Managing external identities to enable secure access for partners, customers, and other non-employees
The block on sending B2B guest invitations due to “suspicious activity” and the 403/Forbidden errors cannot be removed through configuration in the tenant. This type of restriction must be handled directly by Microsoft support.
Required actions:
- Open a support ticket with Microsoft
- Sign in to the Microsoft 365 or Azure portal with a Global Administrator or other support-eligible admin account.
- Create a new support request describing:
- The exact error messages:
- “Invitations are blocked for this directory due to suspicious activity. Please contact Microsoft support for help. Error: 403 Forbidden ErrorCode: Forbidden”
- “Insufficient privileges to complete the operation” when sending invitations.
- The approximate number of invitations sent and that the tenant is now blocked from sending B2B invitations.
- The exact error messages:
- Ask specifically for the block on B2B guest invitations to be investigated and removed.
- Be prepared for identity and security verification
- Support may route the case to internal security/data protection teams to verify tenant ownership and confirm that the activity was legitimate before removing the block.
- Provide any requested business documentation and context about the bulk invitations.
- After Microsoft removes the block
- Test by inviting a single guest user via the Microsoft Entra admin center (Entra ID → External Identities → All users → New guest user).
- If invitations still fail, have an admin verify:
- External collaboration settings and collaboration restrictions (allow/block lists) under External Identities → External collaboration settings.
- Cross-tenant access settings if inviting users from specific organizations.
Because this is a service-side protection mechanism triggered by suspicious activity, only Microsoft support can clear the block and restore normal B2B invitation capability.
References: