Outlook or Microsoft 365 Account Suspended? Complete Fix Guide

Short answer: If you can still receive mail but sending fails with a message about not being recognized as a valid sender, Microsoft 365 has restricted the account for a compromise signal, and an admin clears it in minutes from the Restricted entities page. If it is a personal Outlook.com or Hotmail address that will not sign in at all, that goes through Microsoft's own account recovery flow. A sending-limit message is neither of those, and it clears on its own.

• If you can receive but not send, and bounces mention "bad outbound sender": the account is restricted, not suspended - a Microsoft 365 admin unblocks it in the Restricted entities page after securing it.
• If it is a personal address (outlook.com, hotmail.com, live.com, msn.com) and you cannot sign in: start at Microsoft's account recovery and unblock flow.
• If every user on your company's Microsoft 365 tenant is locked out at once: check the subscription status in the admin center before anything else.
• If the message just says you have reached a sending limit: nothing is suspended - stop sending, wait, resume slower.
• If your address ends in gmail.com or sits on a Google Workspace domain, this is the wrong guide - see our Gmail account suspended or Google Workspace suspended guides instead.

Suspended, Restricted, Blocked, or Throttled

People searching for a suspended Outlook or Microsoft 365 account are usually describing one of four unrelated situations, and Microsoft's own systems treat them completely differently. Getting the label right in the first minute saves you from working the wrong playbook for a day.

Throttled means sending is temporarily slowed or paused because you sent too much too fast. It clears on its own. Restricted is Microsoft 365's specific term for a mailbox that has been cut off from sending - but not receiving - because Microsoft's outbound spam protection read the sending pattern as a sign of compromise. An admin clears it. Blocked, on a personal account, means Microsoft locked you out of signing in entirely, usually over unusual activity, and you work through Microsoft's own recovery flow. Suspended, in the way Microsoft actually uses the word, mostly applies to a whole Microsoft 365 subscription going into a suspended billing state, not to one person.

None of these four is interchangeable with any other, and two of the four never involve contacting Microsoft at all - they are cleared entirely inside your own organization.

Personal Outlook.com vs Microsoft 365

The fix depends entirely on what kind of account you have, and that is decided by what comes after the at sign.

An address ending in outlook.com, hotmail.com, live.com or msn.com is a personal Microsoft account. There is no administrator above you. Microsoft is the only party that can unblock or reactivate it, and the route is Microsoft's own consumer recovery tools.

An address on a company or school domain runs on Microsoft 365 (what used to be called Office 365), and somewhere in your organization a person holds Global Administrator or Security Administrator rights over it. For the single most common cause of a Microsoft 365 sending block - the account being automatically restricted - that admin can fix it today, without contacting Microsoft at all.

Question	Personal account (outlook.com, hotmail.com, live.com, msn.com)	Microsoft 365 (work or school domain)
Who can fix it	Only Microsoft, through account recovery	Usually your own admin, from the Microsoft Defender portal or the admin center
Where you go first	The Outlook.com unblock flow or the Microsoft account recovery page	Your IT or admin contact, not Microsoft support
Typical time to fix	Minutes if automated verification succeeds; days if a human has to review it	Under an hour once an admin acts, per Microsoft's own stated window for restriction removal
What happens to incoming mail meanwhile	Depends on the block type; a fully blocked personal account can bounce inbound mail	Incoming mail keeps arriving normally - only sending is affected while restricted
Typical wording you see	Your account has been blocked, or a sign-in page insisting on identity verification	A bounce saying you were not recognized as a valid sender, or a Microsoft 365 admin notice

The States a Microsoft Account Can Be In

If you have dealt with a suspended Google account before, it is tempting to map this onto the same personal-versus-Workspace split. Microsoft's model looks similar on the surface but divides differently underneath, and forcing it into the Google shape is exactly what sends people looking for a fix that does not exist. Here is Microsoft's actual set of states.

State	What is blocked	Who caused it	How it is fixed
Throttled	Sending, temporarily	Microsoft's automatic rate control, triggered by your own sending speed	Wait it out, then send slower
Restricted (Restricted entities)	Sending only - receiving keeps working	Microsoft's automatic outbound spam protection, reading the account as compromised	An admin unblocks it in the Microsoft Defender portal after securing the account
Sign-in blocked (personal account)	Everything, until you pass identity checks	Microsoft, for unusual sign-in or recovery activity	Microsoft's own unblock flow, usually self-service
Account locked or closed (personal account)	Everything, potentially permanently	Microsoft, for a Microsoft Services Agreement violation	Account recovery, then an appeal if recovery does not restore it
License removed or sign-in blocked by your own admin	Everything, for that one Microsoft 365 user	Your own IT or Global Administrator	Ask your admin - this never touches Microsoft support
Subscription suspended	Everything, for every user on the tenant	Microsoft, automatically, almost always for non-payment	A billing admin reactivates the subscription in the Microsoft 365 admin center

Two of these six states never involve Microsoft support at all - they are entirely inside your own organization's control. That is worth knowing before you spend a day looking for a Microsoft contact form that was never the right door in the first place.

Identify Your Situation From the Exact Notice

Match what you are actually looking at against this table. The precise wording matters far more than any single word like suspended, which gets used loosely across very different Microsoft screens.

What you see	What it means	First action
A bounce saying your message could not be delivered because you were not recognized as a valid sender, with 550 5.1.8 Access denied, bad outbound sender	The account is restricted from sending, most often for a compromise signal	Have an admin open the Restricted entities page in the Microsoft Defender portal
You've reached a limit for sending mail, or a generic rate-limit notice	Temporary throttle. Nothing is suspended	Stop sending, wait, resume at lower volume
Your account has been blocked, shown at sign-in on a personal address	Security block over unusual sign-in or recovery activity	Use the Outlook.com unblock flow from a device you have used before
Your account has been locked. We've detected activity that violates our Microsoft Services Agreement	Personal account locked for a policy violation	Go through Microsoft's account recovery, then the appeal path if needed
Nobody at the company can sign in, and the admin center shows a billing notice	The Microsoft 365 subscription is suspended, almost always for non-payment	A billing admin reactivates the subscription in the admin center
One coworker cannot sign in with a generic error, and nobody else is affected	Your own admin blocked sign-in or removed the license	Ask your admin - this has nothing to do with Microsoft

Write down the exact wording before you close the tab or dismiss the notice. It is often the only evidence you have about which of the six states above you are actually in, and an admin working the fix will ask for it.

A Sending Limit Is Not a Suspension

If what you saw was a rate or sending-limit message, stop here. Nothing is suspended, nothing is restricted, and there is no form to fill in.

Microsoft publishes a rate limit of 30 messages per minute per mailbox for authenticated SMTP client submission through Exchange Online, plus separate daily recipient limits. For Microsoft 365 subscribers using the Outlook.com consumer service, Microsoft publishes 5,000 recipients per day, 500 recipients on a single message, and 1,000 unique non-relationship recipients per day. Free, non-subscriber Outlook.com and Hotmail accounts get a lower quota that Microsoft does not publish as a fixed number - it scales with how established the account looks, and a brand-new account starts well below the ceiling a long-standing one gets.

What to do instead of appealing anything:

• Stop sending immediately, including anything already queued.
• Wait out the window rather than retrying every few minutes - repeated hits are what turns a limit into a genuine review.
• For a free consumer account, make sure your Microsoft account profile has a real name, birthday and country filled in. Microsoft's own guidance ties account credibility partly to a complete profile, and an incomplete one keeps new accounts on the lower quota longer.
• Resume at a fraction of the volume that triggered the limit, spread across the day rather than in one burst.

This distinction earns its own section because a limit and a restriction can look identical from the outside - both stop mail from going out - and behave completely differently. One needs nothing from you but patience. The other needs an admin to act.

Restricted From Sending: Microsoft 365's Compromise Flag

This is the single most common cause behind an Outlook or Microsoft 365 account that stopped sending out of nowhere, and it is worth understanding properly because the fix depends on knowing exactly what triggered it.

When a Microsoft 365 mailbox exceeds the outbound sending limits built into the service, or the limits set in your organization's own outbound spam policy, Microsoft's system treats that as an indicator of compromise. It restricts the account: outbound mail stops, inbound mail keeps arriving normally, and the mailbox is added to the Restricted entities page inside the Microsoft Defender portal. Nothing about this requires anyone at Microsoft to look at your case individually - it is fully automatic.

If the restricted mailbox, or anyone trying to send through it, attempts to deliver mail, the message comes back as a non-delivery report reading close to: "Your message couldn't be delivered because you weren't recognized as a valid sender. The most common reason for this is that your email address is suspected of sending spam and it's no longer allowed to send email. Contact your email admin for assistance." The remote server detail attached to that report is 550 5.1.8 Access denied, bad outbound sender.

Two things about this are easy to misread. First, "suspected of sending spam" does not mean a human decided your content was spam - it means the volume pattern matched what a compromised, spam-sending account looks like from the outside. Second, it is genuinely common for a legitimate cold-outreach mailbox to trip this if volume jumped in a way that looks identical to an account takeover. Microsoft's system cannot tell the difference between a hijacked mailbox blasting strangers and a real sender who scaled up too fast in one step - the pattern is what matters, not the intent behind it.

Why Microsoft Restricted or Suspended the Account

A genuinely compromised mailbox

The most common real cause. A reused or phished password, a stolen app password, or a third-party app with more access than it should have lets someone else send through the account. It usually sends in a short, intense burst, often to addresses that have nothing to do with your normal contacts.

A volume jump that looks identical to compromise

An account that sent a handful of messages a day and suddenly sends hundreds looks exactly like a takeover to an automated system, even if every message was written by the actual owner. The shape of the change matters more than the absolute number involved.

A high bounce rate

Sending to a list with a meaningful share of dead addresses is one of the fastest ways to look automated, because a real person does not accumulate that many invalid addresses through normal correspondence.

Recipients marking mail as junk

Complaint signals feed into the same detection Microsoft uses for outbound spam protection, separate from and in addition to any public blocklist your domain or IP might also be on.

Policy violations

Phishing content, malware links, impersonation and harassment produce the most serious and least reversible actions, and unlike a compromise-triggered restriction, these are not solved by resetting a password.

The Restricted Entities Portal, Step by Step

This is the admin-facing fix for the most common cause above, and it takes minutes once someone with the right permissions sits down to do it.

Before you unblock anything

Microsoft is explicit that a sender exceeding outbound limits is an indicator of a compromised account, so treat the restriction as a warning worth investigating, not just an inconvenience to clear. Before removing the block:

1. Reset the account's password.
2. Review recent sign-in activity for locations or devices that do not match the user's normal pattern.
3. Check for inbox rules or forwarding the user did not create - a classic way attackers keep access after a password reset.
4. Review connected third-party apps and revoke anything unfamiliar or no longer needed.
5. Enable multi-factor authentication on the account if it was not already on.

Removing the restriction

1. Sign in to the Microsoft Defender portal at security.microsoft.com with an account that has Security Administrator, Organization Management, or Global Administrator rights.
2. Go to Email & collaboration, then Review, then Restricted entities. The direct address is security.microsoft.com/restrictedentities.
3. Find the mailbox - it shows in the list with an Entity type of Mailbox. Select it, then choose Unblock.
4. A flyout opens to an Overview page summarizing the restriction. Confirm you have worked through the recommendations - the compromise checks above - before continuing, then select Next.
5. On the Unblock user page, use the links provided to enable multi-factor authentication and reset the password if you have not already done both. Select Submit.
6. Confirm the warning dialog by selecting Yes once you are satisfied the account is secured.

Microsoft's own documentation states that restrictions are normally removed within about an hour of unblocking, with a stated upper bound of 24 hours if there is a transient technical delay. If mail is still refused well past that window, the mailbox may have picked up a separate, unrelated block - work through the identification table above again rather than assuming the same fix simply needs repeating.

If you manage many mailboxes

Larger organizations can view and clear restrictions from Exchange Online PowerShell instead of the portal, using Get-BlockedSenderAddress to list restricted senders and Remove-BlockedSenderAddress to clear one. The portal flow above is simpler for a single account and does not require a PowerShell session at all.

Turn on the alert so this does not surprise you next time

Microsoft 365 includes a built-in alert policy named User restricted from sending email that notifies admins automatically the moment this happens, rather than leaving you to discover it from a bounce report days later. Confirm it is switched on under Email & collaboration, then Policies & rules, then Alert policy, and check who is listed to receive the notification - by default that is your Global Administrators group.

Recovering a Blocked or Closed Personal Account

Everything above applies to Microsoft 365. A personal outlook.com, hotmail.com, live.com or msn.com account is a different world with no administrator to ask, and Microsoft splits it into two situations with two different recovery paths.

Temporarily blocked for unusual activity

Microsoft blocks a personal account defensively when it sees a pattern that looks like fraud or a takeover attempt: sign-ins from a new location or device, an unusual volume of password-reset or verification attempts, or activity that resembles automated account creation or spam. Work through it in this order:

1. Use the Outlook.com unblock flow, ideally from a device, browser and network you have used with the account before - that context is the strongest signal you can offer.
2. If you are given an unusual activity option and it genuinely was not you, select that path rather than guessing at a password repeatedly.
3. If several attempts have already failed, stop. Repeated attempts reset Microsoft's own timer and can extend the block. Wait at least 24 hours, and up to several days for a heavily-flagged account, before trying again.
4. Once access returns, change the password immediately and turn on two-step verification.

Locked or closed for a Microsoft Services Agreement violation

This is the more serious case, and the wording is usually explicit: a message that the account was locked or disabled because activity violated the Microsoft Services Agreement. Start at Microsoft's account recovery page and follow the on-screen verification. If recovery cannot restore access and you believe the determination was wrong, Microsoft provides a dedicated appeal path for exactly this situation, separate from ordinary sign-in recovery.

Be realistic going in. Microsoft states plainly that there is no path to reinstatement other than its own review process, duplicate submissions do not create a faster lane, and violations involving malware, phishing or serious abuse are rarely reversed regardless of how the appeal is written. If two attempts have gone nowhere, the better use of your time is usually migrating to a new, properly warmed mailbox rather than continuing to appeal a decision that has already been made twice.

Watch for the scam version of this problem

A blocked or suspended Microsoft account is a well-known target for scams: fake pop-ups claiming your account is suspended and demanding an immediate phone call, and paid account recovery services that promise to restore access for a fee. Microsoft does not call you about a blocked account, does not charge for recovery, and nobody outside Microsoft can unblock a Microsoft account. Treat any of those as fraud aimed specifically at people in exactly your situation.

When the Whole Microsoft 365 Tenant Is Suspended

If every user at the company loses access at the same moment, stop thinking about individual mailboxes. The subscription itself is suspended, and the fix happens in billing, not in any one user's settings.

The usual cause: a failed payment

An expired card, a card replaced after a fraud alert and never updated, a declined charge, or a subscription that lapsed at renewal all suspend the tenant. Microsoft's own documentation describes suspended subscriptions as becoming limited in functionality rather than disappearing outright, which is why mailboxes and data are generally recoverable once payment is sorted out.

Reactivating it

1. Sign in to the Microsoft 365 admin center as a billing admin. For a Microsoft Online Services Agreement account you need at minimum the Billing Administrator role; for a Microsoft Customer Agreement account you need to be a billing account or billing profile owner or contributor.
2. Go to Billing, then Your products, and select the subscription showing as inactive.
3. Under Subscription status, choose Reactivate, then confirm a payment method - either the one on file or a new one - and complete the reactivation.
4. Do not stop at the payment confirmation screen. Sign in as an ordinary user and actually send and receive a message, because re-provisioning Exchange Online across Microsoft's infrastructure can take up to 24 hours even after the subscription itself shows active.
5. Add a second payment method and a second billing contact so one expired card cannot take the whole company offline again.

The rarer case: a policy suspension by Microsoft

Separately from billing, Microsoft can suspend a tenant for abuse originating from the domain - most often a compromised mailbox that was allowed to send at volume before anyone noticed. The tell is that the admin center shows no billing problem at all; the block is a policy action instead. There is no self-service switch for this. A Global Administrator needs to open a support case from the admin center, and the same rule applies here as everywhere else in this guide: remediate first, ask second. Secure whatever account triggered it, document what you changed, and only then request reinstatement.

If a compromised mailbox is what caused this, assume the domain's sending reputation took damage on the way down. Check it against public blocklists once you are back, using the process in How to Get Off an Email Blacklist, since a reactivated tenant sending from a listed domain still will not reach anyone.

Keeping Email Running While You Wait

Recovery, especially the personal-account kind, can take days. Work does not pause for it.

• Reach important contacts another way. A phone call, a message on another platform, or a colleague's address keeps replies from silently piling up against a dead mailbox.
• Do not point a brand-new mailbox at the same campaign that got the last one restricted. An unwarmed replacement repeating the exact pattern that triggered the block is the fastest way to lose the second mailbox too.
• Check whether the problem is bigger than your account. If mail was already landing badly elsewhere before this happened, that reputation problem follows you to any replacement. If the trouble is actually about mail Microsoft is refusing from you as a sender rather than your own account being blocked, that is a different guide - see Outlook Blocking Your Emails? Complete Fix.
• Move anything that depends on this address as a recovery contact for other services before you lose access to more than email.

The structural fix is redundancy set up in advance: several warmed mailboxes across more than one domain, in rotation, so one restriction or suspension removes a slice of your sending capacity instead of all of it.

Preventing the Next Suspension

Sending discipline

• Keep per-mailbox volume comfortably under Microsoft's published limits - extra capacity should come from more mailboxes, not pushing one harder.
• Ramp new and recovered mailboxes over weeks, never in a single jump.
• Pace sends across the day with irregular gaps instead of a fixed interval.
• Rotate across mailboxes so no single account carries an entire campaign.

List discipline

• Verify addresses before the first send, and re-verify a list older than a few months.
• Remove hard bounces the same day they happen.
• Suppress recipients who never engage rather than sending a fourth follow-up.

Account and admin discipline

• Turn on multi-factor authentication on every sending mailbox.
• Review connected app and app-password access quarterly, and remove anything unused.
• Keep more than one Global Administrator on the Microsoft 365 tenant - if the only admin account is the one that gets compromised, nobody is left who can act.
• Keep the alert for restricted senders switched on and routed to someone who actually reads it.
• Keep two payment methods and two billing contacts on file so a single expired card cannot take the tenant down.

The wider deliverability picture - authentication, blocklists, and what happens when mail Microsoft accepts still does not arrive - is covered across the rest of our guides library.

Preventing the Next One With WarmySender

To be direct about what this does not do: WarmySender cannot remove a Microsoft 365 restriction, cannot reactivate a suspended subscription, cannot unblock a personal Microsoft account, and cannot file an appeal on your behalf. Every one of those requires either your own admin or Microsoft directly, and nothing about connected software changes that.

What it does is reduce the odds of tripping the sending pattern that caused this in the first place. WarmySender runs cold email campaigns, peer-to-peer email warmup, LinkedIn outreach, and multichannel sequences that combine email and LinkedIn in one flow. For the specific failure this guide covers, the mechanics that matter are a gradual warmup ramp on every new or recovered mailbox so it has a sending history before it ever carries a real campaign, per-mailbox daily sending caps you set deliberately, paced sending across the day instead of bursts, inbox rotation so no single mailbox looks like the source of an entire campaign, mailbox health monitoring that flags a problem while it is still small, and list verification before the first send so bounce spikes never happen in the first place.

None of that reverses a restriction or suspension you already have. It makes the pattern that causes one considerably less likely to repeat. See how WarmySender works.