{
  "id": "CB-M365-TENANT-001",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-TENANT-001",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-TENANT-001.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-TENANT-001.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-TENANT-001",
    "title": "Restrict tenant creation to administrators",
    "finding": {
      "title": "Any user can create a new Microsoft Entra tenant",
      "description": "Users can create tenants outside the organization's governance, where they become Global Administrator and can move data or impersonate the organization."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "low"
    },
    "assessment": "manual",
    "tags": [
      "entra-id",
      "user-settings",
      "tenant-creation",
      "shadow-it"
    ],
    "setting": {
      "location": "Microsoft Entra admin center > Entra ID > Users > User settings > Restrict non-admin users from creating tenants",
      "default_value": "No",
      "recommended_value": "Yes"
    },
    "description": "The user setting **Restrict non-admin users from creating tenants** is set to **Yes**\n(`defaultUserRolePermissions.allowedToCreateTenants` = `false`). Only users with the Tenant\nCreator role or an administrative role can create new tenants.\n",
    "rationale": "A user who creates a tenant becomes its Global Administrator, outside the organization's\nsecurity policies, logging and offboarding. Such shadow tenants are used to store data, to\nregister lookalike domains or to host applications trusted by mistake.\n",
    "impact": "Developers or teams who need test tenants request them through a process and receive the Tenant\nCreator role.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **Entra ID** > **Users** > **User settings** and read **Restrict non-admin users\n   from creating tenants**.\n3. Read-only PowerShell alternative (Microsoft Graph, scope `Policy.Read.All`):\n   `(Get-MgPolicyAuthorizationPolicy).DefaultUserRolePermissions.AllowedToCreateTenants`.\n4. Fail if the setting is **No** (value `true`).\n"
    },
    "remediation": {
      "manual": "1. Sign in to the Microsoft Entra admin center as at least a Privileged Role Administrator.\n2. Browse to **Entra ID** > **Users** > **User settings**.\n3. Set **Restrict non-admin users from creating tenants** to **Yes** and select **Save**.\n4. Equivalent with Microsoft Graph PowerShell (scope `Policy.ReadWrite.Authorization`):\n   `Update-MgPolicyAuthorizationPolicy -DefaultUserRolePermissions @{ AllowedToCreateTenants = $false }`.\n",
      "rollback": "Set the option back to **No**.\n"
    },
    "references": [
      {
        "title": "What are the default user permissions in Microsoft Entra ID?",
        "url": "https://learn.microsoft.com/entra/fundamentals/users-default-permissions",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "authorizationPolicy resource type",
        "url": "https://learn.microsoft.com/graph/api/resources/authorizationpolicy",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-6",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "CM-7",
        "relation": "related"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-TENANT-009",
        "type": "related"
      },
      {
        "id": "CB-M365-APPS-001",
        "type": "related"
      },
      {
        "id": "CB-M365-APPS-020",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}