Removing Multiple Blocked Senders from EOP

Along with an Office 365 subscription, you get Microsoft’s mail filtering solution Exchange Online Protection (EOP).  You can also subscribe to EOP if you are running on on-premises mail solution.

One nice feature of EOP is that it can be configured to detect and block outbound spam.  IF When a user account gets compromised (or maybe you have legitimate spammers) Microsoft can block the ability for the account to send any more outbound mail until you have addressed the account and unblocked it.  This is great until you have an outbreak of compromised accounts, likely due to phishing victims, and need to remove multiple blocked addresses.  So how can we do this?

Exchange Admin Center

In the Exchange Admin Center, we can only unblock one account at a time.  Great if you only need to block one or two accounts, but terrible if you have more.EACActionCenter

PowerShell FTW!

As is usually the case, PowerShell is going to be your friend here.  To see a list of accounts that are currently blocked, open a PowerShell session and connect to Office 365, then use the commandlet below. This will return the sender addresses that are currently blocked, along with the reason:


If you only need to unblock a single account, you can use the straightforward command:

Remove-BlockedSenderAddress -SenderAddress

Finally, if you need to mass remove addresses you cannot just pipe the Get to the Remove. Instead, you can use a quick one-liner like this:

Get-cloudBlockedSenderAddress | ForEach-Object -Process {Remove-cloudBlockedSenderAddress -SenderAddress $_.senderaddress}

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s