Disable Self-Service Sign-Up
Governance & Hygiene control for Microsoft 365 and Entra ID
Why This Control Matters
Self-service sign-up lets external users join the tenant on their own, creating ungoverned external identities without admin oversight. Disabling it ensures every external identity enters through a controlled, reviewable path.
Expected State
When this control is compliant, your tenant should meet these criteria:
- 1External users cannot join the organization via self-service sign-up
- 2authorizationPolicy.allowEmailVerifiedUsersToJoinOrganization is false
- 3authorizationPolicy.allowedToSignUpEmailBasedSubscriptions is false
Enforcement
Alerts on deviations but does not make changes
TrueConfig can apply the authorization-policy fix in one click (Graph PATCH to authorizationPolicy disabling self-service sign-up). The manual alternative is disabling self-service sign-up in Entra admin center > User settings unless explicitly required.
Ready to implement this control?
TrueConfig continuously monitors your Microsoft 365 tenant for compliance with this and 50+ other security controls.