Default Authorization Settings - Default User Role Permissions - Allowed to create Tenants

Contributed by Thomas NaunheimAll contributors →

Part of Entra ID SCA · Entra ID · User and directory settings · All checks

Run this check

Invoke-Maester -TestId EIDSCA.AP12

Overview

Restricts the creation of Entra ID (Azure AD) tenants to the global administrator or tenant creator roles. Anyone who creates a tenant will become the global administrator for that tenant.

Restrict tenant creation by non-admin users. Users assigned the Tenant Creator role can still create tenants when this setting is false.

Test script

https://graph.microsoft.com/beta/policies/authorizationPolicy
.defaultUserRolePermissions.allowedToCreateTenants -eq 'false'

Remediation action

Microsoft Graph PowerShell: Update-MgPolicyAuthorizationPolicy -BodyParameter @{DefaultUserRolePermissions = @{AllowedToCreateTenants = $false}}

Related links

• Open in Graph Explorer
• authorizationPolicy resource type - Microsoft Graph beta | Microsoft Learn
• View in Microsoft Entra admin center

MITRE ATT&CK

mindmap
  root{{MITRE ATT&CK}}
    (Tactic)
      TA0010 - Exfiltration - Exfiltration
      TA0040 - Impact - Impact
    (Mitigation)

    (Technique)

Tactic	Technique	Mitigation
TA0010 - Exfiltration - Exfiltration TA0040 - Impact - Impact

Details

Every attribute of this check

Field	Value
Test ID	EIDSCA.AP12
Severity	Medium
Suite	Entra ID SCA
Product	Entra ID
Feature	User and directory settings
Area	Access control
Resource type	Tenant
User impact	Low
Implementation cost	Low
MITRE ATT&CK	None
Supports controls	nist-800-53-r5:AC-6, nist-800-53-r5:CM-7
PowerShell test	Test-MtCheckEidscaAP12
Services	Graph

Source

• Test: tests/eidsca/Test.EIDSCA.AP12.ps1
• Documentation: tests/eidsca/Test.EIDSCA.AP12.md