Home › Blog › Research › Azure Tenant Study

Original research10 min read

Microsoft’s Azure tenant crackdown and the 550 5.7.237 bounce: what three fleets showed

From 29 October 2026, vendors and senders across sequencers started reporting a bounce code nobody had seen before, 550 5.7.237, on Microsoft tenants. Here is what it did to three fleets we can see into, in three segments: two of our customers’ and our own.

WarmInboxes original research · WI-RESEARCH-2026-004·Fieldwork: 20 October to 8 November 2026
Share this

The short version

0 / 0

Segment 1: tenant blocks / licence wipes across 1,500+ customer tenants at 25 users

1.4–2.1%

Segment 1: bounce rate across those tenants, at 76 sends per tenant on an active day

49.0%

Segment 2: of everything the dense tenants sent on Oct 27–30, this much bounced

0.94%

Segment 2: the same tenants' bounce rate on Nov 1–2, once Microsoft lifted the block

0.62% → 1.09%

Segment 3: our own fleet's bounce rate, Oct 26–30 against Nov 2–5

2.0×

Segment 3: bounce rate on our 100-inbox domains against our 50-inbox domains

Segment 1 came through untouched. Customer tenants at 25 users, sending around 76 a day and up to 162 on the busiest, had no blocks and no licence wipes.

Segment 2 got blocked, then came back. 142 dense customer tenants at 50 or 100 users had their outbound refused with 550 5.7.708 from 20 October 2026. On Oct 27–30, 49.0% of everything they sent bounced. By Nov 1–2 it was 0.94%, and from Nov 3 there wasn’t a single 550 5.7.708. Not one licence was suspended.

Segment 3, our own fleet, stepped up and stayed low. Bounce rate went from 0.62% to 1.09% across 12,103 Microsoft inboxes, about 1.7× and still around one in a hundred, with the densest domains carrying most of it.

The three segments

SegmentTenantsWindowWhat happened
Segment 1
Customer tenants, 25 users each
1,500+Last 21 days1.4–2.1% bounces, no blocks, no licence wipes
Segment 2
Customer tenants, 50 or 100 users each
142Oct 20 – Nov 8Outbound refused with 550 5.7.708; 49.0% bounced, then 0.94%
Segment 3
Our own agency fleet, two workspaces
12,103 inboxesOct 26 – Nov 50.62% → 1.09%, heaviest on 100-inbox domains

What happened

From 29 October 2026, reports came in from several infrastructure vendors and from senders themselves: Microsoft was restricting Azure tenants used for cold email, and bounces carrying 550 5.7.237 were appearing across sequencers. Operators started calling it a crackdown.

Microsoft has not said what 5.7.237 means. We found no Microsoft documentation for the code as of 6 November 2026. Microsoft’s guidance groups the 5.7.x family as policy and permission rejections, so it reads as a policy refusal rather than a bad address, but that is a reading of the family, not of the code. Paste one into the bounce analyzer and it is named for what it is.

The worst-affected accounts saw something harsher: 550 5.7.708 Service unavailable. Access denied, traffic not accepted from this IP. That is not a refusal of one message but of the tenant’s outbound traffic. Microsoft’s own Q&A threads tie it to Exchange Online blocking outbound mail from a low-reputation IP, most often on new or trial tenants. And it started earlier than anyone reported: Segment 2’s Exchange records show 550 5.7.708 from 20 October 2026, nine days before the first 5.7.237 reports.

The diagnosis: tenant age

Working through the affected accounts, the restriction appears to fall on tenants younger than about 10 to 14 days. Domains placed on older tenants performed normally, even sending through the same sequencer IPs as the ones being refused, which points at the tenant rather than the IP pool behind the sequencer.

It fits the three segments. Segment 1’s 1,500+ tenants with no blocks were established tenants, and the prewarmed ones with a month or more of warmup behind them were not affected at all. Segment 2’s refusals ran for about two weeks, from 20 October 2026 to 2 November, and then stopped while the tenants kept sending, which is what tenants ageing out of a restriction would look like. It also fits 550 5.7.708’s association with new tenants.

This is a diagnosis from the accounts we worked, not a counted split: the Exchange records do not carry tenant age, and we have not yet tallied every tenant by age against its outcome. We will publish that if the pattern holds.

What it changes for anyone buying Microsoft infrastructure: a brand-new tenant is now the riskiest place to start cold volume. Inboxes on tenants that are already weeks old and warmed, which is what a prewarmed pool is, and sending domains aged before they carry cold mail, are worth more now than they were a month ago.

Method

Segment 11,500+ customer tenants WarmInboxes built at 25 users each. Read from the tenants over the last 21 days: tenant count, average and peak daily sends, bounce range, tenant blocks and licence wipes. The fleet's total sends and bounces are worked out from those, with the formula shown.
Segment 2142 customer tenants at 50 or 100 users (73 and 69), the ones that were hitting 550 5.7.708 when we pulled the October data. Read from Microsoft's Exchange records: every failed send on all 142 for Oct 20–30, two windows with full send counts (Oct 27–30 and Nov 1–2), hourly checks of Microsoft's bounce notices to Nov 8, and one licence check on 3 November 2026. These overlap in time, so we never add their counts together. Dates as the traces recorded them (India Standard Time).
Segment 3Our own agency fleet, 12,103 Microsoft inboxes across two workspaces. Sends and bounces per day, per workspace and per inboxes-per-domain configuration, read from the sequencer for 26 October to 5 November 2026.
Tenant blockOutbound sending refused for the whole tenant, every user at once: 550 5.7.708.
Licence wipeThe tenant's mailbox licences removed, so the users stop existing as mailboxes.
NamedNo customer, vendor, domain or sequencer. Workspaces are lettered.

Segment 1

Customer tenants at 25 users: no blocks, no wipes

Over the last 21 days, across 1,500+ Microsoft tenants we built at 25 users per tenant and domain, warming ones included:

  • 76 sends per tenant on an average active day; the busiest tenant on its busiest day sent 162.
  • Bounce rate between 1.4% and 2.1% across the range.
  • 0 tenant blocks and 0 licence wipes.
  • Tenants sending 76 to 150+ a day were fine, and prewarmed tenants with a month or more of warmup behind them were not affected at all.

The numbers

Over 26 October to 6 November 2026, 12 days, that fleet sent up to 1,368,000 emails (1,500 tenants × 76 sends × 12 days), of which 19,152 to 28,728 bounced at the measured 1.4–2.1%. The sends take every tenant at its active-day average every day, so they are the ceiling, and 1,500 is the floor of the tenant count.

Segment 2

Customer tenants at 50 or 100 users: refused, then recovered

142 dense customer tenants, 73 at 50 users and 69 at 100, each sending around 220 cold emails a day. These are the tenants that were getting hit when we pulled the October data, so this shows how hard it hit and for how long, not how many dense tenants got hit.

Refused from Oct 20

Between Oct 20 and Oct 30, Microsoft’s records for these 142 tenants show 117,605 failed sends. 113,244 of them, 96.3%, were 550 5.7.708: the tenant’s outbound refused, not a bad address. Every single tenant had them. Oct 20 is as far back as the records go, so it may have started earlier.

DateFailed sendsWith 550 5.7.708
Oct 2013,79013,751
Oct 219,5149,432
Oct 2210,82810,710
Oct 2317,24917,095
Oct 2411,59011,438
Oct 2514,40714,229
Oct 269,9469,682
Oct 274,7864,126
Oct 2810,7619,167
Oct 2914,28813,170
Oct 30446444

These records count failures, not sends, so they don’t give a bounce rate on their own. The two windows below do. Oct 30 is a part day.

Half of everything bounced, then under 1%

WindowTenantsSentBouncedRate550 5.7.708
Oct 27–305955,19127,06749.0%26,750
Nov 1–2135170,2901,5950.94%966

Oct 27–30: 27,067 of 55,191 bounced. That’s 49.0%, and 98.8% of those were 550 5.7.708. The median tenant bounced 52.0%, 42 of 59 were above 40%, and not one was under 2%.

Nov 1–2: 1,595 of 170,290, or 0.94%, with tenants sending around 600 a day. The median tenant bounced 0.3%, 132 of 135 were under 2%, and there was no 5.7.237 on any of them.

The two windows don’t cover exactly the same tenants, so we checked the 52 that are in both: 48.5% on Oct 27–30, 1.72% on Nov 1–2. Same tenants, same drop.

Inbox count didn’t make a difference here. On Oct 27–30 the 50-inbox tenants bounced 49.9% and the 100-inbox tenants 46.5%, even though the 50s were sending more each (around 465 a day against 144).

Gone by Nov 3

We check Microsoft’s bounce notices every hour. This is how many tenants showed any 550 5.7.708 each day, out of the ones we could read in full.

DateTenants with 550 5.7.708Tenants checked
Oct 3124126
Nov 13125
Nov 21125
Nov 30125
Nov 40125
Nov 50125
Nov 60125
Nov 70125
Nov 80125

No licence was suspended. When we checked on 3 November 2026, 135 tenants had their Microsoft licences enabled and none were suspended; the other 7 couldn’t be read that day. 550 5.7.708 blocks a tenant’s mail. It doesn’t take its mailboxes away.

Segment 3

Our own agency fleet, day by day

12,103 Microsoft inboxes across two workspaces, 26 October to 5 November 2026: 188 bounces on 19,876 sends, 0.95%.

DateSentBouncedRate
Oct 261,58760.38%
Oct 2749640.81%
Oct 282,711210.77%
Oct 291,36980.58%
Oct 3039920.50%
Oct 313000.00%
Nov 18333.61%
Nov 24,976591.19%
Nov 33,338361.08%
Nov 42,491220.88%
Nov 52,396271.13%

The step came on Nov 2. Oct 26–30 ran at 0.62% (41 on 6,562); Nov 2–5 at 1.09% (144 on 13,201). Nov 2 was also the biggest send day by far, 4,976, so volume and the new code arrived together. Oct 31 and Nov 1 sent 113 between them; Nov 1’s 3.61% is 3 bounces and reads as noise.

By inboxes per domain

ConfigurationSentBouncedRateShare of bounces
100 inboxes per domain14,1201521.08%80.9%
50 inboxes per domain4,197230.55%12.2%
25 inboxes per domain1,548130.84%6.9%
3 or 1 inbox per domain1100.00%0.0%

The 100-inbox domains carry 80.9% of the bounces. They carry most of the volume too, but they still bounce at 2.0× the rate of the 50-inbox domains, 1.08% against 0.55%.

It is not a clean line: the 25-inbox domains sit between them at 0.84%, on 1,548 sends, which is too few to rank against the 50s with confidence. Read it with segments 1 and 2, where the difference between 25 and 50+ users was blocks against none.

By workspace

WorkspaceSentBouncedRateShare of bounces
Workspace A12,2401331.09%70.7%
Workspace B7,636550.72%29.3%

What this study does not show

  • What 5.7.237 means. Microsoft has not published it; this records what the fleets did.
  • A counted split by tenant age. The 10 to 14-day line is our diagnosis from the affected accounts.
  • Cause. Density, daily volume and the new restriction arrived together; the fleets show which tenants were hurt, not why Microsoft chose them.
  • How many dense tenants were hit. Segment 2 is the 142 tenants that were hit, so it shows how hard and for how long, not what share.
  • A bounce rate for every day of Segment 2. Microsoft’s records count failures without sends, so the rates come from the two windows with full send counts.
  • Send-by-send totals for segment 1. Its fleet totals come from the tenant count and averages, with the sends as the ceiling.
  • A heavy-volume agency test. Our own fleet sent about 1.6 emails per inbox over the whole window, so it shows the step in bounce rate, not how it holds at full pace.
  • Google Workspace or Microsoft 365 bought direct. Every tenant here is Azure, built for cold email.

What to do with this

  • Keep Azure tenants at about 25 users per tenant and domain, and daily sends per tenant in the 76–150 range the unaffected fleet ran at.
  • Do not start cold volume on a tenant younger than about 10 to 14 days. Start on prewarmed tenants, or give new ones a month of warmup first: prewarmed tenants with a month or more behind them were unaffected.
  • Age sending domains before they carry cold email, rather than registering and sending in the same week.
  • If a tenant bounces 550 5.7.708, its outbound is blocked: stop sending from it, and move its volume to older tenants rather than retrying.
  • Treat a wave of 550 5.7.237 as a tenant-level warning: cut that tenant’s volume and users before it becomes a block, and check the bounces with the bounce analyzer.

Hit by this?

Move your Azure to us and pay what you pay now

If your tenants are bouncing 550 5.7.708 or 5.7.237, you don’t have to rebuild on your own. Tell us what you pay your current vendor for fresh Azure inboxes and, depending on your volume, we’ll match it.

At that price you get the whole suite:

  • Client workspaces
  • Automated domain forwarding to your website
  • Deliverability monitoring (daily blacklist, SPF, DKIM, DMARC and expiry checks; the dashboard is in closed beta)
  • Expert technicians on WhatsApp

And you get the team that ran Segment 1 through this. We set tenants up at 25 users, keep each one’s daily sends in the range that came through untouched, and warm new tenants before they carry cold mail, because a brand-new tenant is exactly what got hit. If you need to send this week, our prewarmed Azure tenants are already past that age (prewarmed isn’t part of the price match).

Read next

Prewarmed & Fresh Inboxes

Google, Microsoft 365 and Azure inboxes with free prewarmed domains and DNS configured before you log in. Prewarmed inboxes send the day they land; every order is delivered within 48 to 72 hours.

Get Prewarmed & Fresh Inboxes