long as the sending host can split the message into "chunks" of fewer than 500 recipients, no explicit limit is defined. However, each "chunk" is effectively treated as a new message. Too many messages in a short period, messages from a host with a poor reputation, or messages with questionable content could be throttled or blocked.

  • IP Allow or IP Block list limit When configuring an IP Allow list or an IP Block list in the connection filter, you can specify a maximum of 1273 entries, where an entry is either a single IP address or a CIDR range of IP addresses from /24 to /32.

  • Message deferral limit Messages in deferral will remain in our queues for 2 days. Message retry attempts are based on the error type received from the recipient's mail system. Messages are retried every 15 minutes.

  • Spam quarantine retention period By default, spam messages sent to the quarantine are retained for 15 days. Administrators can lower this value via content filter policies.

  • End-user spam quarantine notifications By default, if enabled, end-user spam quarantine notifications are sent every 3 days. They can be configured to be sent every 1 to 15 days.

  • Reporting and message trace limits For reporting and message trace limits, see the "Reporting and message trace data availability and latency" section in Reporting and Message Trace in Exchange Online Protection.

Limits across EOP options

Feature EOP Standalone EOP features in Exchange Online Exchange Enterprise CAL with Services
Domain limit
900
900
900
Message size limit (including attachments)
150 MB
150 MB
150 MB
Recipient limit
See "Recipient limit" above
500 recipients when sending from a hosted mailbox; see "Recipient limit" above for other scenarios
See "Recipient limit" above
Safe sender limit
1024 entries
1024 entries
Blocked sender limit
1024 entries
1024 entries
IP Allow or IP Block list limit
1273 entries
1273 entries
1273 entries
Message deferral limit
2 days, retried every 15 minutes
2 days, retried every 15 minutes
2 days, retried every 15 minutes
Spam quarantine retention period
15 days by default but can be lowered
15 days by default but can be lowered
15 days by default but can be lowered
End-user spam quarantine notifications
3 days by default, configurable from 1 to 15 days
3 days by default, configurable from 1 to 15 days
3 days by default, configurable from 1 to 15 days