550 5.4.1 Recipient Address Rejected: Access Denied (Microsoft 365) Fix

The bounce reads "550 5.4.1 Recipient address rejected: Access denied", often followed by a code such as AS(201806281) and the name of a Microsoft server. It comes from Exchange Online at the edge, before any mailbox is involved. Microsoft accepts mail for the domain, checked its directory for the address, and found nothing. The cause is on the recipient's side: either the address was never created in their Microsoft 365 tenant, or the domain's MX still points at Microsoft after the company moved its email somewhere else.

Quick answer

If you sent the message, confirm the address with the person by another channel; you cannot fix their tenant. If the bounce is for your own domain, you have two possibilities: you still use Microsoft 365 and the address is missing from the directory (add the user, shared mailbox or contact), or you moved to another provider and forgot to change the MX records (the settings that tell the internet where to deliver email for your domain), in which case update the MX to the new provider (mail.oqumail.com with priority 10 for OquMail) and remove the domain from the Microsoft tenant.

Why Microsoft answers this way

Exchange Online uses directory-based edge blocking: when a domain is set as authoritative in a tenant, the edge servers reject any recipient that is not in the tenant's directory, instead of accepting the mail and bouncing it later. That is good for spam but produces this bounce for every address that was not synced, was mistyped, or belongs to a domain whose owner has moved on without updating DNS.

If you are the sender

1. Check the spelling; a missing letter in a Microsoft 365 address gets this exact bounce rather than a friendlier "user unknown".
2. Ask the recipient, or their colleague, whether the address exists. New hires sometimes have a licence before the directory sync has run.
3. If the company recently changed email providers, their MX may be stale. Run their domain through the free MX lookup; if it shows mail.protection.outlook.com but they say they use something else, tell them.
4. Do not retry automatically. It is a permanent rejection until something changes on their side.

If the domain is yours and you still use Microsoft 365

1. In the Microsoft 365 admin center, check Users, Active users for the address. Create the user, or add the address as an alias on an existing user, or create a shared mailbox or a mail contact.
2. If you sync from on-premises Active Directory, confirm the sync ran and the user has the proxyAddresses entry for that address.
3. If the domain is deliberately shared with another system that holds some addresses, change the accepted domain type from Authoritative to Internal relay in the Exchange admin center so unknown addresses are forwarded instead of rejected.

If you moved away from Microsoft 365

1. Look up your MX records. If they still point at mail.protection.outlook.com, every sender gets this bounce for any address you did not keep in the tenant, which after a migration is all of them.
2. Replace the MX with your new provider's: for OquMail, a single record at the root, value mail.oqumail.com, priority 10. Delete the Microsoft one.
3. Update SPF to drop include:spf.protection.outlook.com and add the new provider, and publish the new DKIM record.
4. Remove the domain from the Microsoft tenant once the records have propagated, so a leftover licence cannot re-attach it.
5. Send a test from an outside address. The migration checklist covers the rest of the move.

Common questions

Why did it work last week?

Someone removed the user or the licence, or the company changed providers and the MX was left behind. Both produce this bounce the same day.

Is this the same as 550 5.1.10 RecipientNotFound?

Nearly. 5.1.10 comes from inside the tenant after edge checks; 5.4.1 comes from the edge. The fix on the recipient side is the same: the address has to exist in the directory.

Can a Microsoft 365 tenant reject my whole domain?

Yes, through a tenant-level block list or a transport rule. That bounce usually says "5.7.1" with a message about the sender being blocked rather than 5.4.1, and the recipient's admin has to lift it.

Want to see how your own domain is set up? Use the free MX lookup: it runs in your browser and stores nothing.