Entra ID Free - External user invitations blocked due to suspicious activity

Hello Aleksandar Hristovski,

Greetings! Thanks for raising this question in the Q&A forum.

This error is not a configuration problem on your side. It is a tenant-level anti-abuse control that Microsoft Entra applies automatically when its backend systems detect an unusual pattern of B2B invitations, for example a burst of invitations sent in a short time through a script. Once this flag is set, it blocks all new guest invitations at the directory level, whether they are sent through the Azure portal, the Microsoft Entra admin center, or the Microsoft Graph /invitations API. It is not tied to RBAC, Guest Inviter role, external collaboration settings, or cross tenant access settings, so reviewing or changing those settings will not lift it.

1. Understand what triggered it Sending roughly 10 invitations through a CLI/script in quick succession is a common trigger for this control, especially on newer or smaller tenants, since Entra's anomaly detection looks at invitation velocity and patterns rather than just absolute numbers.
2. Do not keep retrying Repeated invitation attempts while the block is active can extend the time it takes for the flag to be reviewed, since it adds more "suspicious" signal rather than resolving it. Pause invitation attempts until the block is cleared.
3. Confirm there is no local configuration issue first While this is almost certainly the anti-abuse block based on the exact error text, it is worth a quick check to rule out anything else:

      Microsoft Entra admin center > External Identities > External collaboration settings
   

   Confirm guest invitations are enabled and that no domain allow/block list is unintentionally excluding the domains you are inviting.
4. This cannot be self-resolved, it requires Microsoft to clear it This specific block (the exact text "Invitations are blocked for this directory due to suspicious activity") is enforced by Microsoft's backend Data Protection/Identity Protection systems. There is no admin-facing toggle in Entra ID to remove it. It must be reviewed and cleared by Microsoft support.
5. Open a support request even on a Free tenant Entra ID Free does not include a paid Azure support plan, but you do not need one to report this. You can still open a request through either of these channels:

      Microsoft 365 admin center (https://admin.microsoft.com) > Support > New service request
   

   Select Microsoft Entra ID (Azure Active Directory) as the affected service and describe the exact error text. If you do not have a Microsoft 365 admin center request option available because the tenant only has Entra ID Free with no other Microsoft 365 service, you can also raise it from:

      Azure portal > Help + support > Create a support request
   

   Basic support for service-impacting and account/billing issues is included at no cost even without a paid Azure support plan, and tenant security blocks like this fall under that category.
6. Provide these details in the request to speed up review
   • Tenant ID
   • The exact error text quoted above
   • Approximate date/time the script ran and the number of invitations sent
   • A short business justification for the invitations
   Microsoft support typically needs to forward this internally to the Data Protection team handling the flag, so providing this upfront avoids back and forth.
7. Set expectations on timing Based on similar reports, this is reviewed and lifted manually rather than on a fixed timer, so 3 days without resolution is not unusual. Tickets are commonly resolved within several days to about a week once submitted with full details, but there is no published SLA for Free tenants.

If this answer helps you kindly accept the answer which will help others who have similar questions.

Best Regards,

Jerald Felix.