Invitations are blocked for this directory due to suspicious activity – new Workforce tenant, bulk B2B migration blocked after only 10 invitations

Question

Invitations are blocked for this directory due to suspicious activity – new Workforce tenant, bulk B2B migration blocked after only 10 invitations

Mark Benz 0

We are a German B2B Managed Service provider currently performing a planned tenant migration. We recently set up a new Workforce tenant for authenticating our customer platform and need to migrate approximately 2,500 existing B2B guest users via New-MgInvitation (Microsoft Graph PowerShell).

After successfully creating only about 10 invitations, we started receiving the following error:

New-MgInvitation : Invitations are blocked for this directory due to suspicious activity.
Status: 403 (Forbidden)
ErrorCode: Forbidden
DataCenter: Germany West Central

This is a legitimate, controlled migration process – not abusive traffic. The script is idempotent and uses standard Microsoft Graph API calls.

We have a production release scheduled for tomorrow (13 March 2026) that depends on this migration being completed. We are also unable to open a support ticket directly from this tenant.

Could a Microsoft engineer please assist in reviewing and unblocking our tenant? We are happy to provide tenant details, request IDs, and any additional information via private message.

Thank you for any help.

Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-03-12T09:55:44.3266667+00:00

Hello Mark Benz,

We need few details to proceed further. Please check your Private messages tab and provide those details.
Drew Miller 0 Reputation points

2026-07-13T20:00:15.52+00:00

We have the same problem

1 answer

Your answer

Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-03-12T09:55:44.3266667+00:00

Hello Mark Benz,

We need few details to proceed further. Please check your Private messages tab and provide those details.
Drew Miller 0 Reputation points

2026-07-13T20:00:15.52+00:00

We have the same problem

Answer 1

The error indicates that invitations from the tenant are being blocked at the service level, similar in effect to other tenant-level blocks (for example, tenants blocked due to inactivity or suspicious patterns). This cannot be removed through PowerShell or portal configuration alone and requires Microsoft support intervention.

Given the constraints in the context, the following actions are supported:

Verify that the scenario is standard B2B invitation usage
- New-MgInvitation is the correct cmdlet for creating B2B invitations via Microsoft Graph PowerShell.
- Ensure the script is using the documented permissions (for example, User.Invite.All, User.ReadWrite.All, or Directory.ReadWrite.All) as required by New-MgInvitation.
Confirm B2B and external collaboration configuration
- Check that external collaboration is allowed and not restricted in a way that would cause invitation failures, especially if the error appears in other contexts such as SharePoint/OneDrive sharing. Misconfigured B2B collaboration settings can cause invitation blocks and related errors.
- Review:
  - External collaboration settings
  - Microsoft cloud settings (cross-cloud settings)
  - Cross-tenant access settings
- These are the documented levers for “guest invitations not allowed” and “invitation is blocked by cross-tenant access settings” errors, and should be aligned with the migration scenario.
Use supported bulk-invitation patterns
- For large-scale B2B migrations, use the documented bulk invitation approach:
  - Prepare a CSV with guest user data.
  - Use Microsoft Graph PowerShell (or the documented bulk-invite scripts) to send invitations.
- Ensure the latest Microsoft Graph PowerShell module is installed and used for the migration.
Escalate via Microsoft support when tenant-level blocks occur
- When a tenant is blocked at the service level (for example, tenants blocked due to inactivity or suspicious activity), the documented path is to contact Microsoft support to request reactivation or unblocking.
- If the affected tenant cannot open a support ticket directly (for example, due to subscription or access limitations), a common documented workaround is:
  - Create a separate tenant (for example, via a trial subscription) where support requests can be opened.
  - From that tenant, open a support ticket and clearly state that the issue concerns a different tenant that is blocked and cannot open tickets.
  - Provide tenant identifiers and error details in the support request so Microsoft can investigate and unblock the original tenant.
Avoid repeated retries while blocked
- Once the service has flagged the tenant and is returning a 403 “invitations are blocked” response, repeatedly retrying the same operation is unlikely to clear the block and may prolong automated detection flags.
- Focus efforts on support escalation and configuration validation instead of high-frequency retries.

Because the block is at the directory/service level and is not controlled by any documented B2B configuration setting or PowerShell parameter, resolution requires review and action by Microsoft support using internal tools. The documented pattern for similar tenant-level blocks is to contact support (directly or via a secondary tenant) and request reactivation/unblocking, providing tenant details and error information.

References: