# Restrict non-admin users from creating tenants

This test checks if tenant creation is restricted to admin users only.

Source: https://maester.dev/docs/tests/MT.1068

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/marcel-ngn" title="Marcel N. · Original author"><img src="https://github.com/marcel-ngn.png" alt="Marcel N." width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/marcel-ngn">Marcel N.</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/maester">Maester</a> · Entra ID · User and directory settings · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId MT.1068
```

## Overview

This test checks if tenant creation is restricted to admin users only.

"Yes" restricts the creation of Microsoft Entra ID tenants to the Global Administrator or Tenant Creator roles. "No" allows non-admin users to create Microsoft Entra ID tenants. Anyone who creates a tenant will become the Global Administrator for that tenant.

Tenant creation should be restricted to admin users who have undergone proper training and understand the responsibilities of tenant management, security governance, and compliance requirements.

#### Remediation action

This setting can be changed via user settings in the Microsoft Entra or Azure portal or via Microsoft Graph API / Graph PowerShell Module.

Admin Portal:

1. Go to [Entra Admin Center](https://entra.microsoft.com)
2. Navigate to Users → [User settings](https://entra.microsoft.com/#view/Microsoft_AAD_UsersAndTenants/UserManagementMenuBlade/~/UserSettings/menuId/)
3. Set **Restrict non-admin users from creating tenants** to **Yes**
4. Click **Save**

Use the following PowerShell commands to restrict tenant creation:

```powershell
# Connect to Microsoft Graph with appropriate permissions
Connect-MgGraph -Scopes "Policy.ReadWrite.Authorization"

# Get the current authorization policy
$authPolicy = Get-MgPolicyAuthorizationPolicy

# Update the policy to restrict tenant creation
$params = @{
    defaultUserRolePermissions = @{
        allowedToCreateTenants = $false
    }
}

Update-MgPolicyAuthorizationPolicy -AuthorizationPolicyId $authPolicy.Id -BodyParameter $params
```

#### Related links

- [Manage default user permissions in Entra ID](https://learn.microsoft.com/azure/active-directory/fundamentals/users-default-permissions)
- [Authorization policy in Entra ID](https://learn.microsoft.com/graph/api/resources/authorizationpolicy)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | MT.1068 |
| Severity | Medium |
| Suite | Maester |
| Product | Entra ID |
| Feature | User and directory settings |
| Area | Access control |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | None |
| Supports controls | nist-800-53-r5:AC-6, nist-800-53-r5:CM-7 |
| PowerShell test | [Test-MtTenantCreationRestricted](https://github.com/maester365/maester/blob/main/tests/maester/entra/Test.MT.1068.ps1) |
| Services | Graph |

</details>

## Source

- Test: [`tests/maester/entra/Test.MT.1068.ps1`](https://github.com/maester365/maester/blob/main/tests/maester/entra/Test.MT.1068.ps1)
- Documentation: [`tests/maester/entra/Test.MT.1068.md`](https://github.com/maester365/maester/blob/main/tests/maester/entra/Test.MT.1068.md)