Managing external identities to enable secure access for partners, customers, and other non-employees
Your tenant is receiving the error "Invitations are blocked for this directory due to suspicious activity" when using the Microsoft Graph API (/v1.0/invitations) to invite external users. This typically occurs when Microsoft detects unusual invitation patterns from the tenant, such as a high volume of invitations in a short time or invitations to suspicious domains.
Troubleshooting Steps
- Contact Microsoft Support — This block is applied by Microsoft's automated security systems. Open a support request through the Azure portal > Help + Support > New support request to have the block reviewed and lifted.
- Review your B2B collaboration settings — Go to Azure Portal > Microsoft Entra ID > External Identities > External collaboration settings and verify your invitation restrictions are configured correctly (allowed/blocked domains).
- Check for compromised credentials — Review sign-in logs (Microsoft Entra ID > Monitoring > Sign-in logs) for any suspicious activity that may have triggered the block.
- Throttle invitations — Once unblocked, implement rate limiting in your application to avoid triggering the protection again. Avoid bulk-inviting large numbers of external users in a short timeframe.
- Use batch invitations cautiously — If you need to invite many users, space out the invitations and ensure recipients are from legitimate, known domains.