Compromised M365 account outbound email says it is spam from user.

[computertechguy]

I discovered a compromised M365 account (1) user claims no email for a couple of days, I discovered a rule that said mark as read and delete all incoming mail. That fixed the incoming, but now the outgoing says.

We did the normal stuff: reset password, disconnect all sessions.

Delivery has failed to these recipients or groups:

"user@domain.com" Any email address I just removed mine.
This message couldn't be delivered because the sending email address was not recognized as a valid sender. The most common reason for this error is that the email address is, or was, suspected of sending spam. Contact the organization's email admin for help and give them this error message.

Can anyone suggest where to look in the M365 dashboard to correct this? I have aticket opened with my provider, but this needs to be resolved as soon as possible.

Thanks.

I think I got it, he was blocked as sending too much spam. I unblocked him and have to wait the hour before we can test after he gets unblocked.

 

[YeOldeStonecat]

Looks like you got it (based on your last line)

Remove blocked users from the Restricted entities page - Microsoft Defender for Office 365

Admins can learn how to remove user accounts from the Restricted entities page in the Microsoft Defender portal. Users are added to the Restricted entities page for sending outbound spam, typically as a result of account compromise.

learn.microsoft.com

But yeah, in our KB section of our documentation system, bookmark this URL. WHich...is relevant once you sign into any clients 365 tenant

Sign in to your account

security.microsoft.com