A sender was restricted after a message to a distribution list reached 15 external recipients. The outbound spam policy has the external recipients per hour setting at 0, and there haven't been any policy changes. What should I check?
Why is Microsoft 365 restricting a sender after 15 external recipients?
Asked by
no-compass-still-wandering
Answers
Start with one of the affected messages in Defender Explorer, if you have access. The restriction may mention an external recipient limit, but the message's content or other spam signals could also be relevant. Check the message details before assuming the policy value is the whole story.
If the message looks legitimate, submit it to Microsoft as a possible false positive. Availability of those investigation tools can depend on licensing.
Reply to this answer
Check the tenant outbound email limit report in Exchange Admin too. That limit is separate from the per-sender outbound spam policy, so compare the reported usage and limit rather than assuming one explains the other.
Reply to this answer
Double-check what the restriction actually says. There's also a 30 messages per minute limit, but messages per minute and external recipients per hour are different things. A distribution list with lots of recipients doesn't by itself mean 30 separate messages were sent.
Reply to this answer
Add your answer
Answers are reviewed before publication.
no-compass-still-wandering:
The restriction specifically says the external recipient limit was exceeded, rather than a messages-per-minute limit.