Azure Compliance ControlsMicrosoft Entra ID
Microsoft Entra ID policies should have 'Users Can Create Tenants' set to 'No'
Microsoft Entra authorization policy defines default user permissions, including whether non-admin users are allowed_to_create_tenants. The Prowler check evaluates if tenant creation is disabled for default users via default_user_role_permissions.
What this control checks
Checks the Entra ID tenant creation setting for regular users
Framework mappings
The clauses this control is mapped to in each framework.
- A.5.2 Information security roles and responsibilities
- A.5.15 Access control
- A.5.18 Access rights
- A.8.2 Privileged access rights
- 2 Risk management policy
- 3 Incident handling
- 6 Security in network and information systems acquisition, development and maintenance
- 11 Access control
- 6.4 Ensure that 'Restrict non-admin users from creating tenants' is set to 'Yes'
- 5.4 Ensure that 'Restrict non-admin users from creating tenants' is set to 'Yes'
RBI Cyber Security Framework for UCBs
- Annex I (7.1)
- IAM-06.01B Privileged access rights for internal and external employees as well as technical users of the cloud service provider are assigned and changed in accordance with the policy for managing user accounts and access rights (cf. IAM-01) or a separate specific policy.
- IAM-06.02B Privileged access rights are personalised, limited in time according to a risk assessment and assigned as necessary for the execution of tasks ('need-to-know principle').
- 1.3 Ensure that 'Users can create Azure AD Tenants' is set to 'No'
- 1.3 Ensure that 'Restrict non-admin users from creating tenants' is set to 'Yes'
- 2.3 Ensure that 'Restrict non-admin users from creating tenants' is set to 'Yes'
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
iam_user_not_allowed_to_create_tenants - Powerpipe Control:
azure_compliance.control.iam_user_not_allowed_to_create_tenants - Prowler Check:
entra_policy_ensure_default_user_cannot_create_tenants
Last reviewed: 2026-10-13