Managing external identities to enable secure access for partners, customers, and other non-employees
The behavior described matches a tenant-level restriction on guest invitations. The error text aligns with cases where B2B invitations are blocked by external collaboration or cross-tenant settings.
Based on the available information, the following checks and actions are required in the tenant that is sending the invitations:
- Verify guest invite policy is not set to “no one can invite”
- In the target tenant, confirm that Guest invite settings are not configured with the most restrictive option: “No one in the organization can invite guest users including admins (most restrictive)”. When this setting is used, guest invitations are blocked and errors such as “Guest invitations not allowed for your company” or similar invitation-block messages occur.
- If this setting is currently the most restrictive, change it to a less restrictive option so that admins (and, if desired, users) can invite guest users. For guidance, see the external collaboration settings documentation referenced below.
- Check external collaboration allow/block list for the guest domain
- In External collaboration settings, under Collaboration restrictions, verify that
fiap.com.bris not on a deny (block) list. - If an allowlist is configured, ensure
fiap.com.bris explicitly included. If the domain is not allowed, invitations to that domain will fail.
- In External collaboration settings, under Collaboration restrictions, verify that
- Review cross-tenant access settings
- If cross-tenant access policies are configured, confirm that they do not block B2B collaboration with the external organization. Misconfigured cross-tenant access settings can cause errors such as: “This invitation is blocked by cross-tenant access settings.”
- Adjust the cross-tenant access settings so that B2B collaboration is allowed with the external tenant, as appropriate for the organization.
- Check Microsoft cloud / cross-cloud settings (if applicable)
- If the external users are in a different Microsoft cloud (for example, Azure Government vs. global), ensure Microsoft cloud settings are configured to allow B2B collaboration across clouds. If cross-cloud collaboration is not enabled where required, invitations can be blocked.
- If the tenant is in Azure US Government (not indicated here, but relevant generally)
- B2B collaboration is only enabled between tenants that are both in Azure US Government and support B2B collaboration. If inviting a user from a tenant that does not support B2B in that cloud, an error is returned. In that case, configure Microsoft cloud settings to collaborate with organizations outside that cloud.
- If invitations were recently disabled or roles changed
- If external collaboration settings or guest inviter roles were recently modified, allow 15–60 minutes for changes to propagate before testing invitations again.
- If the issue persists after configuration checks
- If all external collaboration, allow/block list, and cross-tenant access settings are correctly configured and the problem persists, open a support case with Microsoft from the tenant to request investigation of a possible anti-spam or security block on outbound B2B invitations for that tenant.
These steps ensure that tenant-side configuration is not blocking invitations and provide the escalation path if a platform-level block is suspected.
References: