How to Fix: Disable Self-Service Sign-Up
Step-by-step guide to implement disable self-service sign-up in your Microsoft 365 environment.
Free baseline scan · No credit card · 5 minute setup
15-20 minutes
Estimated Time
4
Steps
low
Severity
Recommended Secure
Baseline Level
Why This Matters
Self-service sign-up lets external users join the tenant on their own, creating ungoverned external identities without admin oversight. Disabling it ensures every external identity enters through a controlled, reviewable path.
Prerequisites
- 1Global Administrator or appropriate admin role in Microsoft Entra ID
- 2Access to Microsoft Entra admin center (entra.microsoft.com)
Expected Configuration
- External users cannot join the organization via self-service sign-up
- authorizationPolicy.allowEmailVerifiedUsersToJoinOrganization is false
- authorizationPolicy.allowedToSignUpEmailBasedSubscriptions is false
Remediation Steps
Review Current Configuration
Assess your current configuration in Microsoft Entra admin center.
- •Navigate to the relevant section in Entra admin center
- •Document current settings
- •Compare against expected state
Plan Implementation
Determine the changes needed to meet the expected configuration.
- •Review expected configuration requirements
- •Identify affected users or resources
- •Plan rollout strategy
Implement Changes
Apply the necessary configuration changes.
- •Make required configuration updates
- •Apply to appropriate scope
- •Document changes made
Validate and Monitor
Verify the changes are working as expected.
- •Run TrueConfig scan to verify compliance
- •Test affected functionality
- •Set up ongoing monitoring
Related Resources
Automate Your Security Configuration
TrueConfig scans your Microsoft 365 environment on a schedule you control and, with safety gates, can fix configuration drift automatically. Start your free trial today.
Start Free Trial