Back to App

GOV-09: Restrict Tenant Creation

Overview

By default, a standard user in Microsoft Entra ID can create new tenants. A tenant created this way is a separate identity boundary that your security team does not govern or monitor. It becomes shadow IT at the identity layer: an environment where controls, logging, and oversight simply do not reach.

Ungoverned tenants complicate incident response and create places where data and applications can live outside policy. Restricting tenant creation to administrators ensures new identity boundaries are only created deliberately, by people who are accountable for them.

This control assesses a single tenant setting. The expected state is:

  • Non-admin users cannot create new tenants.
  • Tenant creation is restricted to administrators.
  • authorizationPolicy.defaultUserRolePermissions.allowedToCreateTenants is false.

Control ID: GOV-09 Category: Governance & Hygiene Baseline Level: Level 1 (Recommended Secure) Severity: Medium License Required: None. Microsoft Entra ID (any tier).

This is a detect-only, advisory control. TrueConfig reads the authorization policy and reports whether allowedToCreateTenants is false. It does not change the setting for you. The fix is a one-time toggle in the Entra admin center or a single Graph update. This control aligns with CIS Microsoft Entra ID Foundations Benchmark 5.1.2.3.

Prerequisites

Required Roles

  • Global Administrator - Required to change tenant-wide user settings and the authorization policy

Required Licenses

  • Microsoft Entra ID, any tier

Pre-Configuration Requirements

  1. Confirm no legitimate workflow depends on self-service tenant creation. This is rare, but developers occasionally spin up test tenants. Provide an approved alternative if needed.

Time Estimate

TaskDuration
Review the current setting10 minutes
Change the setting5 minutes
Communicate the approved path for test tenants15 minutes

Step-by-Step Instructions

Step 1: Check the Current Setting

Via the Entra admin center

  1. Navigate to the Microsoft Entra admin center (https://entra.microsoft.com).
  2. Go to Identity > Users > User settings.
  3. Locate Restrict non-admin users from creating tenants and note its current value.

Via Microsoft Graph PowerShell

Connect-MgGraph -Scopes "Policy.Read.All"
(Get-MgPolicyAuthorizationPolicy).DefaultUserRolePermissions | Select-Object AllowedToCreateTenants

If AllowedToCreateTenants returns True, any user can create tenants and this control is flagged.

Step 2: Restrict Tenant Creation

Via the Entra admin center

  1. In Identity > Users > User settings, set Restrict non-admin users from creating tenants to Yes.
  2. Click Save.

Via Microsoft Graph PowerShell

Connect-MgGraph -Scopes "Policy.ReadWrite.Authorization"

Update-MgPolicyAuthorizationPolicy -DefaultUserRolePermissions @{
    AllowedToCreateTenants = $false
}

Step 3: Provide an Approved Path for Legitimate Needs

If teams occasionally need test or sandbox tenants:

  • Route requests through IT so a new tenant is created deliberately and inventoried.
  • The Tenant Creator role can be granted to specific trusted users when self-service must be re-enabled for a narrow group, keeping the default blocked for everyone else.

Step 4: Confirm the Change

Re-run the Graph check from Step 1 and verify AllowedToCreateTenants now returns False.

Verification Checklist

  • The current value of allowedToCreateTenants has been reviewed.
  • Restrict non-admin users from creating tenants is set to Yes (or allowedToCreateTenants is false).
  • An approved path exists for any legitimate test-tenant need.
  • TrueConfig reports GOV-09 as compliant.

Troubleshooting

Issue: A user can still create a tenant after the change

Cause: They hold the Tenant Creator role or a directory role that permits tenant creation.

Solution:

  1. Review role assignments for that user.
  2. Remove the Tenant Creator role if the access is not intended. Global Administrators can create tenants by design.

Issue: The setting does not appear in the portal

Cause: The portal layout has moved, or you lack the required role.

Solution:

  1. Confirm you are signed in as a Global Administrator.
  2. Use the Graph method, which reads and writes the authoritative authorization policy regardless of portal layout.

Issue: A team reports they can no longer create sandbox tenants

Cause: They relied on self-service tenant creation.

Solution:

  1. Route the request through IT, or grant the Tenant Creator role to a small, named group.
  2. Keep the default restricted rather than re-enabling tenant-wide self-service.

Cost Considerations

There is no licensing cost. This control uses a built-in tenant setting available on every Microsoft Entra ID tier.

  • Minimal operational impact. Self-service tenant creation is rarely needed. Restricting it affects almost no legitimate workflows.
  • Avoided cost. Every ungoverned tenant is a blind spot for monitoring, compliance, and incident response. Preventing their casual creation removes a source of shadow IT before it starts.
  • Detect-only in TrueConfig. TrueConfig monitors the setting continuously and re-flags it if it drifts back to open, so the one-time fix stays enforced.

Related Controls

  • APP-12: Restrict User App Registration (a related authorization-policy hardening)
  • GOV-10: Restrict Security Group Creation (limit self-service directory-object creation)
  • GOV-11: Disable Self-Service Sign-Up (control how external identities enter the tenant)

Related Resources