Restricted mailbox after sending to 120 recipients

Question

Restricted mailbox after sending to 120 recipients

NAMT ICT 0

We had a mailbox that was blocked from sending after a press email was sent to 120 recipients. This is below the 500 max recipient threshold so I want to know why it was restricted at all.

0 comments

2 answers

Your answer

Answer 1

Hi NAMT,

Although the message was sent to only 120 recipients and did not exceed the default limit of 500 recipients per message, it's important to note that this limit only governs the maximum number of recipients that can be included in a single email. It does not guarantee that the mailbox will not be restricted from sending. Exchange Online</Exchange Online> evaluates several additional factors when determining whether a mailbox should be restricted.

Some factors that may contribute to a sending restriction include:

The sender's cumulative recipient count within the applicable hourly and 24-hour time windows.
Limits configured in the applicable outbound spam policy, such as external recipients per hour, internal recipients per hour, or total recipients per day.
Sending patterns that resemble spam or unusual bulk-mail activity.
Previous messages sent by the same authenticated account.
Messages sent using Send As or Send on behalf permissions.

If delegated sending was involved, the address shown in the From field determines which outbound spam policy applies, while the recipient count is accumulated against the authenticated user who actually submitted the message. As a result, the restricted account may not necessarily be the mailbox that appears in the From field.

Reference: Outbound spam limits with Send As and Send on behalf permissions - Microsoft Defender for Office 365

To better understand what triggered the restriction, I recommend reviewing the following:

Check any alerts associated with the restriction in the Microsoft Defender portal</Microsoft Defender portal>.
Review Email & Collaboration > Review > Restricted entities to identify the account that was restricted.
Run a message trace and review the user's sending activity leading up to the restriction.
Verify the outbound spam policy applied to the address used in the From field, paying particular attention to hourly and daily recipient limits.
Review sign-in logs, forwarding settings, inbox rules, and Sent Items for any signs of unauthorized or unexpected activity before removing the restriction.

For reference, the standard service limits include:

10,000 recipients in a rolling 24-hour period
30 messages per minute
A default maximum of 500 recipients per message

Additionally, custom outbound spam policies can be configured with lower thresholds and may restrict a sender when those limits are exceeded. Even legitimate bulk-mailing activity may trigger outbound protection mechanisms, as Exchange Online</Exchange Online> is not designed to function as a bulk-email marketing platform.

For recurring press releases or other large-scale communications, you may want to consider using a dedicated bulk-email service rather than a standard mailbox.

References:

Exchange Online limits - Service Descriptions

Troubleshoot outbound sending limits in Exchange Online - Microsoft Defender for Office 365

I hope this helps clarify why the restriction may have occurred. Should you have any questions, please feel free to reach out.

Warm regards.

Kristen Tran 2,040 Reputation points Independent Advisor

2026-10-03T11:01:26.7766667+00:00

Hi NAMT,

Have you reviewed the provided answer? Please let me know if there are any updates.

Answer 2

A mailbox can be restricted even when a single message is sent to only 120 recipients, because the 500 recipients per message limit is only one of several Exchange Online enforcement limits.

Relevant reasons include:

Per-user recipient rate limit
Exchange Online enforces a hard limit of 10,000 recipients per 24-hour sliding window. A restriction can occur based on total recent sending activity, not just the one press email.
Outbound spam policy enforcement
Restrictions can be triggered by the applicable outbound spam policy, and the action depends on that policy configuration: Restrict, Restrict until next day, or Alert only. So a mailbox can be blocked even if it did not hit the 500-recipient-per-message limit.
Outbound spam detection
If sending patterns look suspicious, messages can be routed to the high-risk delivery pool and the user can eventually be restricted. A sudden press-style bulk send can match suspicious sending behavior even at 120 recipients.
Delegated or Send As / Send on behalf activity
Sending from another mailbox via permissions is counted against the delegate who sends, not the mailbox in the From field. If delegated sending was involved, the restricted account and the visible From mailbox might not be the same enforcement target.
Distribution group counting differences
Recipient counting depends on how the recipients were addressed:
- Distribution groups in the organization address book count as one recipient for the recipient rate limit.
- Distribution groups in a mailbox Contacts folder count individually by member.
- For TERRL and some policy evaluations, external distribution group members are counted individually.

To investigate why this specific mailbox was restricted, check:

Which user account was actually restricted.
What messages that user submitted before the restriction, including delegated sends.
Which From address was used on the triggering message.
Which outbound spam policy applied to that From address.
The policy settings for external recipients per hour, internal recipients per hour, and total recipients per day.
Whether the account showed signs of compromise, because Microsoft notes that exceeding sending limits can indicate a compromised account.

So the short answer is: 120 recipients is below the per-message limit, but restrictions are also based on rate limits, outbound spam policy limits, suspicious sending behavior, and delegated sending rules.