550 5.4.1 Recipient address rejected: Access denied is a bounce from Microsoft 365 (Exchange Online). Despite the words "access denied", it is usually not about you: Microsoft's mail gateway checked the address against the company's directory, did not find it, and refused the message at the door.

What to do depends on which side you are on. This page covers both. For every other code, see our guide to SMTP bounce codes.

What the error looks like

550 5.4.1 Recipient address rejected: Access denied. AS(201806281)

The AS(…) part is an internal Microsoft tag that shows where the refusal happened (at the edge of Microsoft's network, before any mailbox). You do not need to look it up.

What it means

Microsoft 365 has a feature called Directory-Based Edge Blocking (DBEB). When a message arrives for a company that uses it, Microsoft checks whether the recipient exists in that company's directory. If it does not, the message is rejected right away with 550 5.4.1.

So in most cases, 550 5.4.1 means the same thing as 550 5.1.1: this address does not exist at that company.

If you are the sender

  1. Check the address for a typo, especially the part before the @.
  2. If it is correct and you are sure the person exists, the problem is on their side (see below). Tell them another way; only their administrator can fix it.
  3. If the address is old or comes from a list, remove it. The person has most likely left the company, and their account was deleted.
  4. Check your own authentication anyway if many different Microsoft 365 companies refuse you at once: in rare cases this error comes with sender problems. The SPF and DMARC checker shows the basics.

When MailQuell checks an address and Microsoft answers 550 5.4.1, the address is reported as invalid: the same answer your real email would get.

If you are the administrator of the receiving company

The address exists in your organisation, but Microsoft 365 does not know it. Common causes:

  • The account is not synced to Microsoft Entra ID (Azure AD) from your on-premises directory.
  • The address is a mail-enabled public folder or a shared mailbox that is not in the directory Microsoft checks.
  • Mail is routed out and back through a third-party service (email signatures, archiving, security), and the return path is not set up as a trusted connector.
  • The accepted domain type does not match your setup (for example, a domain that should be "internal relay" because some mailboxes are still hosted elsewhere).

Fix the directory or the routing so the address is known. Turning DBEB off is possible but not recommended: it opens your mail system to directory-guessing spam.

Frequently asked questions

Is 550 5.4.1 a hard bounce?

Yes, for the sender. Treat it like a "user unknown" bounce unless you know the address is real.

Why does it say "access denied" if the address does not exist?

Because Microsoft refuses it at the network edge, before any mailbox is involved, and uses its generic "access denied" wording for that.

Can I fix it from my side as a sender?

Only by correcting the address or removing it. If the address is right, the recipient's administrator has to fix their directory.

Sources