GOV-11: Disable Self-Service Sign-Up

Overview

Self-service sign-up lets external users add themselves to your tenant, typically by verifying an email address, without any administrator involvement. When it is enabled, external identities can appear in your directory on their own, creating ungoverned accounts that no one reviewed or approved. The same mechanism allows email-verified users to claim email-based subscriptions tied to your domain.

Every external identity should enter through a controlled, reviewable path such as a guest invitation or an entitlement management access package. Disabling self-service sign-up closes the door on identities that bypass that review, so you always know who was invited and by whom.

This control assesses the authorization policy settings that govern self-service joining. The expected state is:

• External users cannot join the organization via self-service sign-up.
• authorizationPolicy.allowEmailVerifiedUsersToJoinOrganization is false.
• authorizationPolicy.allowedToSignUpEmailBasedSubscriptions is false.

Control ID: GOV-11 Category: Governance & Hygiene Baseline Level: Level 1 (Recommended Secure) Severity: Low License Required: None. Microsoft Entra ID (any tier).

This is a detect-only, advisory control. TrueConfig reads the authorization policy and reports whether these settings are false. It does not change them for you. The fix is a one-time change in the Entra admin center or a single Graph update. Disable self-service sign-up unless it is explicitly required for a self-service application scenario.

Prerequisites

Required Roles

• Global Administrator - Required to change the authorization policy and self-service sign-up settings

Required Licenses

• Microsoft Entra ID, any tier

Pre-Configuration Requirements

1. Confirm no self-service sign-up user flow is in active use. Some organizations deliberately use self-service sign-up for external-facing applications (Azure AD B2B self-service). If so, scope the exception to that application rather than disabling it blindly.
2. Ensure a controlled invitation path exists (guest invitations or entitlement management) so legitimate external collaboration is not blocked.

Time Estimate

Step-by-Step Instructions

Step 1: Check the Current Settings

Via Microsoft Graph PowerShell

Connect-MgGraph -Scopes "Policy.Read.All"

Get-MgPolicyAuthorizationPolicy |
    Select-Object AllowEmailVerifiedUsersToJoinOrganization, AllowedToSignUpEmailBasedSubscriptions

If either value returns True, self-service sign-up is possible and this control is flagged.

Via the Entra admin center

1. Navigate to the Microsoft Entra admin center (https://entra.microsoft.com).
2. Go to Identity > Users > User settings to review self-service and external user settings.
3. Check External Identities > External collaboration settings for any self-service sign-up user flows attached to applications.

Step 2: Disable Self-Service Sign-Up

Via Microsoft Graph PowerShell

Connect-MgGraph -Scopes "Policy.ReadWrite.Authorization"

Update-MgPolicyAuthorizationPolicy `
    -AllowEmailVerifiedUsersToJoinOrganization:$false `
    -AllowedToSignUpEmailBasedSubscriptions:$false

These two properties sit directly on the authorization policy (not under defaultUserRolePermissions), which is why they are set at the top level.

Via the Entra admin center

1. In Identity > Users > User settings, disable options that allow email-verified users to join the organization.
2. If a self-service sign-up user flow exists under External Identities and is not required, remove it or unlink it from the application.

Step 3: Confirm the Approved Path Still Works

Disabling self-service sign-up should not block legitimate collaboration. Confirm that:

• Administrators and Guest Inviters can still invite external users (see EXT-01).
• Any entitlement management access packages for external users continue to function (see GOV-06).

Step 4: Verify the Change

Re-run the Graph check from Step 1 and confirm both properties now return False.

Verification Checklist

• Current values of allowEmailVerifiedUsersToJoinOrganization and allowedToSignUpEmailBasedSubscriptions have been reviewed.
• Any active self-service sign-up user flows have been identified.
• Both authorization policy properties are set to false (unless a scoped exception is documented).
• A controlled invitation path (guest invitation or access package) remains available.
• External collaboration via invitation has been confirmed working.
• TrueConfig reports GOV-11 as compliant.

Troubleshooting

Issue: External users are still self-registering

Cause: A self-service sign-up user flow is attached to an application and operates independently of the tenant-wide setting.

Solution:

1. Go to External Identities > User flows and review any self-service sign-up flows.
2. Remove the flow or unlink it from the application if self-service sign-up is not intended.

Issue: Disabling sign-up blocked a legitimate external application scenario

Cause: The application genuinely relies on self-service sign-up for external customers.

Solution:

1. Re-enable self-service sign-up scoped to that application's user flow only, rather than tenant-wide email-verified joining.
2. Document the exception so TrueConfig findings can be interpreted correctly.

Issue: The setting does not appear where expected in the portal

Cause: These properties are primarily managed through the authorization policy and the portal layout for them has shifted over time.

Solution:

1. Use the Graph method, which reads and writes the authoritative authorization policy directly.
2. Confirm you are signed in as a Global Administrator.

Cost Considerations

There is no licensing cost. These are built-in authorization policy settings available on every Microsoft Entra ID tier.

• Minimal operational impact. Most organizations do not use self-service sign-up. Disabling it removes an unmonitored entry path without affecting invited collaboration.
• Avoided cost. Self-service external identities accumulate without review and can outlive any legitimate need. Requiring a controlled invitation path prevents ungoverned accounts from entering the directory.
• Detect-only in TrueConfig. TrueConfig monitors both settings continuously and re-flags them if they drift back to enabled.

Related Controls

• EXT-01: Restrict Guest Invitation Permissions (control who can invite external users)
• EXT-09: Guest User Lifecycle Review (retire stale external identities)
• GOV-06: Entitlement Management (govern how external users receive access)

Related Resources

• Self-service sign-up in Microsoft Entra External ID
• authorizationPolicy resource type
• Configure external collaboration settings