Outbound emails blocked after hack

Question

I am getting the below email bounce for all of my emails. I need this cleared asap

Diagnostic information for administrators:

Generating server: <PII removed>.namprd15.prod.outlook.com

<PII removed> @gmail.com Remote server returned '550 5.7.705 Service unavailable. Access denied, tenant has exceeded threshold. For more information please go to http://go.microsoft.com/fwlink/?LinkId=<PII removed> S(7136) [<PII removed>.namprd15.prod.outlook.com 2026-03-15T14:35:28.269Z 08DE81C2388B37CF]'

Original message headers:

Received: from <PII removed>.namprd15.prod.outlook.com
 ([fe80::886e:b5a0:5e3b:246b]) by <PII removed>.namprd15.prod.outlook.com
 ([fe80::886e:b5a0:5e3b:246b%4]) with mapi id <PII removed>; Sun, 15 Mar 2026
 14:35:28 +0000
MIME-Version: 1.0
Content-Type: text/plain
Date: Sun, 15 Mar 2026 14:35:28 +0000
Message-ID:
   <<PII removed>.namprd15.prod.outlook.com>
Subject: test

Answer 1

The issue is because your tenant has reached daily sent limit. Are you using the free domain like onmicrosoft.com? If so, it is best to get a custom domain to avoid daily sent limit restriction.

Answer 2

Hi @Elliot Dennis 

Thank you for posting your question in the Microsoft Q&A forum. 

Please note that our forum is a public platform, and we will modify your question to hide your personal information in the description. Kindly ensure that you hide any personal or organizational information the next time you post an error or other details to protect personal data. 

Just a quick note that this forum is a peer-to-peer community, so while members can share advice and experiences, it doesn’t offer phone or live support. 

If you’re seeing the message error 550 5.7.705 – Access denied, tenant has exceeded threshold, it means your organization’s outbound mail has been blocked because too much spam or bulk mail was detected. Exchange Online automatically enforces this protection to prevent abuse. 

Only an admin in your organization can fix this issue. 

If you're an email admin, review the guidance in this Microsoft article: NDR error codes 550 5.7.703, 550 5.7.705, 550 5.7.708, and 550 5.7.750 - Microsoft Support. It explains how to protect your tenant from threats and reduce the risk of outbound mail being blocked. 

Then, you need to contact Global admin of your organization to submit a support ticket through the Microsoft 365 admin center to have the block removed. 

You can read more at: Get support - Microsoft 365 admin | Microsoft Learn.   

I hope this information is helpful. 

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".          

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.   

Answer 3

The bounce code 550 5.7.705 indicates that outbound mail from the tenant has been blocked because a threshold was exceeded, typically due to spam-like activity or a compromised account.

Only an email admin in the organization can clear this. Recommended steps:

1. Secure any compromised accounts
   • Follow the guidance in "Secure a compromised email account in Exchange Online" to investigate and remediate any hacked mailboxes (reset passwords, enable MFA, remove malicious rules/forwarding, revoke suspicious app permissions, etc.).
   • Also review for unusual connectors or rules that might be sending spam, as attackers sometimes create these.
2. Unblock restricted users
   • In the Microsoft 365 Defender portal, go to Restricted entities (https://security.microsoft.com/restrictedusers).
   • Identify and unblock any user accounts that were blocked for outbound spam. After unblocking, restrictions are usually removed within about an hour so users can send mail again.
3. Check domains and connectors
   • Ensure all domains used to send mail are added and validated as accepted domains in Microsoft 365.
   • Validate connectors and remove any unusual or attacker-created connectors.
4. If the block persists, contact Microsoft Support
   • After securing accounts, validating domains/connectors, and unblocking restricted users, contact Microsoft Support to review and remove any remaining tenant-level block if necessary.
5. Harden the environment to prevent recurrence
   • Implement the recommendations in "Top 10 ways to secure your business data" (for example, enforcing MFA, limiting forwarding, monitoring sign-ins, and tightening mail flow policies).

Until the underlying spam/compromise cause is fixed and the block is removed, outbound mail from the tenant will continue to be rejected with 5.7.705.

---

References:

• NDR error code "550 5.1.8 Access denied, bad outbound sender"
• NDR error codes 550 5.7.703, 550 5.7.705, 550 5.7.708, and 550 5.7.750
• External senders - Use the delist portal to remove yourself from the blocked senders list and address 5.7.511 Access denied errors
• External senders - Troubleshoot email sent to Microsoft 365