Small businesses, beware the Office 365 fine print

If you sign your small business up with Office 365, make sure you read the fine print carefully. An obscure clause in the terms of service limits the number of recipients you're allowed to contact in a day. As one reader discovered, the effect can be very bad for business.
Written by Ed Bott, Senior Contributing Editor

Update: Microsoft's documentation says this limitation applies per recipient, but the statement I received from the company compounds the confusion by noting that limitations are for "any one user or organization." I've edited the post to note the confusion.

I've been working with a small business lately, helping them with a long-overdue migration of their email from POP/SMTP servers to a cloud-based system.

They had no interest in going Google. They use Microsoft Outlook extensively, so it was easy to narrow the choice down to hosted Microsoft Exchange. The question then became who should they choose as a provider. I sat down to do a quick comparison of my two preferred vendors: Microsoft Office 365 and Intermedia's Office in the Cloud.

(I've written about my reasons for choosing Intermedia before. See Gmail or Exchange? Six questions to help you make the right choice and Why I'm letting someone else run my Exchange 2010 server.)

At $6 per user per month, the Office 365 P1 plan had a clear cost advantage, and this cash-conscious company was just about ready to make their decision. Until, that is, I heard from a reader who told me an eye-opening story.

He's a consultant who recently helped a client switch from an in-house Exchange server to a small business Office 365 account. Everything went swimmingly for two months, and then one evening he got a phone call from the CEO of the client company, complaining that she and her employees could no longer send messages. Everything bounced back, with a generic "Message could not be sent—try again later" error.

My reader did some research and discovered, to his chagrin, that the client had inadvertently bumped into a little-known Office 365 limit. As he explained to me:

Small business accounts are limited to 500 recipients per 24 hours and enterprise accounts are limited to 1500. Office 365 technical support was unable to tell me when the limitation is reset... They also said it is very difficult to upgrade from a small business to enterprise Office 365 account. I would need to create a whole new account and migrate the domain and users, so that is not an option.

That's not a limitation of 500 recipients on one message. That's a limitation of 500 recipients during a single day. And the limitation doesn't apply to unique recipients. either. As my reader noted:

If I send a message to you and Cc: Mary Jo Foley, that would take up two of my allotted recipients. If I later in the day sent another message to just you, it would take up another recipient, even though I'd already sent a message to you. Unfortunately, 500 recipients when viewed in this fashion really isn't that many.

It's not hard to imagine scenarios in which a small business can bump up against that number. In this case, the new CEO had sent a getting-acquainted message to 400 of the company's customers and prospects. But it could easily happen to any small business. Imagine if your little company rolls out a new product that gets a mention on the Today Show or a high-profile web site like ZDNet. You could easily have 500 messages in your inbox when you get to work in the morning. If you try to respond to every one, even with a form response, you'll hit that 500-recipient lockout before your first coffee break.

At a minimum, that's an inconvenience. If your small business suddenly has its best day ever and your primary customer information or support mailbox is flooded with 500 or more requests in a short period of time, you will be unable to use that account as it was intended. In a shop with just two or three mailboxes, that's a major disruption in service.

And the P1 plan is, according to Microsoft, "designed for up to 25 employees." If you have the maximum number of mailboxes and each employees sends out 20 messages a day to outside recipients, you've just hit the limit.

Microsoft's online documentation confirms this limitation, if you know where to look. In Office 365 help, under Recipient And Sender Limits, this is what you'll find:

Recipient rate limit The maximum number of recipients that can receive e-mail messages sent from a single cloud-based mailbox in a 24 hour period.

  • Microsoft Live@edu 500 recipients per day
  • Office 365 for professionals and small businesses 500 recipients per day
  • Office 365 for enterprises 1,500 recipients per day

I contacted Microsoft to find out if there's any workaround. Michael Atalla, Director of product management for Exchange Server and Exchange Online, confirmed the limitation for me, arguing that it's a necessary anti-spam measure:

Every online service provider must limit and constrain its service based on limitations such as the amount of disk space currently in its datacenters or bandwidth currently available and also enforce behavioral thresholds which prevent inappropriate use of the service by malicious users or criminals.  This is true for any form of web-based service.

In the world of email, one of the thresholds that must be enforced is the amount of email that is sent through the system by any one user or organization in order to combat spam, mass-mailing worms & viruses.  To ensure that all users experience the level of performance, email delivery expediency and client connectivity behavior that they expect, we must determine what usage typifies behavior of a spammer, for example, and put controls in place to prevent such inappropriate use.  We ask customers with legitimate needs for a service that exceeds these thresholds or must go beyond these limitations to contact support so that we can best meet their specific needs.

He also provided a link to the same help page my reader had already found.

The suggestion to contact support sounds good, but it didn't work in this situation. As my reader explained:

The worst thing about this is that there is no way for support to override it. The user is left to sit without being able to send e-mail for 24 hours with absolutely no recourse. I understand that it is an automated feature put in place to prevent spam, but once the user has spoken to support and it has been verified as a legitimate use, there should be some way to override the limit.

Out of curiosity, I asked Intermedia whether they impose the same limitation. The answer from a company spokesperson was an emphatic no:

To reduce potential spam we set a limit to the number of recipients in one email to 500. But, there is no limit to the number of 500-person emails a person can send. For example, a person can send an email to 500 people and then right after that send another email to 500 people.

This problem is a tough one for e-mail providers and for their customers. Providers have a duty to keep their networks from being exploited by spammers, but customers shouldn't be penalized for suddenly becoming successful.

Neither should consultants who recommend and deploy a service. As my reader notes, sadly, he lost the client over this incident.

Microsoft really needs to take a long look at this policy and reconsider how it's implemented.

Editorial standards