13.2 Managing Restricted Entities & Blocked Users

What a Restricted Entity Is

A restricted entity in Microsoft Defender for Office 365 is a user account that has been blocked from sending email. The restriction is applied to the account — not to a specific message — and it prevents the user from sending any mail until an administrator removes the restriction. The two usual triggers are:

• Detected compromised account: Defender for Office 365 (and Exchange Online's built-in compromised-account detection) identifies signs of takeover — anomalous sign-ins from new locations, large volumes of mail to external recipients, suspicious inbox rules created via EWS, or hidden forwarding configured by an attacker.
• Anomalous bulk-sending behavior: The account suddenly sends a spike of messages that trip sending-pattern heuristics, even if no clear compromise is yet confirmed.

In both cases the system places the user on the Restricted users list to stop the bleeding while investigation happens. From the user's perspective, outbound mail is rejected or held and they may see a non-delivery report indicating their account is restricted.

Where to Find Restricted Entities

In the Microsoft Defender portal (https://security.microsoft.com), restricted entities are exposed under Email & collaboration → Review → Restricted entities. The page lists each restricted user with:

• User (UPN and display name)
• Reason (e.g., “Compromised account” or “Suspicious sending pattern”)
• Timestamp of the restriction
• Details link to the underlying alert or investigation

The same list is also reachable from the Exchange admin center under Mail flow → Restricted entities, and from the older Restricted users page in the Security & Compliance Center. For MS-102, treat the Defender portal path as the canonical one.

How a User Becomes Restricted

Exchange Online and Defender for Office 365 use several signals to decide a user should be restricted automatically:

1. Impossible-travel or anomalous sign-in — a sign-in from a geographically implausible location relative to recent history.
2. Volume spike — the account suddenly sends many more messages than its baseline, especially to external domains.
3. Suspicious inbox rules — rules that delete or move mail containing words like “invoice,” “statement,” or “password,” or that auto-forward to an external address, are created via EWS or EAC.
4. Hidden forwarding — an attacker configures SMTP forwarding on the mailbox to exfiltrate mail.
5. OAuth app consent abuse — a malicious app was granted mailbox access and is sending on the user's behalf.

When the combined signal crosses a threshold, Exchange Online sets the account to a restricted state and Defender raises an alert (for example, “Suspicious email sending activity detected” or “User restricted from sending email”).

The Remediate-Then-Unblock Flow

Unblocking a user is not a one-click action — and on the exam, the correct sequence always puts remediation before removing the restriction. If you unblock before securing the account, the attacker resumes sending immediately.

The recommended operational flow is:

1. Detect — review the alert on the Restricted entities page and the linked investigation.
2. Restrict (already done by the system) — confirm the user is on the restricted list so no further mail leaves.
3. Investigate & remediate:
   • Reset the password and require a strong, unique value.
   • Revoke active sessions (Microsoft 365 admin center → user → “Sign out of all sessions,” or via PowerShell Revoke-AzureADUserAllRefreshToken).
   • Enable and enforce MFA if not already in place.
   • Remove malicious inbox rules and hidden forwarding — check both Outlook rules and EWS/MAPI rules, and clear any auto-forwarding to external addresses.
   • Quarantine and clean — review the user's sent items and quarantine for malicious messages.
4. Unblock — return to the Restricted entities page and select Unblock; confirm when prompted. The user can send mail again, typically within a few minutes.

Restricted User vs. Blocked Sender vs. Quarantine

MS-102 questions frequently test the distinction between three different “block” concepts. They operate at different layers:

A restricted user can still receive mail; only sending is blocked. A Tenant Allow/Block List (TABL) block stops messages from a given sender/domain before they reach the mailbox. Quarantine holds individual messages regardless of who sent them. Knowing which layer a control operates at is the key to answering scenario questions.

Unblocking in Practice

From the Restricted entities page, select the user and choose Unblock. A flyout confirms the action and, in many tenants, shows the reason the user was restricted. After unblocking, monitor the account closely for the next 24–48 hours — if the underlying compromise is not fully remediated, the account will be re-restricted quickly and the alert cycle repeats.

If a user is repeatedly restricted, escalate to a full incident response: review sign-in logs in Microsoft Entra ID, audit mailbox for hidden delegates or app registrations, and consider requiring password reset plus MFA enrollment at next sign-in.

PowerShell Equivalents

For automation-minded admins, the equivalent operations are available via Exchange Online PowerShell V3:

• List restricted users: Get-BlockedSenderAddress
• Remove a restriction: Remove-BlockedSenderAddress -Sender <UPN>

These cmdlets operate on the same restricted-entities store exposed in the portal. They are useful for bulk operations or scripted remediation runbooks, but the remediate-then-unblock sequence still applies — do not run Remove-BlockedSenderAddress before the account is secured.

Best Practices

• Always remediate before unblocking. Reset password, revoke sessions, enforce MFA, and remove malicious rules/forwarding first.
• Review the linked alert or AIR investigation before unblocking — it often names the specific malicious artifact (rule, forwarding address, OAuth app) to remove.
• Monitor recently unblocked accounts for 24–48 hours; re-restriction is a strong signal of incomplete remediation.
• Keep the distinction clear: account restriction is not the same as a mail-flow block or a quarantined message. Each has its own page and its own purpose.