550 5.4.1 Recipient address rejected: Access denied – Meaning and Fix

Microsoft 365 checks every incoming address against the recipient company's directory before it accepts the message. If the address is not there, the message is refused at the door with this text. Microsoft calls the feature Directory Based Edge Blocking.

Why it happens

The address has a typo in the part before the @.
The person left the company and the mailbox was deleted.
The address was guessed or scraped (for example firstname.lastname@) and never existed.
On the recipient side: the mailbox lives on the company's own mail server and was never synced to Microsoft 365, so Microsoft does not know it.

What to do

Compare the address with where you got it from, letter by letter.
If it is spelled as given, the mailbox is gone. Remove it from your list; do not retry.
If you know the person, ask for their current address another way.
If you run the recipient domain: add the missing mailbox to Microsoft 365, or fix directory sync. Only you can do this; senders cannot.

Don't confuse it with

550 5.4.1 Relay Access Denied has the same number but is about the whole domain: the mail server that answered does not accept mail for that domain at all. And 550 5.1.10 means the same as this page (no such recipient) but is raised one step later.

Questions

Is 550 5.4.1 a hard bounce?

Yes. The address does not exist at that company, so sending again gives the same result.

The address is correct and worked last month. Why now?

The mailbox was most likely removed or renamed. When someone leaves, companies usually delete the mailbox after a few weeks.

Got a different bounce?

Paste the whole message into the bounce code lookup. It reads the code and the words and tells you whose move it is.

Related codes

550 5.1.10 Recipient not found (Microsoft 365)
550 5.1.1 The email account that you tried to reach does not exist (Gmail)

550 5.4.1: Recipient address rejected: Access denied

Fix your list Address does not exist