GOV-09: Restrict Tenant Creation

GOV-09 is a security control that if any user can create tenants, they can spin up identity boundaries outside your governance and monitoring. this shadow it creates ungoverned environments that bypass security controls and complicate incident response. It requires that non-admin users cannot create new tenants and tenant creation is restricted to administrators, authorizationpolicy.defaultuserrolepermissions.allowedtocreatetenants is false.

If any user can create tenants, they can spin up identity boundaries outside your governance and monitoring. This shadow IT creates ungoverned environments that bypass security controls and complicate incident response.

GOV-09 requires manual implementation. Detect-only. Fix in Entra admin center > User settings > Restrict non-admin users from creating tenants = Yes.

This control can be implemented with any Microsoft 365 subscription, including free Azure AD.

GOV-09 is included in the TrueConfig Recommended Secure baseline (Level 1). This is the foundation level suitable for most organizations.