B2B guest invitations blocked tenant-wide due to "suspicious activity"

Question

B2B guest invitations blocked tenant-wide due to "suspicious activity"

William 0

All outbound B2B guest invitations from our tenant are being rejected with a

tenant-wide block. We are a legitimate organization and need this fraud/abuse

hold reviewed and lifted.

WHAT WE ARE DOING

We run an internal learning application (an Azure Static Web App) for our client. Authorized users at the client sign in as B2B guests in our tenant. We are onboarding a known, finite set of named business contacts at a single client domain

EXACT ERROR

Calling Microsoft Graph:

POST https://graph.microsoft.com/v1.0/invitations

Returns HTTP 403 with message:"Invitations are blocked for this directory due to suspicious activity. Please contact Microsoft support for help."

REQUEST

Please review and lift the suspicious-activity invitation hold on tenant so we can resume inviting authorized client users. We will pace future invitations to avoid tripping abuse heuristics.

IMPACT

12 named client users cannot access the application until invitations are re-enabled.

ShashikumarSharma-0602 5 Reputation points

2026-06-03T04:06:22.0933333+00:00

Share B2B package with external user and add external user email ID to your active directory as guest. They should able to access you application.
Daniel Breglia 0 Reputation points

2026-06-03T04:07:05.81+00:00
This error message — "Invitations are blocked for this directory due to suspicious activity. Please contact Microsoft support for help." — indicates that Microsoft's automated fraud/abuse detection has placed a tenant-wide hold on outbound B2B guest invitations for your directory.

Why does this happen?

Microsoft monitors invitation patterns across Entra tenants for potential abuse (e.g., phishing campaigns, mass spam invitations). If the automated system detects patterns that resemble abuse, it can place a hold even on legitimate tenants. This can be triggered by:

Sending a large volume of invitations in a short period

Inviting users from domains flagged in Microsoft's threat intelligence

Using automation (Graph API) to send invitations at high rates

Immediate steps to take:

Open a Microsoft Support ticket — This hold can only be reviewed and lifted by Microsoft support. Go to the Azure portal and open a support request:

Category: Microsoft Entra ID (Azure Active Directory)

Problem type: B2B Collaboration / Guest Invitations

Include your Tenant ID (d8260f09-1f8d-4b8e-a281-4c10c60e661d) and the exact error message in your ticket.

Provide context in your support ticket — Explain that you are a legitimate organization onboarding a finite, known set of business contacts. Include:

The business purpose for the invitations

The approximate number of invitations sent and the rate

The single client domain being invited

Confirmation that all users are named, known contacts

Rate-limit future invitations — Once the hold is lifted, to avoid triggering the heuristics again, introduce rate limiting in your Graph API calls (e.g., no more than a few invitations per minute, spread over time rather than in bulk).

What you can do while waiting:

If some users urgently need access, consider adding them directly as guest users via the Azure portal (Entra ID > Users > New guest user) rather than via the API, as manual invitations may not be subject to the same automated hold.

Monitor the Microsoft Entra admin center for any notifications or alerts related to the block.

Microsoft support typically responds to these fraud-hold issues within a few business days when a ticket is raised with proper context. Make sure to set the severity to Business Critical if 12 users are actively blocked from your application.
William 0 Reputation points

2026-06-03T04:51:32.99+00:00

This is exactly what's being blocked. Is there any way to reach support without paying exorbitant support plans?
VEMULA SRISAI 13,900 Reputation points Microsoft External Staff Moderator

2026-06-03T04:56:27.39+00:00

Hello William As part of its security enhancements, Microsoft has anomaly detection systems in place to identify unusual activity, such as an unusually high number of invitations being sent from a tenant. If such anomalies are detected, the tenant may be temporarily blocked. For example, tenants that were created within the last 30 days can be blocked if they send 500 or more invitations within a 24-hour period.
Martin Egli 545 Reputation points

2026-06-03T07:31:34.7466667+00:00
The most important point is: if the same error occurs for both Microsoft Graph invitations and a single manual invitation from the Microsoft Entra admin center, this is not likely to be fixed by changing the application or by using a different invitation method. Treat it as a tenant-level anti-abuse hold and prepare a focused Microsoft support request.

Before posting more details publicly, please edit the thread and mask the tenant ID. Provide the tenant ID only in the private support request.

Quick validation before opening the case:

Confirm that External collaboration settings still allow guest invitations for the admin/user doing the test.

Try one manual invite from Microsoft Entra admin center > Users > New user > Invite external user.

Try one Graph invitation only, not a batch, and keep the request ID, timestamp, HTTP status, and error text.

Check whether existing guest objects can still access the application through a direct app link. This does not unblock new invitations, but it helps separate “guest access” from “new invitation creation”.

Stop repeated retries or bulk invitation attempts until Microsoft reviews the hold.

For the support path:

Start in the affected Microsoft Entra tenant if possible. Microsoft documents that Entra support requests can be opened from the Microsoft Entra admin center, and that the requester should sign in as at least Service Support Administrator.

If you use the Azure portal support flow, Microsoft documents that an Entra scenario can be raised without a subscription when the requester is an admin. For Azure technical support generally, the available support method and severity depend on the support plan.

If this is a Microsoft Entra External ID external tenant where the normal support request feature is unavailable, use Microsoft’s documented guidance: use the feedback path on the support request page or switch to a workforce tenant and open the support request from there.

Suggested support request text:

[Use the ticket text above, but include the tenant ID only in the private support request.]

After the hold is removed, keep the onboarding process conservative: small batches, retry with backoff, audit logs for invitation attempts, and a documented allowlist/approval process for expected partner domains. That gives Microsoft Support useful evidence if the same issue happens again.

Relevant documentation:

Find help and get support for Microsoft Entra: https://learn.microsoft.com/en-us/entra/fundamentals/how-to-get-support

Create an Azure support request: https://learn.microsoft.com/en-us/azure/azure-portal/supportability/how-to-create-azure-support-request

B2B collaboration API and customization: https://learn.microsoft.com/en-us/entra/external-id/customize-invitation-api

Add and manage B2B collaboration users: https://learn.microsoft.com/en-us/entra/external-id/add-users-administrator

B2B collaboration invitation redemption: https://learn.microsoft.com/en-us/entra/external-id/redemption-experience

Disclosure: Drafted with help from ChatGPT and reviewed against the Microsoft documentation linked above.

Your answer

ShashikumarSharma-0602 5 Reputation points

2026-06-03T04:06:22.0933333+00:00

Share B2B package with external user and add external user email ID to your active directory as guest. They should able to access you application.
William 0 Reputation points

2026-06-03T04:51:32.99+00:00

This is exactly what's being blocked. Is there any way to reach support without paying exorbitant support plans?
VEMULA SRISAI 13,900 Reputation points Microsoft External Staff Moderator

2026-06-03T04:56:27.39+00:00

Hello William As part of its security enhancements, Microsoft has anomaly detection systems in place to identify unusual activity, such as an unusually high number of invitations being sent from a tenant. If such anomalies are detected, the tenant may be temporarily blocked. For example, tenants that were created within the last 30 days can be blocked if they send 500 or more invitations within a 24-hour period.