Microsoft 365 tenant restricted from sending email (550 5.7.705) after compromised account was remediated

Question

Microsoft 365 tenant restricted from sending email (550 5.7.705) after compromised account was remediated

AV 0

Our Microsoft 365 tenant is currently restricted from sending outbound email with the following error:

550 5.7.705 – Access denied, tenant has exceeded threshold.

Microsoft Defender generated the following alert:

"Tenant restricted from sending email"

Activity: Potentially compromised tenant

We identified a compromised user account that was sending spam. The account was disabled immediately after the incident was detected.

We have already taken the following remediation steps:

Disabled the compromised account.
Reset the user's password.
Revoked active sign-in sessions.
Removed a suspicious third-party OAuth application that had mail-related permissions, including SMTP.Send.
Enabled MFA for all active users in the tenant. Some users have not yet completed MFA registration.
Reviewed the tenant for suspicious email activity and are continuing to investigate.

At this point, we have no active restricted users in the Microsoft Defender "Restricted entities" section.

We would like to understand whether, after these remediation steps, Microsoft can automatically reassess the tenant and remove the outbound sending restriction, or whether manual review by Microsoft Support is always required for this type of 550 5.7.705 tenant-level restriction.

Also, is there any additional security remediation that Microsoft recommends completing before requesting the restriction to be removed?

The tenant is currently unable to send outbound email, so any guidance on the expected process and requirements for restoring outbound mail would be appreciated.

0 comments

1 answer

Your answer

Answer 1

Hi AV,

A tenant that can't send any outbound email is a serious disruption. You've already done the main containment work, which will help the review. Unfortunately, as a forum moderator, I am not able to review your tenant or remove the restriction directly. My role here is limited to providing general guidance you can apply from your side. Error 550 5.7.705 is a tenant-level block. It applies to the whole organization, not to a single user. That's why Restricted entities in Defender can be empty while the tenant still can't send mail.

As for your first question, whether the block can be lifted automatically, I'd recommend not counting on that. Microsoft's guidance for this error is to fix the underlying cause first and then contact Microsoft Support to have the block removed.

On your second question, about what to remediate before contacting support, Microsoft lists two common causes of this block: a compromised admin account used to create connectors, and a compromised on-premises server that routes mail through Exchange Online. Besides what you've already done, I'd recommend:

Checking Mail flow > Connectors in the Exchange admin center for any connectors you don't recognize
Reviewing inbox rules and forwarding on the compromised mailbox, and on any admin accounts
Making sure every admin account has completed MFA registration, then following up on the users who haven't

Once you've finished, open a service request from the Microsoft 365 admin center. Include the NDR, the Defender alert, and a summary of the remediation you've completed. For detailed instructions on how to get support, please refer to Get support - Microsoft 365 admin.

For reference: NDR error codes 550 5.7.703, 550 5.7.705, 550 5.7.708, and 550 5.7.750 | Microsoft Support

I hope this helps you get outbound mail running again soon. Should you have any further questions or need additional assistance, please don't hesitate to reach out. I'm always happy to help. Have a wonderful day!

If the answer is helpful, please click "Yes" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in the forum documentation to enable e-mail notifications if you want to receive the related email notification for this thread.