Detecting Onmicrosoft Domains Impacted By Email Exchange Restrictions With External Domains
Query
EmailEvents
| where SenderFromDomain endswith "onmicrosoft.com"
| extend Date_F = format_datetime(Timestamp, "yyyy-MM-dd")
| summarize make_set(RecipientDomain), Total_External_Domains=dcount(RecipientDomain) by SenderFromDomain,Date_F
| order by Total_External_DomainsAbout this query
MITRE ATT&CK Technique(s)
| Technique ID | Title |
|---|---|
| T1566 | Phishing |
Author: Sergio Albea (23/08/2025)
Detecting Onmicrosoft domains impacted by email exchange restrictions with External Domains(June 2026)
Microsoft has announced new restrictions on email sending for organizations that use the default onmicrosoft domains. A throttling system will be enforced, limiting external email delivery to a maximum of 100 recipients per organization every 24 hours. To summarize:
- Microsoft limits onmicrosoft.com domains to 100 external emails daily.
- Targets cybercriminals exploiting new tenants, protecting shared domain reputation.
- Organizations must purchase custom domains, rollout phases through June 2026.
The following KQL Query shows the number of distinct external domains where your onmicosoft.com domain, has been sending emails during a day. Could be that you don't detect 100 domains x day but in any case, I would recommend to start to purchase / configure your own domains instead of use the mentioned one.
Explanation
This query is designed to help organizations monitor their email sending activity from their default "onmicrosoft.com" domains, particularly in light of new restrictions imposed by Microsoft. Here's a simplified explanation of what the query does:
-
Context: Microsoft is limiting the number of emails that can be sent from "onmicrosoft.com" domains to external recipients. Each organization can send emails to a maximum of 100 different external domains per day. This is to prevent abuse by cybercriminals and to encourage organizations to use custom domains.
-
Purpose of the Query: The query helps organizations track how many distinct external domains they are sending emails to each day from their "onmicrosoft.com" domain. This is important for ensuring compliance with the new restrictions and for planning the transition to custom domains.
-
Query Breakdown:
- Data Source: The query uses the
EmailEventstable, which contains records of email activities. - Filter: It filters the records to include only those emails sent from domains ending with "onmicrosoft.com".
- Date Formatting: It formats the timestamp of each email event to a "yyyy-MM-dd" format for daily aggregation.
- Aggregation: It summarizes the data by counting the number of distinct external recipient domains each day for each "onmicrosoft.com" sender domain.
- Ordering: The results are ordered by the total number of distinct external domains contacted.
- Data Source: The query uses the
-
Recommendation: If an organization is approaching the limit of 100 external domains per day, it is recommended to start purchasing and configuring custom domains to avoid potential disruptions in email delivery.
Overall, this query is a tool for organizations to monitor their email usage patterns and ensure they are prepared for the upcoming changes in email sending restrictions.
