Invitations are blocked for this directory due to suspicious activity. Please contact Microsoft support for help.

Hello, Microsoft Support team!

We are having the same situation described in the following threads:

• Invitations are blocked for this directory due to suspicious activity. Please contact Microsoft support for help
• ERROR Invitations are blocked for this directory due to suspicious activity. Please contact Microsoft support for help

Our applications use EntraID for SSO and some internal features. Currently we have 5 environments with a separate EntraID tenant per environment.

We are working mostly with DEV tenant, but started using QA and DEMO. We also expect releases to STAGE and PROD within the next month.

We have a small team of ~20 people. Today I had to invite one more user to the QA + DEMO tenants. The Azure portal UI showed me:

User invitation failed. Insufficient privileges to complete the operation.

Then I tried to invite this use via Graph API and got the following response:

Forbidden({"error":{"code":"Forbidden","message":"Invitations are blocked for this directory due to suspicious activity. Please contact Microsoft support for help.","innerError":{...}}})

In QA and DEMO I tried inviting the user first in Azure Portal, then via Bulk Invitations, then tried Graph API.

Then I tried to invite all team members via Bulk Invitation into STAGE + PROD tenants. Both tenants processed only 11 users out of 18 in CSV.

The only reason why I used Bulked Invitations is for simplicity (inviting users one by one is very time consuming).

But apparently STAGE + PROD tenants have been locked as well (I tried to invite user via Graph API on STAGE and got the same Forbidden error).

I can't create a support request in Azure or EntraID portals because the only two options available are Billing and Subscription Management (we currently don't have any Azure Subscriptions or Support Plans available).

I still can create internal users, but we have to use SSO users, so we are blocked now.

Can someone please unlock all tenants so we could continue working and releases preparation?

p.s. I will happily share request IDs or tenant IDs in private for further investigation (Q&A keeps deleting my posts).

Thank you!