Non-admin users cannot create tenants

Check ID: entra_policy_ensure_default_user_cannot_create_tenants
Provider: Azure
Service: entra
Severity: MEDIUM
Categories: identity-access, e3
Resource type: NotDefined

What this check verifies

Microsoft Entra authorization policy governs whether default users can create new tenants. This evaluates if tenant creation is disabled for non-admin users via allowed_to_create_tenants=false.

Risk

Permitting default users to create tenants fuels shadow IT and identity sprawl. Creators become Global Administrators of unmanaged tenants, eroding confidentiality and integrity through unsanctioned apps and unmonitored data flows, and degrading availability of centralized governance.

Recommendation

Apply least privilege: set allowed_to_create_tenants=false so only vetted admins or the Tenant Creator role (managed with PIM) can create tenants. Enforce separation of duties, require approvals, and monitor audits. Review this setting regularly to prevent tenant sprawl and maintain defense in depth.

Remediation

CLI
Terraform
Dashboard steps

Update-MgPolicyAuthorizationPolicy -AuthorizationPolicyId authorizationPolicy -BodyParameter @{ defaultUserRolePermissions = @{ allowedToCreateTenants = $false } }

resource "azuread_authorization_policy" "<example_resource_name>" {
  default_user_role_permissions {
    allowed_to_create_tenants = false # Critical: disables tenant creation for non-privileged users
  }
}

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = entra_policy_ensure_default_user_cannot_create_tenants. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Azure checks

Non-admin users cannot register applications Guest invitations are restricted to specific admin roles

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires