Entra External ID tenant: all invitations blocked "due to suspicious activity" – request for unblock

This tenant-wide invitation block cannot be cleared through Entra roles, collaboration settings, or Graph permissions; Microsoft Support must review and remove it from the backend.^1^

Escalate the existing support request

Because technical support requests cannot be created from an External ID external tenant, Microsoft documents these supported routes:

1. Switch to the associated Microsoft Entra workforce tenant.
2. Open Microsoft Entra admin center → Diagnose and solve problems → New support request.
3. If the organization already has an Azure support plan, create the request through that workforce tenant. Otherwise, use Microsoft Support for business.
4. Reference the Microsoft 365 request already submitted and ask that it be routed to the Microsoft Entra External ID team for backend review of a tenant-wide suspicious-activity invitation block.^2^

External tenants also expose Give Feedback on the New support request page, but that is not a substitute for the technical support case. The documented technical route is through a workforce tenant.^2^

Include:

• External tenant ID
• UTC start time: 20 October 2026, 14:20
• Exact Graph operation and response: POST /v1.0/invitations, HTTP 403
• Full error text
• Portal symptom seen by the Global Administrator
• Confirmation that all domains and all new invitations are affected
• Confirmation that existing users can still sign in
• Tenant creation date
• Approximate invitation count and timing
• Power Pages business scenario and expected remaining volume
• Correlation/request IDs and timestamps from failed Graph calls, if available
• Business impact and request to review and remove the directory-level invitation protection block

Matching cases with the same Graph 403 and portal “Insufficient privileges” symptom were resolved only after Microsoft’s backend team unblocked the tenant.^3^

A suitable ticket summary is:

Microsoft Entra External ID tenant-wide invitation block — backend review required
All Microsoft Graph POST /v1.0/invitations requests fail with HTTP 403 and “Invitations are blocked for this directory due to suspicious activity.” The Entra portal reports “Insufficient privileges” even for a Global Administrator. Existing users can sign in; only creation of new invited users is blocked. Please review and remove the directory-level invitation protection block. The invitations are for known customer contacts accessing a Power Pages portal.

Do not post the tenant ID, administrator address, tokens, or correlation data publicly. Supply them only through the private support case or a verified private-message request from Microsoft Q&A staff.

Invitation rate after unblocking

Microsoft publishes daily B2B invitation ceilings, but not a separate guaranteed “safe pace” that avoids suspicious-activity detection:

• Paid workforce or external tenant, age 30 days or less: 200 invitations/day.
• Unpaid workforce or external tenant, age 30 days or less: 10 invitations/day.
• Unpaid tenant older than 30 days: 100 invitations/day.
• Paid tenant older than 30 days: governed by Microsoft Entra service quotas.^4^

Verify whether the external tenant has paid licenses before resuming. If it is unpaid, its age places it in the documented 10 invitations/day category. The reported 25 invitations across two days could exceed that ceiling depending on their daily distribution, but the available documentation does not establish that this caused the suspicious-activity block.

After unblocking:

• Stay below the applicable daily limit.
• Distribute invitations rather than issuing the entire backlog at once.
• Stop and update the support case if the same 403 reappears.
• For a planned one-time migration or higher-volume onboarding, ask Support to plan mitigations; Microsoft specifically recommends case-by-case support planning for workloads that may encounter stricter security limits.^5^

The Graph invitation-manager limit of 150 requests per five seconds is ordinary API throttling guidance.^6^ It does not explain a persistent directory-wide 403 suspicious-activity block; ordinary throttling is handled as 429 Too Many Requests, not by changing administrator permissions.

References

1. Unable to send B2B guest invitations from Microsoft Entra - Microsoft Q&A
2. Find help and get support for Microsoft Entra
3. Invitations are blocked for this directory due to suspicious activity - Microsoft Q&A
4. Microsoft Entra service limits and restrictions
5. Microsoft Entra External ID deployment guide for tenant design
6. Microsoft Graph service-specific throttling limits