Subscriptions should be blocked from leaving and entering the tenant

Contributed by Erik Oppedijk with Merill FernandoAll contributors →

Part of Maester · Azure · Subscriptions · All checks

Run this check

Invoke-Maester -TestId MT.1227

Overview

Subscriptions should be blocked from leaving and entering the tenant.

The tenant subscription policy controls whether subscription owners can move a subscription out of the tenant or bring one in from another tenant. Allowing subscriptions to leave can let a privileged user transfer a subscription and its resources to an external tenant. Allowing subscriptions to enter can let a user bring in a subscription they control, together with its resources and role assignments.

Since 1 May 2026 Microsoft blocks both directions by default for tenants that never set a policy. A tenant that set Allow everyone before then keeps that setting. This check also covers CIS Microsoft Azure Foundations Benchmark v6.0.0 recommendation 5.6.

Remediation action

1. Sign in to the Azure portal as a Global Administrator with a direct role assignment, and elevate access to manage all Azure subscriptions. Other users can read the policy but not change it.
2. Go to Subscriptions and select Manage Policies.
3. Set Subscription leaving Microsoft Entra tenant and Subscription entering Microsoft Entra tenant to Permit no one.
4. If specific users must still move subscriptions, add them to Exempted Users.
5. Select Save changes.

Related links

• Manage Azure subscription policies - Microsoft Learn
• Azure portal

Details

Every attribute of this check

Field	Value
Test ID	MT.1227
Severity	Medium
Suite	Maester
Product	Azure
Feature	Subscriptions
Area	Infrastructure hardening
Resource type	Tenant
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1537 Transfer Data to Cloud Account
Supports controls	nist-800-53-r5:AC-4
PowerShell test	Test-MtSubscriptionTransferBlocked
Services	Azure

Source

• Test: tests/maester/azure/Test.MT.1227.ps1
• Documentation: tests/maester/azure/Test.MT.1227.md