Update Aug 13, 2026: To further strengthen protection against abuse and ensure fair use of Exchange Online resources, we are updating how the Tenant External Recipient Rate Limit (TERRL) quota is cal...
lmt73 I just dealt with this with a client today as well, also using Checkpoint. They're allotted Sent emails allowed is around 18K, yet the highest their running 24 hour amount was around 225. How does this even make sense? Did you get any clarification or work around on this? They were down maybe 2-3 hours today because I was chasing the issue without knowing what the heck was going on. MS support assured me there was an issue with the send limit, but we were around 2% of their limit at any given time.
Those numbers do not make sense, you're right. You can use Explorer in Checkpoint to show outbound emails in the last 24 hours, then export them. If there's a lot, you may need to break it down into smaller time periods. Sounds like you don't deal in high volume though. You can't go directly off of the number shown in the UI because it doesn't factor in emails to multiple recipients. You'll need to export to CSV then ask an AI tool to provide a count of external recipients (you may need to call out that multiple recipients are listed in one cell so it counts them all).
If you have outbound scanning enabled, you can shut it off to see if it helps. But I wouldn't consider that a permanent solution.
Under Policy->Office 365 Mail Threat Detection, at the bottom uncheck Protect (Inline) Outgoing Traffic if it is checked. It will take some time for this to kick in because it manages it via Entra group membership which takes some time to propagate.