Check ID: entra_policy_ensure_default_user_cannot_create_tenants
Provider: Microsoft 365
Service: entra
Severity: MEDIUM
Categories: identity-access, e3
Resource type: NotDefined

​
What this check verifies

Microsoft Entra authorization policy defines default user permissions, including whether non-admin users are allowed_to_create_tenants. This evaluates if tenant creation is disabled for default users via default_user_role_permissions.

​
Risk

Allowing default users to create tenants spawns unmanaged shadow tenants. Creators become Global Administrator, enabling escalation from compromised accounts and sidestepping governance. This degrades confidentiality and integrity, widens the attack surface, and introduces hidden costs.

​
Recommendation

Enforce least privilege: set allowed_to_create_tenants=false so only authorized staff-or those with the Tenant Creator role-may create tenants. Use separation of duties and PIM for just-in-time access, and routinely review audit events (e.g., Create Company) to deter and detect misuse.

​
Remediation

Update-MgPolicyAuthorizationPolicy -AuthorizationPolicyId authorizationPolicy -DefaultUserRolePermissions @{ AllowedToCreateTenants = $false }

​
References

​
Where this check fires

This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable by Check ID = entra_policy_ensure_default_user_cannot_create_tenants. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Microsoft 365 checks