email error code: 550 5.7.705 Access Denied

[BillyCarpenter]

My client is using O365 email account with Outlook. Several users are reporting that they can't send emails and they're getting a Delivery Failure message with code: 550.7.705. This indicates that they've exceeded their limit but that's not likely. It's more likely that they've been hacked or their email is being spoofed.

First time encountering this. I've read up on what I need to do. I'm hoping someone can help??

Thanks.

[slimslob]

Sounds like someone is sending bulk email from your client's public IP Address. Might be someone spoofing the address or could be some in their building or accessing their
WiFi.

Object moved

[rthonpm]

You're going to need Exchange admin to check the accounts and see if there are unrecognised connections or large amounts of mail sent from those accounts. There are plenty of tools in the Admin portal to figure out what's happening.

Sent from my Pixel 6 Pro using Tapatalk

[BillyCarpenter]

So, I went into Exchange Admin Center. Found 2,200 incoming Phishing emails and that bulk emails had been sent out. There are ways to determine where the emails originated from. I haven't done that yet but I will. I have to open a service ticket with Microsoft to get the block lifted....after I I complete the checklist. Fist step - change all passwords.

[rthonpm]

So, I went into Exchange Admin Center. Found 2,200 incoming Phishing emails and that bulk emails had been sent out. There are ways to determine where the emails originated from. I haven't done that yet but I will. I have to open a service ticket with Microsoft to get the block lifted....after I I complete the checklist. Fist step - change all passwords.

Not only change passwords but enforce MFA.

Sent from my Pixel 6 Pro using Tapatalk

[BillyCarpenter]

This turned out to be a valuable learning experience. There's a lot of valuable tools in the Admin Center. I was able to activate MFA all in one whack. Then I had to check forwarding rules on all accounts and some other stuff.

Thanks to rthonpm for your help.

[BillyCarpenter]

Welp, I finally heard back from Microsoft. They will remote into the network tomorrow to get the issue resolved. There was one thing that I missed: "connectors" had been set up to route mail between Office 365 and someone else's server.

There were 2 connectors set up in the account. One IP address traced back to France and the other to Singapore.



Truly a learning experience.

[BillyCarpenter]

The dude from Microsoft remoted in and ran a diagnostic test and all passed. Email is working again.

Some of the employees are complaining about MFA. Anyone that isn't a Global Admin can't even log in to their account. Only Global Admins can. I wasn't aware that it works like that. Now I know. I had to create 5 global admin accounts for the top people in the organization.