our first large 365 issue. "Tenant restricted from sending email "

[KK20]

Out of the blue this morning we have been hit with an "Tenant restricted from sending email " security compliance event. Ive raised a ticket with microsoft as I cannot see a single reason why. Email volume has not changed, top senders are the secretaries (who always have been), report by connector is the same as always, we are a fairly low volume "sender" with less than 1000 external email per day - no recent spikes, no changes to infrastructure.

 

Alert was "The majority of traffic from this tenant has been detected as suspicious and the tenant has been restricted from sending email". Looking through the usual screen, security and compliance shows no marked suspicious users. No mailflow anomalies, no spikes in the last 7 days. Ive put a full "show me all outbound email in the last 10 days" report request into the mail flow trace and am waiting for that to be completed for download. That should show any immediate compromised accounts.

 

That also being said, we have a mail rule on maximum 50 external emails per day for pupils, a ban on external emails from younger pupils and even staff have a limit of 500 external email per day (apart from the secretaries). Noone has hit the limits (we would be emailed on alert). we block forwarding except for 2 accounts and there have been a grand total of 5 forwarded emails in the last 30 days. Ive checked barracuda and McAfee DNS reputations which are all good so im stumped. Any advice whilst im waiting for MS to get back to me?

 

Internal email is still working, it is just external that appears to have been blocked.

Edited October 19, 2021 by KK20

[KK20]

Nice one microsoft. Apparently yesterday we sent out 2 mailshots totalling 1072 emails. By two separate people. this was enough to label our tenant as suspicious. From their eyes we "doubled" our usual baseline. I have no idea how I can mitigate that in the future.

 

Awesome.

[KK20]

it gets better. Apparently we arent allowed to send to parents as this violates:

 

• Sending bulk mail. This is because bulk mail violates the Office 365 terms of service. Exchange Online customers who have to send legitimate bulk commercial email (for example, customer newsletters) should use third-party providers that specialize in these services

 

The mailshots were for sports cancellations.

 

I have just sent an email to all staff informing them not to send bulk email, along with bouncing it up the line (I do miss my old exchange server). oh the irony.

[TechMonkey]

Have to say, this is a known restriction from O365 and they have been tightening bulk security over the past few years. Look at SendGrid or something similar, or adjust the settings to slowly release the emails. Though this may cause issues if it is an urgent notice that is time sensitive.

We had the same issue with our Library system before we realised the Librarian was sending out late emails all on the same day to the whole school and each parent.

 

MS can not afford for their mail servers to be blacklisted as it would hobble their whole service, so they have to self regulate heavily.

[KK20]

they were sent from outlook as a distribution list by the secretaries so it looks like she is going to be learning something new. Ironically we dont use the MIS to send email due to isams not keeping a decent enough log. isams can use sendgrid so I think a chat with their sales is in order.

[Oaktech]

it gets better. Apparently we arent allowed to send to parents as this violates:

 

• Sending bulk mail. This is because bulk mail violates the Office 365 terms of service. Exchange Online customers who have to send legitimate bulk commercial email (for example, customer newsletters) should use third-party providers that specialize in these services

 

The mailshots were for sports cancellations.

 

I have just sent an email to all staff informing them not to send bulk email, along with bouncing it up the line (I do miss my old exchange server). oh the irony.

 

We use a combination of Mailchimp - for 'manual' bulk messages and Amazon SES for bulk from our MIS.

[TechMonkey]

they were sent from outlook as a distribution list by the secretaries so it looks like she is going to be learning something new. Ironically we dont use the MIS to send email due to isams not keeping a decent enough log. isams can use sendgrid so I think a chat with their sales is in order.

 

What issue do you have with the iSAMS log? We find it OK. Could do with some search tools but shows who sent what, when and to whom. We have the SendGrid set up, it may even be setup all ready for you as I think they were making it mandatory to stop their servers being blacklisted.

[KK20]

it was clunky to find recipients that "failed" if the person didnt save the initial page report. I just use the raw text log and search but the secretaries found it hard to navigate.

[TechMonkey]

With SendGrid they could just use that.

[KK20]

an update, after going through message tracing logs with Microsoft, it turns out the 2x mailshots were not sent to 1072 recipients: They were to 43 and 51 recipients respectively. Microsoft have included all our INTERNAL mail into the 1072 factoring. So the staff briefing email sent to all staff? Microsoft have labelled that as bulk. The reminder for inset training to all staff? Bulk email. Office staff sending trip proformas to school year group going out on a trip? Bulk email. Our tenant as a whole per day doesnt send what they label as a maximum per user per hour. This is insane. There is no evidence of foul play, no evidence of compromised users, we already have limit policies that have never tripped.

 

So we are now supposed to use mailchimp or sendgrid for internal mail? Even going to outlook and selecting a mail group is now bulk mail? Even Microsoft own limits page says this is treat as "one recipient" so I cannot see how they can propose that. Im looking at enabling centralized mail and using our own exchange server to send mail at least in the short term. the exact opposite of what we set out using 365 for. I have asked the case to be escalated as this makes no sense being blocked at all.

Edited October 20, 2021 by KK20

[supportman]

Can you share your mail flow rules for students please? I'd like to set that up as well.

 

Seems like you have done everything right here. We use our MIS to send out bulk emails so it skips the office 365 limits.

[TechMonkey]

Ok, that is silly. Internal email shouldn't matter. I think you should escalate that as someone is fobbing you off.

[KK20]

not really much to say. For our younger year groups they are blocked in exchange rules matching OU vs mail direction and deny - this is in exchange admin -> mail flow -> rules. I also have a deny for receiving external email for our younger year groups, there are exceptions for whitelisted education sites that reset passwords and our external library system.

 

For the rest we have "security" -> policies & rules ->threat policies -> anti spam policies. In there I have 4 outbound policies, one for all pupils witha restriction on external recipients per hour and maximum recipients per day. The other 3 are for generic staff (slightly more recipients per hour and day) one which allows forwarding for a single account (we have forwarding disabled) and one for increased recipients per hour and day (for our secretaries).

 

Incidentally this is our 90 day connector profile so internal and external. Bonus points if you spot where term started :-)

 

Edited October 20, 2021 by KK20

[gmonks]

As techmonkey says, I would escalate. We send All Staff emails which is 80+ users and we've been okay.

[psydii]

Do you have a rule that archives all mail to a single mailbox?

[KK20]

nope. No archive, I do remember when I was first in post (back in exchange 2003 days) that is how the school used to archive. Nowadays I dont bother, I have retention rules and run reports on mailbox sizes, when they get over 5gb the staff member gets told to not use their inbox as a storage device, I have yet to have a teacher defy this so ive not needed to do any large pruning (more of an issue in exchange days as you would never truly recover that space unless you wanted to risk a database defrag which I never did!)

 

Lets see what the escalation does. We have been unblocked for the time being but ive asked for the ticket to be escalated and left open since I dont want it happening again - afterall I have changed nothing and cannot see what to change....

Edited October 20, 2021 by KK20

[psydii]

The only limits I am aware of are documented here: https://docs.microsoft.com/en-us/office365/servicedescriptions/exchange-online-service-description/exchange-online-limits#receiving-and-sending-limits

 

10,000 recipient per user per day with a rate limiter of 30 messages per minute.

 

There is also a limit on the number of messages a mailbox can receive per hour, so that is why I asked about the archive mailbox.

 

I find it very hard to understand where or how 1000 messages would cause you to trip a tenant level limit! Do keep us posted.

[KK20]

update. We have been temporarily unblocked whilst being escalated. Ironically the email from microsoft telling me of this was marked as spam by EOP. You cant make this up.

 

The last word was that we have been blocked for the AI flagging us as sending outside of our normal pattern. The issue with this is that the connector egress graphs would show otherwise, our volume log on a day by day basis would also not show this. The variation is by a hundred or so at the most. Their response then was "this is on the basis of your mailbox to email ratio". So 11k in a week maximum for a tenant of 1024 with no abnormal burst email?

 

The final email before I insisted on an escalation was that we have a new tenant that hasnt had a proper update to EOP with the licence count. I cannot see how a three year old tenant with little variation in licencing would do this.

 

Still, at least we can email for the time being.

[KK20]

Our tenant was being locked every day (although first line support kept unlocking it). Escalation got to the root cause: Not our fault.

 

OutboundSpam24Hours=0;OutboundUnprovisionedMail24Hours=0;TenantAgeInDays=0;TotalSeatCount=0;TrialSeatCount=0;MessageId=;SnapShotStatus=0

 

Looks like someone or something at MS set our tenantage and licencecount to zero. Thanks for that. In essence, sending any external email would have tripped it... Now I can undo my emergency "send email from onsite" via hybrid centralized mail transport.

Edited October 29, 2021 by KK20