Small number of users are blocked from sending email to external recipients

Incident
December 16, 5:38am AST

Small number of users are blocked from sending email to external recipients

Status: Closed
Start: December 15, 9:24am AST
End: December 16, 1:00am AST
Duration: 15 hours 35 minutes
Affected Components:
Update

December 15, 9:24am AST

December 15, 9:24am AST

Title: Small number of users can't send outbound email due to delays in the unblocking process
User Impact: Users are unable to send outbound email due to delays in the unblocking process.
Current status: We’re reviewing details provided in the support case to determine the next steps needed to resolve this issue.
Scope of impact: Your organization is affected by this event, and the issue impacts a single user.
Next update by: Wednesday, December 15, 2021, at 3:30 PM UTC

Update

December 15, 11:13am AST

December 15, 11:13am AST

Current status: We're analyzing diagnostic data to determine the source of the issue and develop a mitigation plan.
Scope of impact: Your organization is affected by this event, and the issue impacts a single user.
Next update by: Wednesday, December 15, 2021, at 5:30 PM UTC

Update

December 15, 12:42pm AST

December 15, 12:42pm AST

More info: Admins are experiencing delays in unblocking the users which have been previously blocked by Microsoft 365 Defender.
Affected users may receive the error message: '550 5.1.8 Access denied, bad outbound sender AS(42003)'.
Current status: We're continuing to review service telemetry and AntiSpam diagnostics to isolate the source of the issue.
Scope of impact: This issue affects your organization and is limited to users which have been previously blocked by Microsoft 365 Defender.
Next update by: Wednesday, December 15, 2021, at 6:00 PM UTC

Update

December 15, 1:55pm AST

December 15, 1:55pm AST

More info: Admins are experiencing delays in unblocking the users, which were previously blocked by Microsoft 365 Defender.
Affected users may receive the error message: '550 5.1.8 Access denied, bad outbound sender AS(42003)'.
Users can send email to users within their organization as expected.
Current status: We're reviewing example user data alongside the reported errors to determine if there's a particular pattern and formulate appropriate next steps.
Scope of impact: This issue affects your organization, and the problem is limited to users that were previously blocked by Microsoft 365 Defender.
Next update by: Wednesday, December 15, 2021, at 8:30 PM UTC

Update

December 15, 3:55pm AST

December 15, 3:55pm AST

More info: Admins are experiencing delays in unblocking the users, which were previously blocked by Microsoft 365 Defender.
Affected users may receive the error message: '550 5.1.8 Access denied, bad outbound sender AS(42003)'.
Users can send email to users within their organization as expected.
Current status: We've requested fresh Non-Delivery Report (NDR) examples from some affected users for analysis while reviewing message IDs to better understand the issue and determine our next steps.
Scope of impact: A small number of users that were previously blocked by Microsoft 365 Defender and are routed through the affected infrastructure may be affected.
Next update by: Wednesday, December 15, 2021, at 10:30 PM UTC

Update

December 15, 6:17pm AST

December 15, 6:17pm AST

More info: Admins are experiencing delays in unblocking the users, which were previously blocked by Microsoft 365 Defender.
Affected users may receive the error message: '550 5.1.8 Access denied, bad outbound sender AS(42003)'.
Users can send email to users within their organization as expected.
Current status: We've received fresh DNR examples from some affected users and are now reviewing them to determine the underlying cause of the issue. We're also exploring options to unblock the affected users.
Scope of impact: A small number of users that were previously blocked by Microsoft 365 Defender and are routed through the affected infrastructure may be affected.
Next update by: Thursday, December 16, 2021, at 1:00 AM UTC

Update

December 15, 8:51pm AST

December 15, 8:51pm AST

More info: Admins are experiencing delays in unblocking the users, which were previously blocked by Microsoft 365 Defender.
Affected users may receive the error message: '550 5.1.8 Access denied, bad outbound sender AS(42003)'.
Users can send email to users within their organization as expected.
Current status: Our review of the fresh NDR examples suggests this is not an issue with user configurations, and we're continuing to review recent changes to the service as we investigate a potential code issue. In parallel, we've begun unblocking individual users as reported via support cases to provide relief as we continue to investigate long-term solutions.
Scope of impact: A small number of users that were previously blocked by Microsoft 365 Defender and are routed through the affected infrastructure may be affected.
Next update by: Thursday, December 16, 2021, at 3:00 AM UTC

Update

December 15, 11:16pm AST

December 15, 11:16pm AST

More info: Admins are experiencing delays in unblocking the users, which were previously blocked by Microsoft 365 Defender.
Affected users may receive the error message: '550 5.1.8 Access denied, bad outbound sender AS(42003)'.
Users can send email to users within their organization as expected.
Current status: We've determined that a code issue is causing users to not be unblocked as expected. We're fixing the code issue and continuing to unblock individual users as reported via support cases.
Scope of impact: A small number of users that were previously blocked by Microsoft 365 Defender and are routed through the affected infrastructure may be affected.
Root cause: A code issue is causing users to not be unblocked as expected, which is preventing some users from sending email to external recipients.
Next update by: Thursday, December 16, 2021, at 6:00 AM UTC

Resolved

December 16, 1:00am AST

December 16, 1:00am AST

Title: Small number of users are blocked from sending email to external recipients
User Impact: Users were blocked from sending email to external recipients.
More info: Admins were experiencing delays in unblocking the users, which were previously blocked by Microsoft 365 Defender.
Affected users may have received the error message: '550 5.1.8 Access denied, bad outbound sender AS(42003)'.
Users could send email to users within their organization as expected.
Final status: We've completed the deployment of a fix to prevent this impact from occurring to additional users as well as unblocking all remaining mailboxes.
Scope of impact: A small number of users that were previously blocked by Microsoft 365 Defender and were routed through the affected infrastructure may have been affected.
Start time: Wednesday, December 15, 2021, at 9:47 AM UTC
End time: Thursday, December 16, 2021, at 5:00 AM UTC
Root cause: A code issue hindering users from being unblocked as expected, which was preventing some users from sending email to external recipients.
Next steps: - We're continuing our review of the impacting code to better identify and prevent similar impact in the future.
This is the final update for the event.

Resolved

December 16, 1:00am AST

December 16, 1:00am AST

Resolved

Update

December 16, 1:46am AST

December 16, 1:46am AST

More info: Admins are experiencing delays in unblocking the users, which were previously blocked by Microsoft 365 Defender.
Affected users may receive the error message: '550 5.1.8 Access denied, bad outbound sender AS(42003)'.
Users can send email to users within their organization as expected.
Current status: We've fixed a portion of the code issue and have manually unblocked individual users that have been reported via support cases. We're continuing to unblock reported users and fix the remaining code issue to remediate the impact.
Scope of impact: A small number of users that were previously blocked by Microsoft 365 Defender and are routed through the affected infrastructure may be affected.
Root cause: A code issue is causing users to not be unblocked as expected, which is preventing some users from sending email to external recipients.
Next update by: Thursday, December 16, 2021, at 10:30 AM UTC

Update

December 16, 5:38am AST

December 16, 5:38am AST

More info: Admins are experiencing delays in unblocking the users, which were previously blocked by Microsoft 365 Defender.
Affected users may receive the error message: '550 5.1.8 Access denied, bad outbound sender AS(42003)'.
Users can send email to users within their organization as expected.
Current status: We're continuing with our remediation efforts in repairing the remaining code issue. In parallel, we're processing the manual unblocking of affected users reported via support cases to provide immediate relief.
Scope of impact: A small number of users that were previously blocked by Microsoft 365 Defender and are routed through the affected infrastructure may be affected.
Root cause: A code issue is causing users to not be unblocked as expected, which is preventing some users from sending email to external recipients.
Next update by: Thursday, December 16, 2021, at 7:30 PM UTC