How to fix compromised account. Not able to send emails

If you believe your Microsoft 365 account has been compromised and you are unable to send emails, follow these steps to secure your account:

1. Reset Your Password: Immediately reset your password to prevent further unauthorized access.
2. Revoke User Access: Use PowerShell to revoke any active sessions. You can run the following command in an elevated PowerShell window:

      Revoke-MgUserSignInSession -UserId <YourEmailAddress>
   

   Replace <YourEmailAddress> with your actual email address.
3. Check for Suspicious Activity: Look for unusual activity in your mailbox, such as missing emails or unexpected changes in your contacts. If you notice any suspicious inbox rules (like forwarding emails to unknown addresses), remove them.
4. Review MFA Devices: Check the Multi-Factor Authentication (MFA) settings and remove any unrecognized devices or methods.
5. Scan for Malware: Ensure that your devices are free from malware by running a comprehensive scan.
6. Notify Your Administrator: If you are part of an organization, inform your IT administrator about the compromise so they can assist you further.
7. Enable MFA: If you haven't already, enable Multi-Factor Authentication to enhance your account security moving forward.

Following these steps can help you regain control of your account and secure it against future compromises.

References:

• Respond to a compromised cloud email account
• Secure and Restore Email Function to a Compromised Microsoft 365 Mail Enabled Account

Hi @Sylvia King 

Thank you for contacting the Microsoft Q&A forum.   

From what you’ve described, being unable to send email can indeed be one of the signs that an account has been compromised. This usually appears along with several other indications of unusual activity. 

To look into this more accurately, I strongly recommend contacting your organization’s IT administrator. They are in the best position to help because they have access to tools and permissions that forum moderators or external users do not. 

If you’re seeing an error message when trying to send email, there is a strong chance that your account has been placed on the Restricted entities list.  

Your IT admin can verify this and remove the restriction by going to the Microsoft Defender portal: https://security.microsoft.com, go to Email & collaboration > Review > Restricted entities. Or they can go directly using this link:  https://security.microsoft.com/restrictedentities. 

For additional guidance, your IT admin can refer to Microsoft’s documentation: Remove blocked users from the Restricted entities page - Microsoft Defender for Office 365 | Micros… 

I hope this helps clarify your situation. If you have any updates or more questions, please feel free to reply.  

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".         

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.