B2B guest invitations blocked tenant-wide: "Invitations are blocked for this directory due to suspicious activity" — how to get the block reviewed without a support plan?

Since 2026-08-05, every B2B guest invitation in our tenant fails.

POST https://graph.microsoft.com/v1.0/invitations returns:

403 Forbidden

"Invitations are blocked for this directory due to suspicious activity.

Please contact Microsoft support for help."

request-id: fbd7bcf9-5dfd-4895-b6bc-5075b389d8cb (2026-08-05 13:09 GMT)

request-id: 816e11b9-49ba-4d53-92be-bb6bc8fa2af5 (2026-08-06 07:24 GMT)

What we have already ruled out:

• Not credential-specific: reproduced with both an app-only token (application permission

  User.Invite.All, admin-consented) AND a delegated Global Administrator token, same 403.

• Not a policy we control: external collaboration settings have allowInvitesFrom = everyone.
• Not an authorization failure: a malformed email address returns 400 "Invalid Email Address",

  so the request passes authorization and fails at the invitation stage.

• Not invitee-specific: inviting an address that is already a guest in the directory returns

  the same 403 — the block is directory-wide.

• Directory audit logs show no "Invite external user" entries, so we cannot date the onset

  from our side. A manual invitation succeeded during the week of 2026-07-27.

Context that may have triggered the detection: on 2026-08-05 we admin-consented a new app

registration with User.Invite.All for our internal user-provisioning service and its first

automated invitation went to a placeholder address (******@test.com) during testing. Small

tenant, legitimate business use, one test invitation — we are happy to provide any

verification Microsoft needs.

Impact: no new user can be onboarded to our production application by any route (Entra

portal, Graph API, delegated or app-only). Existing users are unaffected.

The error says to contact Microsoft support, but this tenant has no Azure subscription and

therefore no support plan; the Azure portal and Entra admin center support flows both stop

at "Get support on Microsoft Q&A" (no Technical issue type / greyed-out Next). The same

dead end applies from our organization's other tenant.

This appears to be the same issue as

https://learn.microsoft.com/en-us/answers/questions/5909797/b2b-guest-invitations-blocked-tenant-wide-due-to-s

where the accepted advice was to open a support request. We have tried every route

suggested there:

• Azure portal support request (from our organization's subscription): the flow stops at

  step 3 "Additional details" — it shows only a "Prioritized support on Microsoft Q&A"

  panel and the Next button stays disabled (no support plan on the subscription).

• Entra admin center support request signed into the affected tenant: the Issue type

  dropdown offers only Billing and Subscription management — no Technical option (the

  tenant has no subscription).

• Entra admin center from our organization's workforce tenant: Technical exists as an

  issue type, but step 3 hits the same disabled-Next / Q&A-only panel.

So "open a support request" is not actionable for us — which is why we are posting here.

Question: how do we get this block reviewed and lifted? Requesting escalation to a support

engineer who can open a case for the affected tenant.