Users Restricted from Sending
The question it answers: Which users has Exchange Online blocked from sending, which usually means the account is compromised?
When an account suddenly sends large volumes of spam or phishing, Exchange Online blocks it from sending. That almost always means the account is compromised - and it is still signed in, still reading mail and still able to create inbox rules. Every row here needs an incident response, not just a release.
At a glance
Section titled “At a glance”| Where in the app | Exchange Online › Mail Security & Hygiene › Users Restricted from Sending |
| Workload | Exchange Online |
| Kind | Findings list · dashboard tile |
| Data | Read from Microsoft 365 when someone first opens it, then kept for the report cache lifetime (Settings > Data & cache, 1 hour unless changed). It reads through PowerShell (Exchange Online or SharePoint Online), so the first load takes longer than a Graph report. |
| Licence | Exchange Online Protection; the risk column needs Entra ID P2. |
| Report id (API and MCP) | exchange.hygiene.restricted-senders |
Columns
Section titled “Columns”| Column | Key | Type |
|---|---|---|
| Severity | Severity | Status |
| State | Category | Text |
| User | Subject | Link |
| Check | Setting | Text |
| Value | Value | Text |
| Finding | Finding | Text |
| Identity Protection | Detail | Text |
| Restricted since | When | Date |
| Count | Number | Number |
A findings list hides columns that no row fills. Severity is Critical, Serious, Warning, OK or Info; rows rated Critical, Serious or Warning need attention (Working with findings).
What it needs
Section titled “What it needs”Licence: Exchange Online Protection; the risk column needs Entra ID P2.
Application permissions on the IntensiveReports app registration (all permissions):
| Permission | API | What it allows | Note |
|---|---|---|---|
Exchange.ManageAsApp | Office 365 Exchange Online | Manage Exchange As Application | + Security Reader in Exchange |
IdentityRiskyUser.Read.All | Microsoft Graph | Read all identity risky user information | optional |
User.Read.All | Microsoft Graph | Read all users’ full profiles | address to UPN, optional |
User-LifeCycleInfo.Read.All | Microsoft Graph | Read all users’ lifecycle information | with |
User.Read.All | Microsoft Graph | Read all users’ full profiles | with |
Data sources it reads
Get-BlockedSenderAddressGET /v1.0/identityProtection/riskyUsers (optional)
Through the API and MCP
Section titled “Through the API and MCP”GET /ir-api/v1/reports/exchange.hygiene.restricted-senders?size=100An AI assistant reads it with the MCP tool get_report and the id exchange.hygiene.restricted-senders. The client needs the Read grant for Exchange Online. See Using the API.