Anybody with an email address in a verified domain can join this tenant

What it decides

Rule

ENTRA-AUTH-005

Applies to

entra · authorization-policy

Default severity

medium

Basis

documented-guidance

On what authority

Microsoft defines the value and the definition is the finding: `allowEmailVerifiedUsersToJoinOrganization` "indicates whether a user can join the tenant by email validation", and to join "the user must have an email address in a domain that matches one of the verified domains in the tenant. This setting is applied company-wide for all domains in the tenant." THE SETTING CREATES MEMBERS, NOT GUESTS, and that is why it is worth reading separately from the invitation controls. An organisation that restricted who may invite guests has not restricted this: they are two different doors into the same directory. Microsoft documents the closed value without recommending either, so this reports the reach of the setting and does not say it is wrong. Schools and organisations that rely on self-service sign-up hold it deliberately.

• authorizationPolicy resource type
• What is self-service sign-up for Microsoft Entra ID?

What it needs to decide

• authorization_policy.email_verified_users_may_join

Without these facts the rule answers unknown, which is not a pass and is not a failure: it is the rule saying the evidence could not settle the question.

Where the evidence comes from

• tenant-governance: what every user in a tenant may do without asking, and how many accounts hold the role that may do anything · live-validated

What a pass does not establish

OFF TODAY IS NOT NOBODY. This reads one setting and says nothing about who joined while it was on, whether those accounts are still there, or what they can reach. A tenant that closed this yesterday still holds every member created before.

• The setting is company-wide and this rule reads it as such. It cannot say which verified domains exist, and a tenant that verified a domain it no longer controls is a different question this does not ask.
• Joining is one path to an account. Invitations, access packages, cross-tenant access and directory synchronisation are others, and a closed value here is not a boundary around the directory.

Source

The rule as the Engine holds it, at the revision this page was generated from: 1.0.0b10@0c269e9d29d0.

Generated from capability-manifest/1.0.0 at 1.0.0b10@0c269e9d29d0, contract 1.0.0b10. Every fact on this page is the Engine's; this site publishes it and does not maintain it.