EIDSCA.AP12 - Default Authorization Settings - Default User Role Permissions - Allowed to create Tenants.
Overview
Restricts the creation of Entra ID (Azure AD) tenants to the global administrator or tenant creator roles. Anyone who creates a tenant will become the global administrator for that tenant.
Restrict tenant creation by non-admin users. Users assigned the Tenant Creator role can still create tenants when this setting is false.
Test script
https://graph.microsoft.com/beta/policies/authorizationPolicy
.defaultUserRolePermissions.allowedToCreateTenants -eq 'false'
Remediation action
Microsoft Graph PowerShell: Update-MgPolicyAuthorizationPolicy -BodyParameter @{DefaultUserRolePermissions = @{AllowedToCreateTenants = $false}}
Related links
- Open in Graph Explorer
- authorizationPolicy resource type - Microsoft Graph beta | Microsoft Learn
- View in Microsoft Entra admin center
MITRE ATT&CK
| Tactic | Technique | Mitigation |
|---|---|---|
| TA0010 - Exfiltration - Exfiltration TA0040 - Impact - Impact |
Test Metadata
| Field | Value |
|---|---|
| Test ID | EIDSCA.AP12 |
| Severity | Medium |
| Suite | Entra ID SCA |
| Product | Entra ID |
| Feature | User and directory settings |
| Area | Access control |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | None |
| Supports controls | nist-800-53-r5:AC-6, nist-800-53-r5:CM-7 |
| PowerShell test | Test-MtCheckEidscaAP12 |
| Services | Graph |
Source
- Test:
tests/eidsca/Test.EIDSCA.AP12.ps1 - Documentation:
tests/eidsca/Test.EIDSCA.AP12.md