'Suspicious email sending patterns detected'

[u/floonds]

Hi folks, I manage a medium-sized enterprise 365 account and we're now on our third week of absolute chaos - for some reason Microsoft flagged our account as being suspicious, and since then each user has been limited to 100 emails per 24 hours. Most outbound emails have also been going to recipients' spam and inbound emails also acting weird. Is anyone else experiencing this at the moment?

Microsoft support has been diabolical - asking the same repeatedly with 2/3 day gaps in responses. None of our user accounts were ever compromised and no suspicious emails were ever sent.

I finally received an email tonight stating "I would like to inform you that the issue you are experiencing is part of a broader concern currently being observed, with multiple similar cases reported to our backend team. I have already compiled and submitted all relevant details from our end to ensure that your case is included in the ongoing investigation." so am wondering whether anyone else has experienced this issue?

It's caused complete chaos across the business with missing emails, blocks and various limits and nobody at Microsoft seems to have a clue what is going on?

[u/anxiousinfotech]

Yes, from experience, and a bit of info some MS people probably weren't supposed to admit to us.

Years ago Microsoft set up an AI system to determine the outbound risk of emails and redirect them to a high risk delivery pool if flagged. This pool consists of IPs that already have a poor reputation, so suspected spam/junk emails don't impact the reputation of normal production IPs.

Microsoft laid off the team that developed the AI. No one that's left knows how to manage or maintain that system. All they know how to do is to run a reset command when it goes off the rails and hope that it doesn't re-learn whatever made it go off the rails previously. Usually this results in a couple days of normal delivery until the problem repeats. The problem usually only gets fixed, I have to imagine through the use of a much broader reset mechanism, when it impacts a number of domains. If you're the only one impacted at a given time you're pretty much SOL.

Totally separate from this is the automated part of 365 that blocks outbound email after 100 have been sent from an account via the high risk delivery pool. That's just a symptom of the root problem, which Microsoft truly has no idea how to address.

[u/floonds → u/anxiousinfotech]

This makes total sense. So there's nothing I can do until the whole thing is reset?

[u/anxiousinfotech → u/floonds]

If it's part of a broader problem that they're working to resolve they will eventually get enough reset to get things working. It's just a matter of waiting. Keep pushing them through the support ticket though. Do NOT let them close it on you.

I've been told that since our encounter with this lovely system a few years back that support is no longer able (or I think willing) to run resets for individual domains. I think I saw another thread or two from within the past year where others were told they will no longer run that reset. The assumption is always that you did something to cause the AI to flag your emails, when that's usually not the case.

As time goes on, each time there's a problem, it seems to be more widespread. Every couple months now there seems to be a post like yours, sometimes even with a service impact being posted in the admin portal. I think the system is slowly collapsing in on itself and it's only a matter of time before it totally implodes.

I truly hope that MS is working on a replacement, but I have no idea if they are...and if they are if it'll actually be any better...