The availability of the delete API (removeallaccessforuser API) does not stop a malicious user from resending a Microsoft Teams message to the same victim. To help prevent that, a block user feature will allow the admin to block the malicious user from reaching out again. To make this possible, we will use a similar feature as the allow/block list in federation identity credentials to block the malicious user from the entire organization.