Restrict Tenant Creation
Governance & Hygiene control for Microsoft 365 and Entra ID
Why This Control Matters
If any user can create tenants, they can spin up identity boundaries outside your governance and monitoring. This shadow IT creates ungoverned environments that bypass security controls and complicate incident response.
Expected State
When this control is compliant, your tenant should meet these criteria:
- 1Non-admin users cannot create new tenants
- 2Tenant creation is restricted to administrators
- 3authorizationPolicy.defaultUserRolePermissions.allowedToCreateTenants is false
Enforcement
Alerts on deviations but does not make changes
TrueConfig can apply the authorization-policy fix in one click (Graph PATCH to authorizationPolicy setting allowedToCreateTenants = false). The manual alternative is Entra admin center > User settings > Restrict non-admin users from creating tenants = Yes.
Ready to implement this control?
TrueConfig continuously monitors your Microsoft 365 tenant for compliance with this and 50+ other security controls.