Microsoft blocks outbound email when it thinks your account or your whole Microsoft 365 tenant is sending spam. The bounce 550 5.7.708 means mail from your tenant is coming from a low-reputation address; "restricted from sending" means a user has been blocked. The most common cause is a mailbox that's been hacked and used to send phishing.
First, assume a compromise
- Check the affected user's sent items and the message trace for mail they didn't send
- Look for inbox rules forwarding or deleting mail
- Check sign-in logs for logins from unexpected countries
- Review which apps have been granted access to the account
Then lift the block
Reset the password, sign the user out everywhere, turn on multi-factor authentication, and remove any rules or app consents the attacker added. Only then release the user from the restricted senders list in the Microsoft Defender portal. If the whole tenant is blocked, you may need to open a ticket with Microsoft showing what you've done.
Stop it happening again
MFA for everyone, legacy authentication turned off, alerts for new forwarding rules, and DMARC on your domain.
As a Microsoft 365 partner we can check the whole tenant for you. Book a same-day Microsoft 365 fix.
