What “service abuse mode” actually means
If you’re seeing this error when sending through a Microsoft 365 account:
AADSTS70000: User account is found to be in service abuse mode
…it means Microsoft has restricted the mailbox due to behavior that resembles abuse. This is a provider-level block enforced by Microsoft’s anti-abuse systems. It is not a Truss integration issue.
When an account enters “service abuse mode,” Microsoft essentially places the mailbox in a restricted state until an admin verifies and resolves the root cause.
How to fix a service abuse mode restriction
1. Contact your firm's Microsoft 365 admin. They are the only ones who can initiate the unblock.
2. The admin must open a case with Microsoft Support. Only Microsoft can remove the service abuse mode restriction.
3. Once Microsoft lifts the block, the user goes to Truss and re-connects their account.
The Truss integration will start working again.
Why this happens
Microsoft flags accounts when they see patterns like:
Bulk sending
High spam complaint rates
Abnormal sending patterns that resemble compromised or abusive behavior
On some Office 365 tenants, even minor spikes can trigger protective blocks depending on the tenant’s configuration.
You don’t need to be an email admin to resolve this
The workflow is straightforward once you know what’s happening:
Account is restricted by Microsoft
Admin contacts Microsoft Support
Block is lifted
User re-authenticates
If issues persist after recovery, check sender reputation, content quality (avoid spammy subject lines or email content).