Enable-OrganizationCustomization fails with "Organization is currently being upgraded" on a new Microsoft 365 Business tenant — how long does the upgrade take, and is there any way to check its status?

Abdulaziz AL-Haddad 0 Reputation points
2026-09-04T08:57:11.6633333+00:00

Hello,

We have a new Microsoft 365 Business tenant (created a few days ago, custom domain verified, shared mailbox created). We need to enable organization customization so we can create a management scope and a role assignment (RBAC for Applications, "Application Mail.Send") that restricts one Entra application to a single shared mailbox.

Running the following in Exchange Online PowerShell (ExchangeOnlineManagement 3.10.1, signed in as Global Administrator) fails every time, including after several retries over the day:

Enable-OrganizationCustomization

Error:

Enabling customization is not allowed because the Organization is currently being upgraded. Please try again after the Upgrade is complete.

Get-OrganizationConfig still reports IsDehydrated : True. New-ServicePrincipal worked, but New-ManagementScope / New-ManagementRoleAssignment cannot be created until customization is enabled.

Questions:

How long does this "organization upgrade" normally take on a new tenant, and is there any cmdlet or admin-center page that shows its status or completion?

Is there anything on our side that can trigger or speed up the completion, or is a support request from the Microsoft 365 admin center the only option if it does not clear on its own?

While waiting, is there a supported way to scope an application's Mail.Send to one mailbox that does not require organization customization (for example, does New-ApplicationAccessPolicy work on a dehydrated tenant)?

Thanks in advance.

Exchange Online
Exchange Online

A cloud-based service included in Microsoft 365, delivering scalable messaging and collaboration features with simplified management and automatic updates.

0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Ana Le 2,345 Reputation points Independent Advisor
    2026-09-04T09:24:39.9333333+00:00

    Hi,

    Microsoft’s public documentation does not specify a standard completion time for this Exchange Online upgrade state.

    The documented check is: Get-OrganizationConfig | Format-List IsDehydrated

    According to Microsoft:

    • False means Enable-OrganizationCustomization has already been completed.
    • True means it has not been completed.

    This property confirms whether organization customization has been enabled, but the documentation does not describe it as a progress or ETA indicator. It also does not provide another cmdlet or admin-center page for viewing the percentage or estimated completion time of the upgrade.

    References:

    The Enable-OrganizationCustomization documentation does not provide a separate tenant-side method to force or accelerate the process. Since the command has continued to return the same error, I recommend opening a support request through Microsoft 365 admin center > Help & support. Support can review the tenant-specific condition, which cannot be inspected through this user-to-user forum.

    Get support - Microsoft 365 admin | Microsoft Learn

    Regarding New-ApplicationAccessPolicy, Microsoft confirms that Application Access Policies can restrict the Microsoft Graph Mail.Send application permission. However, Microsoft now classifies this feature as legacy and states that new access configurations should use RBAC for Applications instead.

    The Application Access Policy documentation does not confirm whether New-ApplicationAccessPolicy can be created while a tenant remains dehydrated or while this upgrade message is present. Therefore, I cannot confirm it as a supported workaround for this specific condition.

    Once IsDehydrated returns False, you can continue creating the management scope and the Application Mail.Send role assignment.

    If Exchange Application RBAC is intended to be the app’s only source of Mail.Send authorization, also verify that the same organization-wide application permission has not been left granted in Microsoft Entra ID. Microsoft documents that Entra application permissions and Exchange Application RBAC permissions are additive, so an unscoped Entra permission would not be restricted by the Exchange management scope.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.