Any user can create a new tenant this organisation does not govern

What it decides

Rule

ENTRA-AUTH-004

Applies to

entra · authorization-policy

Default severity

medium

Basis

documented-guidance

On what authority

Microsoft documents the property as corresponding to the "Restrict non-admin users from creating tenants" setting in the Microsoft Entra admin centre -- a control whose name is the recommendation. The reference also records what restricting it does not do: "When this setting is `false`, users assigned the Tenant Creator role can still create tenants", so closing it keeps the capability available to the people who were given it. What makes this worth a rule rather than a preference is where the created directory sits. It is not a resource this organisation can audit, apply policy to, or find. It is a peer, created with an organisational identity, and the first time most organisations learn one exists is when somebody puts data in it.

• defaultUserRolePermissions resource type
• Default user permissions in Microsoft Entra ID

What it needs to decide

• authorization_policy.users_may_create_tenants

Without these facts the rule answers unknown, which is not a pass and is not a failure: it is the rule saying the evidence could not settle the question.

Where the evidence comes from

• tenant-governance: what every user in a tenant may do without asking, and how many accounts hold the role that may do anything · live-validated

What a pass does not establish

RESTRICTING IT DOES NOT FIND THE ONES ALREADY CREATED. A tenant created while this was open stays created, stays ungoverned and is not visible from here. This rule reads whether it can happen again, and nothing about whether it happened.

• Users can also reach an ungoverned directory without creating one, through a personal account or a free subscription that this setting does not govern. The setting closes one documented path.

Source

The rule as the Engine holds it, at the revision this page was generated from: 1.0.0b10@0c269e9d29d0.

Generated from capability-manifest/1.0.0 at 1.0.0b10@0c269e9d29d0, contract 1.0.0b10. Every fact on this page is the Engine's; this site publishes it and does not maintain it.