Users are unable to send outbound email messages in Exchange Online

Incident
April 10, 1:11pm

Users are unable to send outbound email messages in Exchange Online

Status: closed
Start: April 10, 6:57am
End: April 10, 11:45am
Duration: 4 hours 47 minutes
Affected Components:
Update

April 10, 6:57am

April 10, 6:57am

Title: Some users may be unable to send outbound email messages in Exchange Online
User impact: Users may be unable to send outbound email messages in Exchange Online.
Current status: We're reviewing impact scenario details and log data provided by users reporting this problem. Scope of impact: Some users attempting to send email messages to users outside of their organization may be impacted. Next update by: Monday, April 10, 2023, at 4:00 PM UTC

Update

April 10, 8:57am

April 10, 8:57am

User impact: Users may be unable to send outbound email messages in Exchange Online.
More info: Impact is specific to sending email messages to addresses outside of their organization. Email messages sent other users within the organization aren’t impacted.
Users will see the following within the NDR message: "Remote server returned '550 5.7.705 Access denied, tenant has exceeded threshold"
Affected users will encounter this issue in all Exchange Online connection methods.
Current status: We're reviewing the Non-Delivery Reports (NDR) users receive while trying to send email messages to assist with the investigation. Scope of impact: Some users attempting to send email messages to users outside of their organization may be impacted. Next update by: Monday, April 10, 2023, at 6:00 PM UTC

Update

April 10, 10:59am

April 10, 10:59am

User impact: Users are unable to send outbound email messages in Exchange Online.
More info: Impact is specific to sending email messages to addresses outside of their organization. Email messages sent other users within the organization aren’t impacted.
Users will see the following within the NDR message: "Remote server returned '550 5.7.705 Access denied, tenant has exceeded threshold"
Affected users will encounter this issue in all Exchange Online connection methods.
Current status: Our review of NDRs provided by affected users is leading us to suspect that an anti-spam rule isn't behaving as expected and contributing to impact. We're investigating further to confirm this and to identify resolution options.
Scope of impact: Some users attempting to send email messages to users outside of their organization may be impacted.
Next update by: Monday, April 10, 2023, at 8:00 PM UTC

Resolved

April 10, 11:45am

April 10, 11:45am

Title: Users are unable to send outbound email messages in Exchange Online
User impact: Users are unable to send outbound email messages in Exchange Online.
More info: Impact was specific to sending email messages to addresses outside of their organization. Email messages sent to other users within the organization weren't impacted.
Users saw the following within the NDR message: "Remote server returned '550 5.7.705 Access denied, tenant has exceeded threshold"
Affected users would have encountered this issue in all Exchange Online connection methods.
Final status: We've confirmed through user feedback and internal telemetry monitoring of NDR occurrences that disabling the problematic anti-spam rule has resolved the issue.
Scope of impact: Some users attempting to send email messages to users outside of their organization may have been impacted.
Start time: Monday, April 10, 2023, at 9:00 AM UTC
End time: Monday, April 10, 2023, at 6:45 PM UTC
Root cause: A recently updated anti-spam rules wasn't processing or evaluating email data as expected, resulting in impact.
Next steps: - We're reviewing our anti-spam rule update processes and testing procedures to help prevent problems like this in the future prior to implementation. - We're additionally evaluating telemetry indicators, such as NDR increases, to better detect problems like this.
This is the final update for the event.

Resolved

April 10, 11:45am

April 10, 11:45am

Resolved

Update

April 10, 12:46pm

April 10, 12:46pm

User impact: Users are unable to send outbound email messages in Exchange Online.
More info: Impact is specific to sending email messages to addresses outside of their organization. Email messages sent other users within the organization aren’t impacted.
Users will see the following within the NDR message: "Remote server returned '550 5.7.705 Access denied, tenant has exceeded threshold"
Affected users will encounter this issue in all Exchange Online connection methods.
Current status: We've disabled an anti-spam rule that we suspect may be blocking some users from sending outbound email messages, and confirming with some users who initially reported the issue to confirm if disabling this rule remediated impact.
Scope of impact: Some users attempting to send email messages to users outside of their organization may be impacted.
Next update by: Monday, April 10, 2023, at 10:00 PM UTC

Update

April 10, 1:11pm

April 10, 1:11pm

User impact: Users are unable to send outbound email messages in Exchange Online.
More info: Impact is specific to sending email messages to addresses outside of their organization. Email messages sent other users within the organization aren’t impacted.
Users will see the following within the NDR message: "Remote server returned '550 5.7.705 Access denied, tenant has exceeded threshold"
Affected users will encounter this issue in all Exchange Online connection methods.
Current status: We've received positive feedback from some users that they can send external email as expected. We're continuing to wait for additional users to validate remediation, while we monitor telemetry which indicates that fewer users are receiving the NDR messages since we've disabled the rule. Additionally, we're further analyzing the anti-spam rule which we've disabled to understand the underlying root cause and to prevent impact from reoccurring.
Scope of impact: Some users attempting to send email messages to users outside of their organization may be impacted.
Next update by: Tuesday, April 11, 2023, at 1:00 AM UTC