Stuck in the Microsoft 365 administrative void with a user who can’t send email? Here is the unvarnished guide to clearing the “Restricted entities” block using both the GUI and PowerShell, so you can get back to real work.

Fixing the “Account Blocked and Not Recognized” Error: A DevOps Perspective

I still remember the first time I ran into this specific flavor of rejection. It was 4:45 PM on a Friday—because that is the only time critical infrastructure is allowed to break. I was managing a migration for a logistics client, and suddenly their VP of Sales, let’s call him sales-lead-01, went dark. He tried to send a quarterly update and got hit with a bounce back: “This account is currently blocked and not recognized as a valid account.”

He panicked, thinking we had accidentally deleted his Active Directory user object during a sync cycle. I panicked, thinking our hybrid Exchange server exch-hybrid-prod had finally given up the ghost. We were both wrong. The account wasn’t deleted, and the server was fine. Microsoft had just decided to put him in “Time Out.”

The “Why”: It’s Not a Bug, It’s a Feature

If you see this error, you usually aren’t dealing with a broken account; you are dealing with a security trigger. specifically, the High Risk Delivery Pool (HRDP) in Microsoft 365 (Exchange Online).

Microsoft’s algorithms constantly monitor outbound traffic. If marketing-intern@techresolve.com suddenly sends 2,000 emails in ten minutes (perhaps because they got compromised, or perhaps because they just discovered the “CC All” button), Exchange Online slams the brakes. It blocks the account from sending to protect the IP reputation of their servers. The error message is just poorly worded—it says “not recognized as valid” because, effectively, the account has been stripped of its sender privileges.

The Fixes

Here is how we get the lights back on. I’ve broken this down into three approaches: the manual click-ops way, the automated engineer way, and the nuclear option for when things are truly FUBAR.

1. The Quick Fix: The Defender Portal (Click-Ops)

If you only have to do this once a year, just use the GUI. It’s buried, but it works.

• Navigate to the Microsoft 365 Defender Portal (security.microsoft.com).
• Go to Email & collaboration > Review > Restricted entities.
• You will likely see the offending user listed there.
• Select the user and click Unblock.

Pro Tip: You will be forced to walk through a wizard asking why the user was blocked (e.g., compromised account). Be honest here. If you select “Compromised,” it might force a password reset depending on your tenant policies.

2. The Permanent Fix: PowerShell (The DevOps Way)

I hate clicking through portals. It’s slow, and I can’t script it. If you manage a tenant with thousands of users, or if you suspect multiple accounts on prod-app-server-04 got flagged, use PowerShell.

First, connect to Exchange Online, then inspect the damage:

# Connect to Exchange Online
Connect-ExchangeOnline

# Find out who is in the penalty box
Get-BlockedSenderAddress

Once you have confirmed the blocked account (e.g., alex.vance@techresolve.com), run this to release them:

# Unblock the specific user
Remove-BlockedSenderAddress -SenderAddress alex.vance@techresolve.com

# Verify the list is empty
Get-BlockedSenderAddress

I usually wrap this in a script that alerts my team via Slack whenever Get-BlockedSenderAddress returns a value, so we know about the block before the user calls the helpdesk.

3. The “Nuclear” Option: Hybrid Sync Mismatches

Sometimes, the error is literal. If you are in a Hybrid environment (On-Prem AD syncing to Azure AD via Entra Connect), and the ImmutableID gets mangled, Microsoft 365 genuinely might not recognize the account as valid.

If the unblock methods above don’t work, and the user status looks weird in the Admin Center (e.g., “Cloud Only” when it should be “Synced”), you might have a sync orphan. This is risky, but it works:

Warning: This relies on SMTP matching to re-link the accounts. Ensure the PrimarySMTPAddress matches exactly on both sides, or you will end up with john.doe123@domain.com and a very angry user.

Most of the time, it’s just the spam filter being overzealous. Unblock them, tell them to stop sending 50MB attachments to the entire company, and get on with your day.

Darian Vance

Lead Cloud Architect & DevOps Strategist

With over 12 years in system architecture and automation, Darian specializes in simplifying complex cloud infrastructures. An advocate for open-source solutions, he founded TechResolve to provide engineers with actionable, battle-tested troubleshooting guides and robust software alternatives.

🤖 Frequently Asked Questions