Exchange Online 550 5.7.705 — Tenant Exceeded Threshold

Treat it as a security incident first

Microsoft applies this restriction when outbound traffic from the tenant resembles abuse: a sudden burst, a high rate of undeliverable recipients, complaint signals, or patterns associated with spam. In most cases one account or one connected application has been compromised and is sending on its own.

Before requesting any remediation, find the source. Look at outbound message trace for unusual volume by sender, review recent sign-ins for the accounts involved, and check connectors and applications that hold send permissions.

Stop the traffic, then recover

Reset credentials and revoke sessions for any compromised account, remove mailbox rules the attacker created, and disable any application or connector that was abused. Microsoft will not lift a restriction while abusive traffic continues.

Once the source is contained, an administrator can review the restriction in the Defender portal. Some restrictions clear automatically after traffic normalizes; others require a request.

• Identify the sending account or system before anything else.
• Contain: credentials, sessions, rules, connectors.
• Only then follow Microsoft’s administrative recovery path.

Preventing a repeat

Enforce multi-factor authentication, alert on unusual outbound volume, and inventory every application with mailbox send permissions. Compromised accounts are the primary cause, and the restriction is Microsoft protecting the rest of the internet from your tenant.

Legitimate bulk campaigns should not go through mailbox accounts. Use a sending platform with its own reputation and authenticate it properly.

Known limits

• Threshold values are not published and adapt to the tenant’s history.
• Recovery timing depends on Microsoft’s review once the abusive traffic has stopped.

Common questions