Organisations marked Not yet enabled are permitted by this application but have never completed a sign-in. The application registration is currently single-tenant, so Microsoft will refuse them before reaching us — you would see an AADSTS7000119 page we cannot intercept. To enable one, a Commonwealth administrator sets the registration to multi-tenant and an administrator at that organisation consents. A guest invitation into the Commonwealth directory achieves the same thing with one administrator instead of two.