If your on-premises Exchange servers route outbound email to Microsoft 365 through an Inbound Connector of type OnPremises, you may suddenly observe email messages piling up in local queues with status Retry, or users receiving Non-Delivery Reports (NDRs) bearing the error:
450 4.7.230 Connecting Exchange server version is out-of-date; connection to Exchange Online delayed for <N> mins/hr
or550 5.7.230 Connecting Exchange server version is out-of-date; connection to Exchange Online blocked for <N> mins/hr
This behavior is driven by Microsoft's Exchange Online Transport Enforcement System. Designed to protect cloud tenants from vulnerabilities present in unpatched on-premises servers, this system progressively throttles and eventually blocks inbound SMTP traffic coming from Exchange servers running unsupported cumulative updates (CUs) or missing security updates (SUs).
In this runbook, we break down how the enforcement timeline works, how to audit your connecting servers using PowerShell, how to request an emergency 90-day pause, and the steps required to resolve the block permanently.
The 90-Day Progressive Enforcement Lifecycle
Microsoft does not block mail flow overnight. Once an on-premises Exchange server (Exchange 2016, 2019, or Exchange Server SE) falls below Microsoft’s minimum baseline version, a strict 90-day progressive enforcement clock begins:
- Zero mail flow disruption
- Flagged in EAC Mail Flow reports
- Identified via
Get-OnPremServerReportInfo
- Returns
450 4.7.230(Temporary failure) - Throttled 5 mins/hr → scaling to 30 mins/hr
- On-prem queue status: Retry
- Returns
550 5.7.230(Permanent bounce) - Blocked 10 mins/hr → scaling to 100% block
- Senders receive immediate NDRs
How Exchange Online Identifies Your Server Version
When an on-premises Exchange server opens an SMTP session to Exchange Online, it advertises its build identity during the SMTP handshake (or via the authenticated hybrid certificate andX-Originating-IP data). Exchange Online compares this build number against the official list of supported CUs and SUs.
Step 1: Audit Non-Compliant Servers in Exchange Online
Before mail flow is impacted, inspect whether Microsoft has flagged any of your hybrid servers.
Method A: Via Exchange Online PowerShell (Fastest)
Connect to Exchange Online and query the non-compliant server telemetry:
Connect-ExchangeOnline -UserPrincipalName [email protected]
# Retrieve flagged on-premises servers
Get-OnPremServerReportInfo | Format-Table ServerGuid, ServerName, DetectedVersion, CurrentEnforcementStage, ThrottledMinutesPerHour -AutoSize
If your on-premises servers are fully patched and compliant, this command returns 0 items (clean bill of health).
Method B: Via the Exchange Admin Center (EAC)
- Sign in to the Exchange Admin Center (
admin.exchange.microsoft.com). - Navigate to Reports > Mail flow reports.
- Click on the report titled: Out-of-date connecting on-premises Exchange servers.
- Review the table listing flagged Server IP addresses, server names, detected builds, and their current enforcement stage.
Step 2: Emergency Workaround: Pause Enforcement for 90 Days
If your servers have reached Stage 2 (450 4.7.230) or Stage 3 (550 5.7.230) and mail flow is actively failing, you can issue an emergency enforcement pause.
Important Limit: Microsoft allows each tenant a cumulative total of up to 90 days of exemption per calendar year. You can pause enforcement for 1 to 90 days. Use this window to schedule maintenance and install the required updates.
Requesting the Pause via PowerShell:
# Pause the unpatched server enforcement for 90 days
New-TenantExemptionInfo -BlockingScenario UnpatchedOnPremServer -NumberOfDays 90
# Verify the active exemption and expiration date
Get-TenantExemptionInfo -BlockingScenario UnpatchedOnPremServer | Format-List
Requesting the Pause via the EAC:
- In the Out-of-date connecting on-premises Exchange servers report, click the Pause Enforcement button in the upper right.
- Enter the number of days you need (up to 90 days) and confirm.
- Within 15 to 30 minutes, Exchange Online will lift the
450and550error codes, and queued emails will deliver normally.
Step 3: Permanent Resolution: Patching On-Premises Servers
The only way to permanently exit the Transport Enforcement System is to update your on-premises infrastructure:
- Identify Missing Updates with Health Checker:
Download and run the official Microsoft Exchange Health Checker on every on-premises Mailbox and Edge Transport server:
.\HealthChecker.ps1
- Supported Minimum Baselines:
* Exchange Server SE: Must be on the latest Subscription Edition build (e.g., SU12 / Build 15.02.2562.057).
* Exchange Server 2019: Must be on CU14 or CU15 with the latest Security Update applied.
* Exchange Server 2016: Must be on CU23 with the latest Security Update applied.
* Note: Exchange 2016 and 2019 reached end-of-support in October 2025. Organizations still operating them should plan an immediate upgrade to Exchange Server SE.
- Check Edge Transport Servers:
Many organizations patch their internal Mailbox DAG servers but forget about perimeter Edge Transport servers in the DMZ. If your outbound hybrid mail routes through Edge servers, those Edge servers must also be patched to the latest build, or Exchange Online will throttle the connection.
Step 4: Verify Mail Flow Restoration
After applying updates to your servers:
- Allow up to 24 hours for Exchange Online's background telemetry to register the new server version build string.
- Force a queue retry on your on-premises servers to flush any backlogged mail:
Get-Queue -Filter "Status -eq 'Retry'" | Retry-Queue
- Inspect the transport send connector protocol logs (
C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\FrontEnd\ProtocolLog\SmtpSend) to confirm SMTP responses return clean250 2.0.0 OKreceipts rather than450 4.7.230.