Email sending issues post-compromise

Crawford Warnock 0 Reputation points
2026-08-28T12:00:05.63+00:00

Hi there

I had my email hacked a few days back and secured the account, but I cannot now get the block lifted - every email I send is met with the same : "Remote server returned '550 5.1.8 Access denied, bad outbound sender AS(42004)'" - but when I try to log into the defender portal (as suggested by AI, based on the MSFT pages) I cannot access it? How do I fix this?

Microsoft Security | Microsoft Defender | Microsoft Defender for Office 365
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Zoha Fatima 430 Reputation points
    2026-08-29T08:51:46.0566667+00:00

    Hi Crawford,

    That 550 5.1.8 AS(42004) error usually means Microsoft has restricted the account from sending because suspicious outbound activity was detected, which would fit with the recent compromise.

    Since you have already secured the account, the next step is to have a Global Administrator or Security Administrator check Microsoft Defender under Email & collaboration > Review > Restricted entities and unblock your account. If you cannot access that page yourself, it is likely a permissions issue, so your Microsoft 365 administrator will need to do it. Microsoft says sending normally becomes available within about an hour after the restriction is removed.

    Thank you, and feel free to respond back for more assistance.

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.