New-SafeLinksPolicy "Enable-OrganizationCustomization" error is a propagation red-herring

On a freshly org-customized M365 tenant, New-SafeLinksPolicy (and other threat-policy New-* cmdlets) fail with "The command you tried to run isnt currently allowed... you first need to run Enable-OrganizationCustomization" EVEN WHEN Get-OrganizationConfig shows IsDehydrated=False and Enable-OrganizationCustomization returns "already enabled for customization." It is not RBAC and not a real customization gap — it is the Defender / Security-&-Compliance policy backend still propagating after hydration (Microsoft documents up to ~4h). Diagnose by comparing Get-OrganizationConfig WhenChangedUTC to now; if customization was enabled minutes/hours ago, just retry on an interval. Two more gotchas: (1) Safe Links / Safe Attachments cmdlets live on the compliance endpoint - Connect-IPPSSession reuses the MSAL token cache from a prior Connect-ExchangeOnline -Device login, so no second prompt; Connect-IPPSSession does NOT accept -Device. (2) The actual fix for auth/magic-link emails stuck in ATP "[Scan in progress] waiting for detonation result" is a custom Safe Links policy with -DeliverMessageAfterScan $false (keeps click-time protection, stops holding mail); the built-in protection policy cannot be edited and defaults DeliverMessageAfterScan=True.