Microsoft 365 Cold Email After MC1454397: New-Tenant Limits

Microsoft 365 got two changes in 2026 that hit cold email from fresh tenants. Under Message Center post MC1454397, rolling out from mid-September to the end of November 2026, a new tenant gets 10% of its tenant external recipient rate limit (TERRL) for its first 30 days and 25% until day 60, and a trial tenant gets 500 external recipients a day instead of 5,000. At the end of December 2026, SMTP AUTH Basic Authentication, the password login many sending tools use, is turned off by default in existing tenants. If your outreach runs on tenants opened in the last two months, plan for a fraction of your summer volume and check how your tools log in before December.

We make Outreach2day, SMTP/IMAP mailboxes with warmup and a sequencer. We don't sell Microsoft 365. Everything below comes from Microsoft's posts and documentation, read October 30, 2026.

What MC1454397 Changes

Microsoft's stated reason is to "strengthen protection against abuse and ensure fair use of Exchange Online resources." The post names three groups:

• New tenants. Days 1 to 30: 10% of the standard calculated quota. Days 31 to 60: 25%. After day 60: 100%.

• Trial tenants. 500 external recipients a day, down from 5,000. Some Learn pages still show 5,000; the Message Center post is newer, so plan for 500.

• Education tenants. A new formula gives free EDU licenses a lower weight than purchased ones, so they add less quota.

The formula for ordinary tenants is unchanged: 500 × (purchased email licenses^0.7) + 9,500 external recipients in a rolling 24 hours. Microsoft says "no immediate action is required" and points to the Tenant Outbound External Recipients Rate report in the Exchange admin center (Reports > Mail flow).

Per-mailbox limits are in Microsoft 365 sending limits.

Why Warmup and Follow-Ups Eat the Reduced Quota

TERRL counts external recipients: any address outside your tenant's accepted domains. In cold email that is every prospect and every warmup partner, since warmup mail goes to mailboxes in other organizations. Repeat sends count too, so each follow-up is another recipient.

Worked through Microsoft's formula:

• 1 license. Full quota 10,000 a day. Days 1 to 30: 1,000. Days 31 to 60: 2,500.

• 10 licenses. Full quota about 12,006. Days 1 to 30: about 1,201. Days 31 to 60: about 3,001.

• Trial tenant. 500 a day.

Cold sends alone may fit: ten mailboxes at our guideline of 25 cold emails a day is 250 recipients. Add warmup and follow-ups and a 10-license tenant can spend its 1,201 in its first month. The pool is shared, so once it is spent, external mail from every user in the tenant bounces.

Bounce Codes on New and Trial Tenants

Each of these comes from your own tenant, not the recipient's filter, so new copy or a new list won't clear it:

• 550 5.7.232. "Message blocked due to trial tenant external recipient limit." The 500-a-day trial cap is spent; it clears as the 24-hour window rolls.

• 550 5.7.233. "Message blocked due to tenant external recipient limit." The same cap on a non-trial tenant; while the tenant is new, it hits at 10% or 25% of the usual number. Steps to confirm and clear it: how to fix 550 5.7.233.

• 550 5.7.708. "Access denied, traffic not accepted from this IP." Microsoft Learn (October 2, 2026) says the sending IP has a low reputation and this "is more likely to affect new customers," such as trials. Only Microsoft Support can grant an IP exception. On a Microsoft Q&A thread of October 23, 2026, a new trial tenant got it on every external message and was sent to support.

• 550 5.7.705. "Access denied, tenant has exceeded threshold." Not specific to new tenants: the tenant sent too much spam or bulk mail; outbound mail stops for everyone until admins fix the cause and Microsoft Support removes the block.

Codes from the recipient side, such as 550 5.7.515, are in why Outlook blocks cold email.

SMTP AUTH Deprecation (Basic Auth): The December 2026 Timeline

SMTP AUTH is how an app or sending tool submits mail to Exchange Online over SMTP; Basic Authentication means it logs in with a username and password. Microsoft first planned the cutoff for September 2025, then for March to April 2026, and replaced that plan on January 27, 2026:

• Until December 2026: nothing changes.

• End of December 2026: Basic Auth is "disabled by default for existing tenants," and "administrators will still be able to enable it if needed."

• Tenants created after December 2026: Basic Auth is "unavailable by default"; OAuth is the supported method.

• Second half of 2027: Microsoft announces the final removal date.

Microsoft gives no exact day, only "end of December." Sequencers that connect Microsoft inboxes with OAuth, Instantly among them, aren't affected by this step. A tool that stores an SMTP password per mailbox can fail to log in once the default flips, unless an admin re-enables Basic Auth, which only buys time until the removal date.

A separate switch sits next to it: SmtpClientAuthenticationDisabled turns SMTP AUTH off for the whole organization, and a per-mailbox setting overrides it. Microsoft recommends keeping SMTP AUTH off except for mailboxes that still need it (Learn, September 16, 2026). When it is off, sending tools typically see a 535 5.7.139 authentication error, judging by Microsoft Q&A threads. Microsoft hasn't published what tools will get after the December default changes.

Disposable and Aged Tenants

The setup most exposed is the tenant opened only to send and replaced when it burns. emailexpert.com (August 26, 2026) called the change "considerably less useful" for that setup, expects disposable tenants to get slower and more expensive rather than disappear, and says the change may encourage stockpiling and a secondary market for aged tenants.

A tenant older than 60 days does get 100% of its quota. Age doesn't change Microsoft's outbound spam controls, the 5.7.705 ban or the December Basic Auth default.

A Checklist for This Week

1. Write down each tenant's creation date and the days it crosses 30 and 60.

2. Open the Tenant Outbound External Recipients Rate report per sending tenant and set an alert before the cap, for example at 80%.

3. Budget warmup, cold sends and follow-ups together under the reduced quota.

4. Check how every tool logs in and move password-based SMTP AUTH connections to OAuth before the end of December.

5. Don't replace a blocked tenant with a new one. It starts at 10%, and 5.7.705 or 5.7.708 has a cause to fix first.

6. Keep company mail off sending tenants. A spent TERRL or a ban stops support and billing mail too.

If Your Outreach Depends on New Tenants

If your sending runs on Microsoft 365 tenants under 60 days old, or on trials, the math above is your daily ceiling until each tenant ages. Mailboxes sold as Azure inboxes are Exchange Online mailboxes in a Microsoft tenant, so the same rules apply. One option is to move cold volume to SMTP/IMAP mailboxes outside any Microsoft tenant quota: see the SMTP route off Microsoft 365 and Azure inboxes.

Outreach2day sells cold email infrastructure on that model: standard SMTP/IMAP mailboxes on your domains at $2.50 a month each, from 12 mailboxes ($30), with warmup and a sequencer, or synced to Instantly and Smartlead by API key. Mailboxes are ready within 24 hours and warm up for 14 days. Gmail and Outlook still filter every message; we measure placement per mailbox and don't promise it.

When we're not the fit. No Google Workspace or Microsoft 365 mailboxes, no trial, a 12-mailbox minimum, no white-label portal for agency clients. If a client requires Microsoft accounts, or you need 1 to 5 mailboxes, keep a small, aged Microsoft 365 setup on separate domains at low volume.

FAQ

Does MC1454397 apply to my existing tenant?

The 10% and 25% quotas apply to newly created tenants in their first 60 days. A paid tenant older than that keeps 100%. The trial and EDU rules apply at any age.

Can I ask Microsoft to raise the new-tenant quota?

MC1454397 describes no request process. For tenants that run near the cap, Microsoft suggests a third-party bulk email service or more licenses.

Does High Volume Email (HVE) help?

Not for prospecting. Microsoft limits HVE to internal recipients within the tenant and says HVE accounts can't be used for external email delivery (Learn, August 3, 2026).

Is SMTP AUTH gone in December 2026?

No. Basic Auth becomes off by default in existing tenants and admins can still turn it on; OAuth keeps working.

Sources

Checked October 30, 2026:

• MC1454397, Microsoft 365 Message Center (public mirror), published August 14, updated September 29, 2026.

• Exchange Team Blog: Updated SMTP AUTH Basic Authentication Deprecation Timeline, January 27, 2026; Retire Basic auth for Client Submission, April 15, 2024, updated January 27, 2026; Tenant Outbound Email Limits, updated August 13, 2026.

• Microsoft Learn: NDR codes 550 5.7.705 and 5.7.708, October 2, 2026; Q&A on 550 5.7.708, October 23, 2026; SMTP AUTH settings, September 16, 2026; a Q&A thread on 535 5.7.139, 2021; High Volume Email, August 3, 2026.

• emailexpert.com: 60-day sending probation, August 26, 2026.