Information
Microsoft 365 Defender reviews of Restricted Entities will provide a list of user accounts restricted from sending e-mail. If a user exceeds one of the outbound sending limits as specified in the service limits or in outbound spam policies, the user is restricted from sending email, but they can still receive email.
Rationale:
Users who are found on the restricted users list have a high probability of having been compromised. Review of this list will allow an organization to remediate these user accounts, and then unblock them.
NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.
Solution
To review the report, use the Microsoft 365 Admin Center:
Click Security to open the Security portal.
Under Email & collaboration navigate to Review.
Click Restricted Entities.
Review alerts and take appropriate action (unblocking) after account has been remediated.