When was my Microsoft 365 tenant created?

The question of “when was my organization’s tenant created” popped up recently, so I thought I’d address it in a short blog post. After all, it’s an interesting bit of information to have, and as it turns out it’s now actually displayed on the landing page of the Teams Admin Center. This in fact is the easy answer here, if you are only interested in the value and not the means to obtain it, you can easily do so from the TAC, assuming you have access to it.

OK, but what if you don’t have admin privileges? Or if you want to obtain this information programmatically? The answer is again simple – use the Graph API and specifically, the /organization endpoint. The below screenshot illustrates the information you can obtain from said endpoint, which includes the createdDateTime property:

GET https://graph.microsoft.com/beta/organization

 

So this particular tenant (one of my DEV tenants) has been created back in April 2013. Do note that the value of the createdDateTime property will only be shown if you have the necessary permissions, such as Organization.Read.All or Directory.Read.All. Calling this endpoint without the required permissions will still return some data, however most of the fields, including createdDateTime, will show null values. The screenshot below illustrates how this looks like – same query, same tenant, different user with insufficient permissions – null value for the createdDateTime property.

In effect, for a regular user account with no additional permissions within the Office 365 tenant, there is no way to obtain this information. What about PowerShell, one might ask? Well, while most organizations do not block PowerShell access, and regular users can still connect and use cmdlets such as Get-MsolCompanyInformation, said property is not actually exposed therein. The Azure AD module won’t help you either, and the Microsoft Graph SDK has the same permission requirements as the direct Graph API calls above.

What you can do however is look at user’s properties, via the Get-MsolUser cmdlet or similar. Therein, look for the value of the WhenCreated property, and choose the oldest one. Or, if you happen to know what the initial admin user is, you can check his properties directly. I won’t teach you how to do any of these things, as they can be used for harvesting directory data, but suffice to say it’s doable, and can give you a rough approximation of the tenant’s creation date. Still, it’s not the same thing as user accounts come and go.

Alternatively, you can look into the properties of some other objects within the directory. For example, the output of Get-OrganizationConfig. Or the properties of the default accepted domain, via Get-AcceptedDomain, the default OU, and a whole array of other Exchange-specific containers. This will only work if the tenant has been enabled for Exchange Online, obviously, and the value will only be relevant if the Exchange workload was provisioned from the get go.

Get-AcceptedDomain | sort WhenCreatedUTC | select WhenCreatedUTC -First 1

Get-OrganizationalUnit | sort WhenCreatedUTC | select WhenCreatedUTC -First 1

Get-OrganizationConfig | select WhenCreated

WhenCreated
-----------
18/04/2013 09:03:15

You get the idea. Similar tricks might be applied to other workloads, however you need to keep in mind that not all of them expose properties such as WhenCreated, and even if they do, the workloads themselves might be quite “younger” compared to the age of your tenant. Remember that back when Office 365 launched in 2011, only a handful of the services we’re using today were available!

This entry was posted in Azure AD, Graph API, Microsoft 365, Office 365. Bookmark the permalink.

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.