Microsoft 365 is one of the best places to send cold email from: strong reputation, solid authentication, and a mailbox your prospects’ servers trust. It is also the provider whose throttling most often gets mistaken for a broken account. Here are the limits, what the errors mean, and how to set up sending so one throttle never stops a campaign.
The documented limits
Microsoft publishes limits for Exchange Online (Microsoft 365) mailboxes. The ones that matter for outreach:
| Limit | Microsoft 365 mailbox |
|---|---|
| Recipients per day | About 10,000 |
| Messages per minute | 30 |
| Recipients per message | 500 |
Consumer Outlook.com and Hotmail accounts sit far lower and are not meant for business sending at all. Microsoft also adjusts limits and has announced tighter rules on external recipients over time, so check the current documentation for your tenant.
Why cold email should stay far below them
Those limits exist for normal business mail: replies, internal threads, newsletters people asked for. Cold email is judged by the receiving side, not by Microsoft’s ceiling. A mailbox sending a few hundred cold emails a day collects spam complaints and bounces far faster than it builds trust.
| Mailbox | Healthy cold volume per day |
|---|---|
| New, in warm-up | 5–15, rising gradually |
| Warmed, good reputation | 30–50 |
| More than that | Add mailboxes, not volume |
More on per-mailbox volume in cold email sending limits.
Reading the errors correctly
| What you see | What it means | What to do |
|---|---|---|
| HTTP 429 (Graph), "Too many requests" | Throttling, temporary | Wait the Retry-After time, continue with other mailboxes |
| 4.3.2 / 452 "too many recipients", "try again later" | Temporary rate limit | Rest the mailbox for minutes, then resume |
| Submission quota exceeded | Daily limit reached | Stop that mailbox until tomorrow |
| 401 / 403, SMTP 535 | Authentication refused | Fix the password, app password or reconnect OAuth |
| 550 to a specific recipient | That address is bad | Remove the recipient, the mailbox is fine |
The most expensive mistake is treating the first row as the fourth. If a 429 suspends a mailbox until a human notices, an account with one Outlook mailbox loses its whole outreach channel to a throttle that would have cleared in minutes.
How sending should be set up
- Several mailboxes, each warmed, each at modest volume.
- Rotation with headroom first: the next email goes from a mailbox that still has room today.
- Rest, do not suspend, on throttling: a throttled mailbox sits out for a few minutes and comes back on its own, visibly "resting" rather than "broken".
- Overflow to a sending provider when every mailbox is full, so the campaign slows instead of stopping.
- Suspend only on refused logins, and say why.
That is how Smart Sequences send in Leads Ranger: mailboxes with headroom first, a connected provider such as Brevo for overflow, capped or resting mailboxes as a last resort, and every failure labelled with its real cause.
Before you send anything
Connect Microsoft 365 with OAuth rather than a password where you can, publish SPF, DKIM and DMARC for your sending domain (our free checker shows all three) and warm each new mailbox for two weeks or so before cold volume. The limits will never be your problem if your volume is.