High severity alert in school outlook, what to do

Hi @Derek Hobbs 

Thank you for posting your question in the Microsoft Q&A forum.        

It appears a high-severity alert was triggered for one of your staff accounts due to suspected compromised activity. Specifically, the account was automatically restricted from sending emails externally by Microsoft 365’s security systems to help prevent potential spam or phishing from being sent outside your organization. 

These restrictions are typically triggered when Microsoft detects patterns such as: 

• The account suddenly started sending a large number of emails in a short period of time. 
• There were unusual or suspicious login attempts that didn’t match the user’s normal behavior. 
• The account may have been used to send spam or unwanted messages, possibly without the user realizing it. 

You can reinstate the account when you are administrators by following these steps: 

1. Visiting the Microsoft 365 Defender portal: https://security.microsoft.com/restrictedusers 
2. Locating the affected user and selecting Unblock. 
3. Resetting the user’s password  
4. Enabling Multi-Factor Authentication (MFA) if not already active. 

This will lift the restriction and help secure the account moving forward. 

While restricted, the teacher can still send emails within your organization (e.g., to ******@yourschool.com addresses). Only external sending is blocked. 

To reduce the chances of this happening again, we recommend: 

1. Enabling MFA for all staff. 
2. Reviewing outbound spam policies in the Microsoft 365 Defender portal. 
3. Educating staff on phishing awareness and safe email practices. 

For more information, please refer to the following link:  

• Outbound spam protection 
• Address compromised user accounts with automated investigation and response 
• Remove blocked users from the Restricted entities page 
• Responding to a Compromised Email Account 

Note: Please understand that our initial response does not always resolve the issue immediately. However, with your help and more detailed information, we can work together to find a solution.  

I hope this information is helpful. Please follow these steps and let me know if it works for you. If not, we can work together to resolve this.  

Thank you for your patience and your understanding. If you have any questions, please feel free to reach out.  

I'm looking forward to your reply.  

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".      

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.