Disable self-service sign-up to the tenant

Description

Self-service account creation is off:

• allowedToSignUpEmailBasedSubscriptions = false: users cannot sign up for email-based subscriptions (free trials, Power BI, viral sign-ups) that create accounts in the tenant;
• allowEmailVerifiedUsersToJoinOrganization = false: people who verify an email address on one of the tenant's domains cannot join the directory as members;
• Enable guest self-service sign up via user flows is No in the external collaboration settings: external users cannot create guest accounts through a sign-up user flow.

The two directory properties have no portal toggle. Guest sign-up through user flows also needs a user flow enabled on an application; turning the switch off disables all of them.

Rationale

Accounts created outside the joiner process have no owner, no HR link and no offboarding. A former employee or contractor who still receives mail on a company domain could join the tenant. Self-service guest sign-up lets external people create accounts that bypass invitation restrictions.

Impact

Users can no longer start some free trials or self-service sign-ups that create accounts; those go through IT. Self-service purchases and trials are governed separately (CB-M365-TENANT-015).

Audit

1. Connect to Microsoft Graph PowerShell with a Global Reader account (scope Policy.Read.All) and run:

   Get-MgPolicyAuthorizationPolicy |
     Select-Object AllowedToSignUpEmailBasedSubscriptions, AllowEmailVerifiedUsersToJoinOrganization
   

   (or GET https://graph.microsoft.com/v1.0/policies/authorizationPolicy).
2. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com), browse to Entra ID > External Identities > External collaboration settings and read Enable guest self-service sign up via user flows.
3. Fail if either property is true or if guest self-service sign-up is Yes.

Remediation

1. Connect to Microsoft Graph PowerShell as at least a Privileged Role Administrator (scope Policy.ReadWrite.Authorization) and run:

   Update-MgPolicyAuthorizationPolicy -AllowedToSignUpEmailBasedSubscriptions:$false `
     -AllowEmailVerifiedUsersToJoinOrganization:$false
   

2. With an External Identity Provider Administrator or Global Administrator, browse to Entra ID > External Identities > External collaboration settings, set Enable guest self-service sign up via user flows to No and Save.

Rollback

Set the properties back to true and the switch back to Yes.

References

• Self-service sign-up for email-verified users Microsoft, vendor-doc, accessed 2026-10-24
• Configure external collaboration settings Microsoft, vendor-doc, accessed 2026-10-24
• authorizationPolicy resource type Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-TENANT-001 Restrict tenant creation to administrators
• related CB-M365-TENANT-015 Prevent users from adding Store apps and starting trials
• related CB-M365-TENANT-011 Restrict guest invitations to administrators and Guest Inviters
• related CB-M365-APPS-001 Restrict application registration to administrators

People and lifecycle