Exchange Suspicious messages

Question

Hello,

For last some day we have one user which always blocked with this log

User's image

My question is :

This log mean the user send many suspicious emails for last 24 hours?
How can we change the limit?
How exchange can be categorized the outbound message as suspicious?

Answer

Hi @Handian Sudianto

Have you checked this article?

Remove blocked users from the Restricted entities page

The following explains why users are added to the restricted entity page.

|| several things happen if a user exceeds the outbound sending limits of the service or the limits in outbound spam policies:

The user is restricted from sending email, but they can still receive email.

The user is added to the Restricted entities page in the Microsoft 365 Defender portal.

A restricted entity is a user account or a connector that's blocked from sending email due to indications of compromise, which typically includes exceeding message receiving and sending limits.

Q&A：

Yes, as provided in the details.
Please check this: Customizable Recipient Limits in Office 365
How EOP controls outbound spam

Please let me know if I misunderstood something, looking forward to your feedback!

Regards

Shaofan

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Share via

Exchange Suspicious messages

1 answer

Your answer