Remote Server returned ‘550 5.7.520 Access denied, Your organization does not allow external forwarding. Please contact your administrator for further assistance. AS(7555)’

When trying to use external forwarding on a Shared Mailbox:

user@domain.tld
Remote Server returned ‘550 5.7.520 Access denied, Your organization does not allow external forwarding. Please contact your administrator for further assistance. AS(7555)’

Go to: https://protection.office.com/antispam

Create policy -> Outbound -> user@domain.tld -> Forwarding is enabled.

The command you tried to run isn’t currently allowed in your organization. To run this command, you first need to run the command: Enable-OrganizationCustomization

When trying to add an anti-spam policy in O365 Security Portal the following message occurs:

All the customers where we already added anti-spam policies without this message used Azure AD Connect, I think this activates the OrganizationCustomization option.

On Windows 10, open elevated Powershell:

Install-Module -Name ExchangeOnlineManagement

Import-Module ExchangeOnlineManagement

Connect-ExchangeOnline -UserPrincipalName user@domain.tld

Enable-OrganizationCustomization

Just one extra step there for those who do not use PowerShell, after InstallModule, run this: Set-ExecutionPolicy RemoteSigned

Gareth