(L1) Ensure 'Restrict non-admin users from creating tenants' is set to 'Yes'

Contributed by Benjamin Metz with -MynsterAll contributors →

Part of CIS · Entra ID · User and directory settings · All checks

Run this check

Invoke-Maester -TestId CIS.M365.5.1.2.3

Overview

5.1.2.3 (L1) Ensure ‘Restrict non-admin users from creating tenants’ is set to ‘Yes’

Non-privileged users can create tenants in the Microsoft Entra ID and Microsoft Entra administration portal under “Manage tenant”. The creation of a tenant is recorded in the Audit log as category “DirectoryManagement” and activity “Create Company”. By default, the user who creates a Microsoft Entra tenant is automatically assigned the Global Administrator role. The newly created tenant doesn’t inherit any settings or configurations.

Rationale

Restricting tenant creation prevents unauthorized or uncontrolled deployment of resources and ensures that the organization retains control over its infrastructure. User generation of shadow IT could lead to multiple, disjointed environments that can make it difficult for IT to manage and secure the organization’s data, especially if other users in the organization began using these tenants for business purposes under the misunderstanding that they were secured by the organization’s security team.

Impact

Non-admin users will need to contact I.T. if they have a valid reason to create a tenant.

Remediation action

1. Navigate to Microsoft 365 Entra admin center.
2. Click to expand Entra ID > Users > User settings.
3. Set Restrict non-admin users from creating tenants to Yes then Save.

PowerShell

1. Connect to Microsoft Graph using Connect-MgGraph -Scopes "Policy.ReadWrite.Authorization"
2. Run the following commands:

# Create hashtable and update the auth policy
$params = @{ AllowedToCreateTenants = $false }
Update-MgPolicyAuthorizationPolicy -DefaultUserRolePermissions $params

Related links

• Microsoft 365 Entra admin center
• Restrict member users’ default permissions
• CIS Microsoft 365 Foundations Benchmark v7.0.0 - Page 200

Details

Every attribute of this check

Field	Value
Test ID	CIS.M365.5.1.2.3
Severity	Medium
Suite	CIS
Product	Entra ID
Feature	User and directory settings
Area	Access control
Resource type	Tenant
User impact	Low
Implementation cost	Low
MITRE ATT&CK	None
Supports benchmark	CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.1.2.3
Benchmark level	L1
Benchmark profiles	E3 Level 1, E5 Level 1
Supports controls	cis-m365:5.1.2.3, nist-800-53-r5:AC-6(10), nist-800-53-r5:CM-5
PowerShell test	Test-MtCisCreateTenantDisallowed
Services	Graph

Source

• Test: tests/cis/Test.CIS.M365.5.1.2.3.ps1
• Documentation: tests/cis/Test.CIS.M365.5.1.2.3.md