Azure subscriptions should have 'Subscription leaving Microsoft Entra tenant' and 'Subscription entering Microsoft Entra tenant' set to 'Permit no one'
Checks that 'Subscription leaving Microsoft Entra tenant' and 'Subscription entering Microsoft Entra tenant' are set to 'Permit no one'. Subscription owners can make administrative changes and move subscriptions into and out of Microsoft Entra ID.
Users who are set as subscription owners are able to make administrative changes to the subscriptions and move them into and out of Microsoft Entra ID.
What this control checks
Subscription leaving and entering Microsoft Entra tenant must both be set to 'Permit no one'
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control azure_compliance.control.iam_subscription_tenant_transfer_restricted.
Framework-specific interpretation
CIS Azure Benchmark v5.0.0: Mapped to 5.25 (Ensure that 'Subscription leaving Microsoft Entra tenant' and 'Subscription entering Microsoft Entra tenant' is set to...).
Framework mappings
The clauses this control is mapped to in each framework.
- 5.25 Ensure that 'Subscription leaving Microsoft Entra tenant' and 'Subscription entering Microsoft Entra tenant' is set to 'Permit no one'
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
iam_subscription_tenant_transfer_restricted - Powerpipe Control:
azure_compliance.control.iam_subscription_tenant_transfer_restricted
Last reviewed: 2026-10-13