Share via

Restricted Entities: email was unblocked and got blocked again soon

Zhanibek Sydykov 5 Reputation points
2023-12-19T06:59:27.85+00:00

The thing is that one of our corporate emails is in the "Restricted entities" list again, and we cannot send emails to our users (although we continue to receive emails). 

Please find the description of the error attached below.

We pulled this email back from Restricted Entities recently, but it didn't help, and it got blocked again soon after we started using it. We followed all of your recommendations and instructions. 

Also, we are not engaged in spam/anomalous sending patterns, as it is indicated here in the screenshot. 

  1. How do we fix it so that it doesn't happen again?
  2. How to avoid such problems in the future?

We are looking forward to hearing from you!

User's image

Outlook Management
Outlook Management
Outlook: A family of Microsoft email and calendar products.Management: The act or process of organizing, handling, directing or controlling something.
5,025 questions

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. SokiGuo-MSFT 25,106 Reputation points Microsoft Vendor
    2023-12-19T08:31:14.8233333+00:00

    Hi @Zhanibek Sydykov

    Based on the images you sent, your email account appears to have been blocked by Microsoft Defender, perhaps sending too many messages marked as spam or bulk. Or it indicates that your account has been compromised by a malicious actor.

    To resolve this issue and avoid such issues in the future, you need to follow these steps:

    • Remove the blocked user from the Restricted entities page in the Microsoft Defender portal or in Exchange Online PowerShell. This will allow the user to send emails again, but you should also take additional steps to protect the account. More information, see: Remove blocked users from the Restricted entities page | Microsoft Learn.
    • Review the mailbox delegation, mail forwarding rules, global mail forwarding properties, and mailbox audit logs for user accounts. Attackers may have changed these settings to access your email or send spam on your behalf.
    • Enable complex passwords and multi-factor authentication for user accounts. This will help prevent unauthorized access to your account in the future.
    • Review your email content and sending practices to make sure they meet spam filtering guidelines and outbound sending limits. This will help reduce the chances of your emails being marked as spam or sent in bulk by recipients or services.

    Hope this helps!

    If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.