All outgoing emails fail in Outlook for Windows

A Microsoft 365 administrator should check the sender through Exchange Online PowerShell and, if it is absent there as well as from Restricted entities, open a Microsoft support case for investigation of the continuing backend restriction.

Because sending fails in both Outlook for Windows and Outlook on the web, repairing or recreating the Outlook profile will not address this Exchange Online rejection. Error 550 5.1.8 ... AS(42004) means the account has been blocked from outbound sending, commonly after exceeding sending limits or spam detection.^1^

Give your administrator this handoff

Send the administrator:

• The complete non-delivery report (NDR), including timestamp, generating server, and AS(42004).
• The affected mailbox address and its user principal name (UPN), if different.
• Confirmation that the failure occurs in Outlook on the web as well as desktop Outlook.
• Confirmation that the mailbox was not found under Microsoft Defender → Email & collaboration → Review → Restricted entities.

Ask the administrator to perform these steps:

1. Check the restriction through Exchange Online PowerShell. A hosted mailbox is queried using its UPN, which might differ from its primary email address.^2^

      Connect-ExchangeOnline
   
      Get-BlockedSenderAddress -SenderAddress "[Email]" |
          Format-List
   
      # Run only if the preceding command returns the affected sender,
      # and only after completing the security review:
      Remove-BlockedSenderAddress -SenderAddress "[Email]"
   

   Get-BlockedSenderAddress requires appropriate Exchange permissions and is available only in the cloud service.^3^
2. If PowerShell returns the sender, investigate and secure the account before removing the restriction:
   • Reset the password.
   • Revoke active sign-in sessions.
   • Review registered MFA methods and enable MFA.
   • Check Sent Items, hidden Inbox rules, mailbox forwarding, and application consent for unauthorized activity.
   Microsoft documents a blocked mailbox as a possible compromise symptom and recommends reviewing persistence mechanisms before restoring service.^4^
3. Remove the restriction only after securing the account. Restrictions are normally cleared within one hour, although transient issues can extend this to no more than 24 hours.^2^

If neither the portal nor PowerShell shows the sender

The tenant administrator should open a Microsoft 365 support request:

1. Sign in to the Microsoft 365 admin center.
2. Select Help & support.
3. Describe the issue as:
   Exchange Online outbound sender blocked with 550 5.1.8 AS(42004), but sender is absent from Restricted entities and Get-BlockedSenderAddress.
4. Include:
   • Full NDR and message headers.
   • UTC timestamps for recent failures.
   • Affected UPN and primary SMTP address.
   • Results of Get-BlockedSenderAddress.
   • Confirmation that account-security remediation was completed.
5. Select Contact Support and request investigation of the continuing outbound restriction.

Only an administrator can create the business support request. If the Microsoft 365 subscription was purchased entirely through a partner or reseller, that partner must be contacted instead.^5^

Since you do not have administrator access, contact your internal help desk, business owner, or the IT provider that created the account. Those are the usual holders of Microsoft 365 administrative access.^6^

Additional check for delegated sending

If messages were sent using Send As or Send on behalf, the administrator should examine both the authenticated user and the address in the From field. Outbound limits and policies can apply based on that From address, so delegated sending activity may identify the entity that triggered enforcement.^7^

References

1. Fix NDR error 550 5.1.8 in Exchange Online - Exchange
2. Remove blocked users from the Restricted entities page
3. Get-BlockedSenderAddress-Syntax
4. Respond to a compromised cloud email account
5. Get support for Microsoft 365 for business
6. Overview of the Microsoft 365 admin center
7. How outbound spam policy limits apply to Send As and Send on behalf permissions