B2B guest invitations blocked tenant-wide — "Invitations are blocked for this directory due to suspicious activity" — request review and removal of block

Kumar k 5 Reputation points
2026-07-26T05:47:48.2666667+00:00

**
Hello,

I am the Global Administrator of the tenant below. All B2B guest invitations in our tenant are failing tenant-wide, and Microsoft Graph returns an explicit fraud-hold error asking us to contact support. I am requesting an investigation and removal of this invitation block.

Tenant details

  • Tenant domain: rpavault9.onmicrosoft.com
  • Tenant ID: 705299f7-804d-40a1-938c-55dbdc1a894a
  • Reporter: tenant Global Administrator

Exact error from Microsoft Graph (POST https://graph.microsoft.com/v1.0/invitations)

{

"error": {

"code": "Forbidden",

"message": "Invitations are blocked for this directory due to suspicious activity. Please contact Microsoft support for help.",

"innerError": {

"request-id": "5580c1b6-a5b5-4c31-aade-519cefc0a59c",

"date": "2026-07-26T14:16:06",

"client-request-id": "f4a029e6-8422-f554-9f95-d38043907fca"

}

}

}

How the issue appears in other surfaces

When inviting via the Entra admin center or sharing from SharePoint/OneDrive, the same underlying block surfaces as a misleading error:

Error from Entra B2B: At least one invitation failed. Error: ReadResponseFailure, message: Cannot access a disposed object. Object name: 'System.Net.HttpWebResponse'.

What I have already verified (all correct)

  • External collaboration settings: guest invites are allowed; no domain allow/deny list blocking the invited addresses
  • Cross-tenant access settings: default inbound B2B collaboration is allowed
  • No stale/conflicting guest object for the invited email (checked All users and Deleted users)
  • My account holds the Global Administrator role
  • Reproduced with Security Defaults temporarily disabled — same error, so no tenant policy on our side is causing this
  • Reproduced via three independent paths: Entra portal "Invite external user", SharePoint/OneDrive sharing, and the raw Graph API (error above)

Context / legitimate use

We are a small business (an IT training and services company) inviting a small number of known external collaborators to work on SharePoint documents. These are legitimate, low-volume business invitations. The repeated invitation attempts in our logs today were troubleshooting retries of this same failure, not bulk sending.

Request

Please review the automated fraud/abuse hold on B2B invitations for this tenant and remove it. The request-id and client-request-id above should let the team locate the block server-side. I'm happy to provide any further verification of the tenant or my identity through a private/official channel.

Impact: External collaborators are completely blocked from accessing shared resources; this is blocking active business work.

Thank you.

Extra More info
Environment**

Product: Microsoft Entra ID — External Identities (B2B collaboration)

Tenant: RPAVAULT (rpavault9.onmicrosoft.com)

Portal: Microsoft Entra admin center → External Identities → External collaboration settings

What I’m trying to do Invite an external user as a B2B guest to my tenant.

What happens The guest invitation fails. The portal returns a ReadResponseFailure error, followed by a “Cannot access a disposed object” message. The invite does not complete and the guest user is not created.

Current configuration (External collaboration settings)

Guest invite restrictions: [state which option is selected — e.g. “Anyone in the organization can invite” vs “Only specific admin roles”]

Guest user access restrictions: [which option is selected]

Collaboration restrictions: [Allow any domain / Deny specific domains / Allow only specific domains]

Cross-tenant access settings: [any inbound/outbound restrictions configured?]

Steps to reproduce

  1. Go to External Identities → External collaboration settings (or Users → New guest user).
  2. Enter the external email address and send the invitation.
  3. Error appears: ReadResponseFailure → “Cannot access a disposed object”.

What I’ve already tried

  • [e.g. different browser, cleared cache, tried a different admin account, retried invite]Environment
  • Product: Microsoft Entra ID — External Identities (B2B collaboration)
  • Tenant: RPAVAULT (rpavault9.onmicrosoft.com)
  • Portal: Microsoft Entra admin center → External Identities → External collaboration settings What I’m trying to do Invite an external user as a B2B guest to my tenant. What happens The guest invitation fails. The portal returns a ReadResponseFailure error, followed by a “Cannot access a disposed object” message. The invite does not complete and the guest user is not created. Current configuration (External collaboration settings)
  • Guest invite restrictions: Anyone in the organization can invite
  • Guest user access restrictions: Enabled
  • Collaboration restrictions: Allow any domain Steps to reproduce
  1. Go to External Identities → External collaboration settings (or Users → New guest user).
  2. Enter the external email address and send the invitation.
  3. Error appears: ReadResponseFailure → “Cannot access a disposed object”.

Details to add

  • Exact email domain being invited: gmail
  • Full error text / correlation ID: added in attachment
  • When it started / whether it ever worked: No, this is a new tenant account
  • Browser and whether it reproduces in incognito: same error in incognito What I’ve already tried
    • tried different browsera, cleared cache, tried a different admin account, retried invite
          {
              "error": {
                  "code": "Forbidden",
                  "message": "Invitations are blocked for this directory due to suspicious activity. Please contact Microsoft support for help.",
                  "innerError": {
                      "request-id": "5580c1b6-a5b5-4c31-aade-519cefc0a59c",
                      "date": "2026-07-26T14:16:06",
                      "client-request-id": "f4a029e6-8422-f554-9f95-d38043907fca"
                  }
              }
          }
      
      Screenshot 2026-07-26 at 11.12.14 AM
Microsoft Security | Microsoft Entra | Microsoft Entra External ID
0 comments No comments

1 answer

Sort by: Most helpful
  1. Jerald Felix 18,200 Reputation points Volunteer Moderator
    2026-07-31T02:08:55.07+00:00

    Hello Kumar k,

    Greetings! Thanks for raising this question in the Q&A forum

    You have already done the right diagnostic work, and it confirms this is not a configuration problem on your side. The Forbidden / "Invitations are blocked for this directory due to suspicious activity" response is Microsoft's automated fraud and abuse detection placing a tenant-wide hold on outbound B2B guest invitations at the Entra B2B backend, not something enforced by your External collaboration settings, cross-tenant access settings, or Security Defaults. That is why disabling Security Defaults and reproducing the failure through three separate paths (Entra portal, SharePoint/OneDrive, and raw Graph) all returned the identical error. It also explains the misleading ReadResponseFailure / "Cannot access a disposed object" message you saw in the portal and SharePoint/OneDrive flows: that is the same backend rejection surfacing through a different code path with a less specific error handler, not a separate bug.

    Since your configuration is already confirmed correct, there is nothing further to change in the tenant. The only remediation path is:

    • Open a Microsoft Support request for this specific hold From the Azure portal or the Microsoft Entra admin center, open a new support request with:
    • Category: Microsoft Entra ID
      • Problem type: B2B Collaboration / Guest Invitations
      • Problem subtype: Invitation blocked / suspicious activity

    Attach the identifiers you already have You already have everything the support engineer needs to locate the block server-side, so include it directly in the case description rather than only in this thread:

    1. Tenant ID: 705299f7-804d-40a1-938c-55dbdc1a894a (domain rpavault9.onmicrosoft.com)
    2. Graph request-id: 5580c1b6-a5b5-4c31-aade-519cefc0a59c
    3. Client-request-id: f4a029e6-8422-f554-9f95-d38043907fca
    • Timestamp: 2026-07-26T14:16:06 UTC A brief note on business context, as you posted here, plus the fact that you reproduced this through three independent paths with Security Defaults off, since that preempts the first round of troubleshooting questions support usually asks
    • New tenant is a relevant detail worth including You noted this is a new tenant with no prior invitation history. New tenants sending their first invitations, especially to consumer domains like gmail.com, can trigger this fraud heuristic more readily than established tenants. Mention this explicitly in the case, since it helps the reviewing team distinguish a false positive from genuine abuse patterns faster.
    • Avoid further retries while the case is open Since you've confirmed the failure is consistent and not intermittent, further invitation attempts (via any of the three paths) won't succeed and could add noise to the abuse signal Microsoft's system is evaluating. Hold off until support responds, then retry once you get confirmation the block has been lifted.

    If this answer helps you kindly accept the answer which will help others who have similar questions.

    Best Regards,

    Jerald Felix.

    Was this answer helpful?

    0 comments No comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.