Forum Discussion
Tenant blocked from sending email
Having the same, been blocked twice in 4 months on a small tenant of 8 users, only sending 30-50 emails a day, MS claim they detected 15000 outbound emails both times, yet all logs/reports are completely clean.
I also suspect that MS is incorrectly attributing spam to the wrong tenant, or there is a flaw/vulnerability allowing spammers to obfuscate/hide/delete/attribute email.
Either way I'm 100% sure the issue is on MS side.
Also getting the run around with support it seems they have no intentions of taking this seriously and that it will just bounce around low level support till we give up on it.
Sorry to hear that. I never got anywhere with MS support, even after doing a paid support request. There was never an actual resolution. They eventually just enabled our domain, and then thankfully it hasn't been blocked again since August 2022. I'm always fearful that the same thing will happen again, especially since there was no explanation of how it happened.
eagles1927I found the root cause of this issue 🙂
SharePoint did it.Guest users in the client's SharePoint had configured alerts on the document library, these alerts triggered for file change actions.
So when a large number of files were changed, SharePoint attempted to send 2 external users 1 email per file change, according to the SharePoint logs that was 97000 the first time 20000 the second ect.
SharePoint email notifications do not show up in your exchange as outbound (you will get an inbound trace if you are sending the alerts internally) but it appears MS will count them against the sending limits and lock your tenant. I'm not sure if internal ones would also cause your tenant to lock, but you would find it easily as you would see hundreds or thousands of them being delivered in message trace.
On a side note it was difficult to locate the correct Settings menu within SharePoint as the GUI would not let you navigate there directly, i had to go to the document library site home page and append "/_layouts/15/settings.aspx" to the URL to actually access the correct alert settings under 'user alerts', using the GUI we could only access the default site settings witch had no documents or alerts configured.
Also turning off alerts with the global settings/options had no impact on the user defined alerts (there may be a method using powershell but the GUI cannot be used to stop them)
It may also be possible that something like defender alerts could also cause this issue as i believe both SharePoint and defender use the same email setup, although it's far less likely you would have an alert setup that would trigger so many alerts and send the notification externally, but i can confirm these also do not show up in message trace for outbound.Chris_Itnstuff Thanks a lot for letting me know how you fixed it, and I'm glad you were able to get to the bottom of the issue. We don't really use SharePoint in our domain except for a few specific use cases, so I'm not sure if our issue is the same. But if it happens again, I will keep this in mind.