Azure Compliance ControlsMicrosoft Entra ID
Azure subscriptions should have 'Subscription leaving Microsoft Entra tenant' and 'Subscription entering Microsoft Entra tenant' set to 'Permit no one'
Checks that 'Subscription leaving Microsoft Entra tenant' and 'Subscription entering Microsoft Entra tenant' are set to 'Permit no one'. Subscription owners can make administrative changes and move subscriptions into and out of Microsoft Entra ID.
What this control checks
Subscription leaving and entering Microsoft Entra tenant must both be set to 'Permit no one'
Framework mappings
The clauses this control is mapped to in each framework.
- 5.25 Ensure that 'Subscription leaving Microsoft Entra tenant' and 'Subscription entering Microsoft Entra tenant' is set to 'Permit no one'
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
iam_subscription_tenant_transfer_restricted - Powerpipe Control:
azure_compliance.control.iam_subscription_tenant_transfer_restricted
Last reviewed: 2026-10-13