Microsoft 365 SecurityComplianceCenter: User Restricted From Sending Email
Alerts when Microsoft 365 SecurityComplianceCenter reports a user was successfully restricted from sending email due to sending-limit policy violations.
- Product
- m365
- Service
- threat_management
- Author
- austinsonger (SigmaHQ), DRL 1.1
- Published
- 2021-08-19
- Updated
- 2026-07-31
ATT&CK techniques
Initial AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule triggers when the Security Compliance Center reports a successful event indicating a user was restricted from sending email after exceeding sending limits under service policies. Such restrictions can be abused to disrupt communications or to prevent legitimate sending, so alerting on these enforcement actions helps security teams validate policy outcomes and investigate impacted accounts. It relies on threat management telemetry from Microsoft 365 with event source SecurityComplianceCenter and the specific event name 'User restricted from sending email' with successful status.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy
- learn.microsoft.comhttps://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/cloud/m365/threat_management/microsoft365_user_restricted_from_sending_email.yml
Changelog
v4- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Microsoft 365 SecurityComplianceCenter: User Restricted From Sending Email"
id: e4df2531-0104-451c-a099-49a1885b5400
status: test
description: This rule triggers when the Security Compliance Center reports a successful event indicating a user was restricted from sending email after exceeding sending limits under service policies. Such restrictions can be abused to disrupt communications or to prevent legitimate sending, so alerting on these enforcement actions helps security teams validate policy outcomes and investigate impacted accounts. It relies on threat management telemetry from Microsoft 365 with event source SecurityComplianceCenter and the specific event name 'User restricted from sending email' with successful status.
references:
- https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy
- https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/m365/threat_management/microsoft365_user_restricted_from_sending_email.yml
author: austinsonger, Huntrule Team
date: 2021-08-19
modified: 2022-10-09
tags:
- attack.initial-access
- attack.t1199
logsource:
service: threat_management
product: m365
detection:
selection:
eventSource: SecurityComplianceCenter
eventName: User restricted from sending email
status: success
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: ff246f56-7f24-402a-baca-b86540e3925c
type: derived