removed from blocked sending list

Microsoft 365 may have restricted the mailbox after the unauthorized bulk sending, so secure the account fully and then have an administrator remove it from Restricted entities.

If this is a work or school Microsoft 365 account

1. Finish securing the mailbox before unblocking it. Changing the password was an important first step, but an administrator should also:
   • Revoke all active sign-in sessions.
   • Enable multifactor authentication (MFA).
   • Remove unfamiliar MFA methods and registered devices.
   • Review and revoke suspicious application consent.
   • Check mailbox forwarding and all Inbox rules, including hidden rules.
   • Review recent sign-in activity.
   These checks prevent an attacker from retaining access through an existing session, forwarding rule, authentication method, or connected application.^1^
2. Ask your Microsoft 365 security administrator or organization administrator to open the Microsoft Defender portal and go to: Email & collaboration → Review → Restricted entities
3. Find your account, confirm that Entity is Mailbox, select it, and choose Unblock.
4. Review the recommendations, select Next → Submit, and confirm Yes. Microsoft states that restrictions are normally removed within one hour, although it can take up to 24 hours.^2^ The administrator needs an appropriate role, such as Security Administrator or membership in Organization Management. If you are not an administrator, this cannot be completed from Outlook; contact your organization’s IT administrator.
5. After the restriction clears, send one test message to an internal address and one to an external address. Do not resend the 300 messages or send another large batch.

An administrator can also check the restriction through Exchange Online PowerShell:

Get-BlockedSenderAddress

Get-BlockedSenderAddress `
  -SenderAddress [Email] |
  Format-List

Remove-BlockedSenderAddress `
  -SenderAddress [Email]

Use the mailbox UPN rather than assuming it matches the primary email address.^2^

If this is a personal Outlook.com account

The Microsoft 365 Restricted entities admin procedure does not apply to a personal Microsoft account. Instead:

1. Run a full malware scan on each device used to access the mailbox.
2. In Outlook on the web, examine Settings → Mail → Rules, forwarding, connected accounts, and automatic replies; remove anything unfamiliar.
3. Review account security information, devices, and recent activity, then sign out unfamiliar sessions and enable two-step verification.
4. Use Microsoft’s compromised-account sign-in helper or its option to contact a support agent if sending remains blocked.^3^

If a returned message contains 550 5.1.8 Access denied, bad outbound sender, that specifically matches the Microsoft 365 organizational restriction handled through Restricted entities.^2^

References

1. Respond to a compromised cloud email account
2. Remove blocked users from the Restricted entities page
3. How to recover a hacked or compromised Microsoft account | Microsoft Support