Invitations are blocked for this directory due to suspicious activity. Please contact Microsoft support for help.

Dmytro Zlobodukhov 0 Reputation points
2026-11-04T17:22:51.9733333+00:00

Hello, Microsoft Support team!

We are having the same situation described in the following threads:

Our applications use EntraID for SSO and some internal features. Currently we have 5 environments with a separate EntraID tenant per environment.

We are working mostly with DEV tenant, but started using QA and DEMO. We also expect releases to STAGE and PROD within the next month.

We have a small team of ~20 people. Today I had to invite one more user to the QA + DEMO tenants. The Azure portal UI showed me:

User invitation failed. Insufficient privileges to complete the operation.

Then I tried to invite this use via Graph API and got the following response:

Forbidden({"error":{"code":"Forbidden","message":"Invitations are blocked for this directory due to suspicious activity. Please contact Microsoft support for help.","innerError":{...}}})

In QA and DEMO I tried inviting the user first in Azure Portal, then via Bulk Invitations, then tried Graph API.

Then I tried to invite all team members via Bulk Invitation into STAGE + PROD tenants. Both tenants processed only 11 users out of 18 in CSV.

The only reason why I used Bulked Invitations is for simplicity (inviting users one by one is very time consuming).

But apparently STAGE + PROD tenants have been locked as well (I tried to invite user via Graph API on STAGE and got the same Forbidden error).

I can't create a support request in Azure or EntraID portals because the only two options available are Billing and Subscription Management (we currently don't have any Azure Subscriptions or Support Plans available).

I still can create internal users, but we have to use SSO users, so we are blocked now.

Can someone please unlock all tenants so we could continue working and releases preparation?

p.s. I will happily share request IDs or tenant IDs in private for further investigation (Q&A keeps deleting my posts).

Thank you!

Microsoft 365 and Office | Subscription, account, billing | For business | Other
0 comments No comments

1 answer

Sort by: Oldest
  1. JeseminQH 1,210 Reputation points Independent Advisor
    2026-11-06T03:33:37.42+00:00

    Hi @Dmytro Zlobodukhov

    The error “Invitations are blocked for this directory due to suspicious activity” indicates that Microsoft has placed a service-side restriction on guest invitations in the affected Microsoft Entra tenants. Since the same error occurs when using the Azure portal, bulk invitations, and Microsoft Graph, this restriction cannot be resolved by changing administrator permissions or invitation settings. 

    Since you cannot create a technical support request through the Azure or Microsoft Entra admin portals, please try submitting a support ticket through the Microsoft 365 admin center instead, if your organization has an eligible Microsoft 365 business subscription. 

    For more details, please refer to: Get support - Microsoft 365 admin

    User's image

    A Global Administrator can follow these steps: 

    • Sign in to the Microsoft 365 admin center. 
    • Select Help & support. 
    • If Support Assistant is enabled, turn it off.
    • User images
    • Enter the complete error message. 
    • Scroll down and select Contact support, then choose Phone or Email to submit your request.

    In the support request, explain that: 

    • Manual invitations fail in the Azure portal. 
    • Bulk invitations are only partially processed. 
    • Microsoft Graph returns a 403 Forbidden response. 
    • Multiple tenants are affected, including QA, DEMO, STAGE, and PROD. 
    • The restriction is blocking release preparation and SSO testing. 

    You should also provide the affected tenant IDs, Microsoft Graph request IDs, timestamps, and the complete error response. Share this information only through the private support request and do not post tenant IDs, user email addresses, CSV files, access tokens, or diagnostic identifiers publicly in the forum. 

    When submitting the ticket, you can request that all affected tenants be reviewed under the same case. However, since each directory may have been restricted separately, the support team may need to review each tenant individually. 

    If you’re unsure who the Global Admin is within your organization, you can find guidance on locating them here: How do I find my Microsoft 365 admin?

    Note: If you’re an end-user, please coordinate with your Office 365 Global Administrator to handle these steps. 

    If your Microsoft 365 subscription was purchased through a reseller or Cloud Solution Provider, please contact that partner and ask them to open or escalate a Microsoft support request on your behalf. 

    As a fellow forum user, I can only provide basic troubleshooting guidance and do not have access to internal systems to review or remove the restriction. I apologize that I cannot help further and hope the support team can resolve the issue as soon as possible.

    Was this answer helpful?

    0 comments No comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.