Restrict tenant creation to administrators

Description

The user setting Restrict non-admin users from creating tenants is set to Yes (defaultUserRolePermissions.allowedToCreateTenants = false). Only users with the Tenant Creator role or an administrative role can create new tenants.

Rationale

A user who creates a tenant becomes its Global Administrator, outside the organization's security policies, logging and offboarding. Such shadow tenants are used to store data, to register lookalike domains or to host applications trusted by mistake.

Impact

Developers or teams who need test tenants request them through a process and receive the Tenant Creator role.

Setting

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader.
2. Browse to Entra ID > Users > User settings and read Restrict non-admin users from creating tenants.
3. Read-only PowerShell alternative (Microsoft Graph, scope Policy.Read.All): (Get-MgPolicyAuthorizationPolicy).DefaultUserRolePermissions.AllowedToCreateTenants.
4. Fail if the setting is No (value true).

Remediation

1. Sign in to the Microsoft Entra admin center as at least a Privileged Role Administrator.
2. Browse to Entra ID > Users > User settings.
3. Set Restrict non-admin users from creating tenants to Yes and select Save.
4. Equivalent with Microsoft Graph PowerShell (scope Policy.ReadWrite.Authorization): Update-MgPolicyAuthorizationPolicy -DefaultUserRolePermissions @{ AllowedToCreateTenants = $false }.

Rollback

Set the option back to No.

References

• What are the default user permissions in Microsoft Entra ID? Microsoft, vendor-doc, accessed 2026-10-24
• authorizationPolicy resource type Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Related controls

• related CB-M365-TENANT-009 Disable self-service sign-up to the tenant
• related CB-M365-APPS-001 Restrict application registration to administrators
• related CB-M365-APPS-020 Restrict creation of agent identity blueprints to administrators

People and lifecycle