Responding to Outbound Spam Notifications from Microsoft

How to respond when Microsoft flags a user for sending outbound spam in Office 365.

Applicable to: System

Affiliation: Staff, IT Administrators

Prerequisites

You must be a system administrator with access to the Microsoft 365 admin portal and the NetID Portal.

Instructions

Log in to the NetID Portal and reset the user’s NetID password to prevent further unauthorized access.
Forward the outbound spam notification email to soc@colostate.edu and CC windows@colostate.edu.
1. The Security Operations Center (SOC) will notify the user and may offer training to help prevent future incidents.
Log in to the Microsoft 365 Admin Portal at the Microsoft Office portal using an admin account.
Navigate to the Exchange Admin Center:
1. Click the app launcher (grid icon) in the upper left, then select Admin.
2. In the lower left, select Exchange to enter the Exchange admin center.
In the Exchange admin center:
1. Click the Protection link on the left menu.
2. Click the Action Center tab at the top.
3. Find the user account flagged for spam.
4. Click the Unblock Account… link on the right side.

Outcome

Following these steps will restore the user’s ability to send email and notify the appropriate internal teams to investigate and prevent future compromises.