The pool model
Normal outbound leaves via shared healthy IP pools. Mail that LOOKS risky — outbound spam verdicts, anomalous volume — gets routed via the high-risk delivery pool: separate IPs whose reputation is, by design, sacrificial. Receivers treat high-risk-pool IPs accordingly. The system protects the healthy pools (and everyone else's delivery) from YOUR bad day; the cost is that your bad day compounds — spam flagged → risk pool → more rejections (the 5.7.708 family in the NDR concept when Microsoft itself starts restricting the sender/tenant).
The usual trigger is one compromised mailbox running the BEC starter kit: burst sending, then your legitimate mail starts bouncing from partners — the incident announces itself via deliverability before security tooling speaks.
The escalation ladder Microsoft runs
Individual sender: outbound-spam policy thresholds hit → the user is restricted from sending (blocked-senders list in Defender, alert raised — the per-user circuit breaker). Tenant-level: enough badness → tenant sending restrictions (the 5.7.7xx responses). Your controls on the same ladder: outbound spam policy limits (hourly recipient caps, forwarding controls — in the nightly scan), which you should TIGHTEN from defaults so the circuit breaker fires before reputation damage, not after.
The recovery sequence (order matters)
- Contain the account (revoke sessions, reset, kill the inbox rules and OAuth grants — BEC concept).
- Clear the restriction (unblock the sender in Defender once clean).
- THEN wait out pool recovery — reputation heals on Microsoft's timeline, not your escalation's; partner-side blocks may need their delisting flows.
- Post-incident: findings into outbound-policy thresholds and the auth-module records (SPF/DKIM intact throughout? attackers love sending as you WITH your own authentication).
What to watch (proofs)
- Restricted entities: the Defender restricted-senders view + its alert — the circuit breaker's state; wire the alert to your channel (serv365 delivery pattern).
- Outbound spam policy: Get-HostedOutboundSpamFilterPolicy (nightly scan) — thresholds and forwarding stance; drift here is security-posture drift.
- The early smoke: outbound volume per sender trends (mail-flow reports) — the burst is visible BEFORE the bounces if anyone looks; alert on deviation.
- Far-side evidence: 5.7.708-family and partner-bounce text trends (NDR ledger) — the reputation state as receivers see it.