Entra ID B2B guest invitations blocked — "Invitations are blocked for this directory due to suspicious activity"

Gitte Dreyer 30 Reputation points
2026-03-18T09:04:51.1266667+00:00

We were developing and testing a script to automate the onboarding of external users via the Graph API. During development, we repeatedly invited and deleted the same user multiple times in quick succession to verify the script's behavior. We believe this pattern of rapid invite-delete cycles triggered the suspicious activity detection and caused the tenant-wide block on invitations.

Error: {"error":{"code":"Forbidden","message":"Invitations are blocked for this directory due to suspicious activity. Please contact Microsoft support for help."

Microsoft Security | Microsoft Entra | Microsoft Entra ID

Answer accepted by question author

AI answer

2026-03-18T09:05:07.6233333+00:00

The error indicates that Microsoft Entra has placed a security-based block on B2B invitations for the directory. This is treated as suspicious activity protection and cannot be cleared through configuration alone; it requires Microsoft support intervention.

Based on the available information, the only supported remediation path is:

  1. Have a Global Administrator for the affected tenant open a support case with Microsoft.
  2. In the support request, include:
    • The exact error message and code from the Graph API response.
    • A description of the recent activity pattern (repeated invite/delete cycles for test users).
    • Confirmation that the activity was intentional and part of testing/automation.
  3. Work with Microsoft support to review and remove the block on invitations for the directory.

While waiting for the block to be cleared, verify that normal B2B configuration is correct so that invitations work once unblocked:

  • Review External collaboration settings in Microsoft Entra to ensure:
    • Guest invitations are allowed.
    • The correct roles are permitted to invite guests.
    • Any domain allow/block lists are configured as intended.
  • Review cross-tenant access settings and Microsoft cloud settings if collaborating with other Entra tenants or across Azure clouds, to ensure they are not independently blocking invitations.

If the tenant itself ever becomes inaccessible or blocked more broadly (for example, due to inactivity), a tenant administrator must also contact Microsoft support to request reactivation within the allowed window.


References:

AI-generated content may be incorrect. Read our transparency notes for more information.

Was this answer helpful?

0 additional answers

Sort by: Newest

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.