Microsoft Defender for Office 365
Email and collaborationOutbound Spam Restore Restricted Users
In brief
The article explains that hosted mailboxes use the blocked mailbox UPN, while nonhosted senders use their sending SMTP address when viewing details or removing a restricted sender.
What Defender admins need to know
Administrators can use the appropriate identifier to manage restricted senders successfully.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Use Exchange Online PowerShell to view and remove users from the Restricted entities page
To view thisthe list of users thatwho are restricted from sending email, run the following command in Exchange Online PowerShell:
Get-BlockedSenderAddress
The identifier for a restricted sender depends on the sender type:
- Hosted mailbox: The user principal name (UPN) of the blocked mailbox. The UPN and primary SMTP address aren't required to match.
- Nonhosted sender: The SMTP address that the sender uses. For example, an on-premises sender is listed by its sending SMTP address.
To view details about a specific user,restricted sender, replace <emailaddress> with their emailthe UPN of a hosted mailbox or the SMTP address of a nonhosted sender, and then run the following command:
Get-BlockedSenderAddress -SenderAddress <emailaddress> | Format-List
For detailed syntax and parameter information, see [Get-BlockedSenderAddress](/powershell/module/exchangepowershell/get-blockedsenderaddress).
To remove a user from the Restricted users list,restricted sender, replace \<emailaddress\> with their emailthe UPN of a hosted mailbox or the SMTP address of a nonhosted sender, and then run the following command:
```powershell
Remove-BlockedSenderAddress -SenderAddress <emailaddress>
@@ -12,11 +12,11 @@ ms.collection: - tier2 description: Admins can learn how to remove user accounts from the Restricted entities page in the Microsoft Defender portal. Users are added to the Restricted entities page for sending outbound spam, typically as a result of account compromise. ms.custom:- - msecd-doc-authoring-1016+ - msecd-doc-authoring-1015 - seo-marvel-apr2020 - sfi-ga-nochange ms.service: defender-office-365-ms.date: 07/03/2026+ms.date: 08/24/2026 appliesto: - ✅ <a href="https://learn.microsoft.com/defender-office-365/eop-about" target="_blank">Built-in security features for all cloud mailboxes</a> - ✅ <a href="https://learn.microsoft.com/defender-office-365/mdo-about#defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 Plan 1 and Plan 2</a>@@ -127,13 +127,18 @@ The default alert policy named **User restricted from sending email** automatica ## Use Exchange Online PowerShell to view and remove users from the Restricted entities page -To view this list of users that are restricted from sending email, run the following command in [Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell):+To view the list of users who are restricted from sending email, run the following command in [Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell): ```powershell Get-BlockedSenderAddress ``` -To view details about a specific user, replace \<emailaddress\> with their email address and run the following command:+The identifier for a restricted sender depends on the sender type:++- **Hosted mailbox**: The user principal name (UPN) of the blocked mailbox. The UPN and primary SMTP address aren't required to match.+- **Nonhosted sender**: The SMTP address that the sender uses. For example, an on-premises sender is listed by its sending SMTP address.++To view details about a specific restricted sender, replace \<emailaddress\> with the UPN of a hosted mailbox or the SMTP address of a nonhosted sender, and then run the following command: ```powershell Get-BlockedSenderAddress -SenderAddress <emailaddress> | Format-List@@ -141,7 +146,7 @@ Get-BlockedSenderAddress -SenderAddress <emailaddress> | Format-List For detailed syntax and parameter information, see [Get-BlockedSenderAddress](/powershell/module/exchangepowershell/get-blockedsenderaddress). -To remove a user from the Restricted users list, replace \<emailaddress\> with their email address and run the following command:+To remove a restricted sender, replace \<emailaddress\> with the UPN of a hosted mailbox or the SMTP address of a nonhosted sender, and then run the following command: ```powershell Remove-BlockedSenderAddress -SenderAddress <emailaddress>