Microsoft Entra ID policies should have 'Users Can Create Tenants' set to 'No'
Microsoft Entra authorization policy defines default user permissions, including whether non-admin users are allowed_to_create_tenants. The Prowler check evaluates if tenant creation is disabled for default users via default_user_role_permissions.
Allowing default users to create tenants spawns unmanaged shadow tenants. Creators become Global Administrator, enabling escalation from compromised accounts and sidestepping governance.
What this control checks
Checks the Entra ID tenant creation setting for regular users
Audit evidence
Evidence that deployed resources meet this control: Prowler check entra_policy_ensure_default_user_cannot_create_tenants (prowler azure --checks entra_policy_ensure_default_user_cannot_create_tenants); PowerPipe control azure_compliance.control.iam_user_not_allowed_to_create_tenants.
Framework-specific interpretation
ISO/IEC 27001:2022: Mapped to A.5.15 (Access Control), A.5.18 (Access Rights), A.5.2 (Roles and Responsibilities) and 1 more clause.
NIS2 Directive (EU 2022/2555): Mapped to 11.2.2.a (assign and revoke access rights based on the principles of need-to-know, least privilege and separation of duties;), 11.2.2.d (ensure that access rights appropriately address third-party access, such as visitors, suppliers and service providers...), 11.3.2.c (individualise and restrict system administration privileges to the highest extent possible,) and 6 more clauses.
Framework mappings
The clauses this control is mapped to in each framework.
- A.5.2 Information security roles and responsibilities
- A.5.15 Access control
- A.5.18 Access rights
- A.8.2 Privileged access rights
- 2 Risk management policy
- 3 Incident handling
- 6 Security in network and information systems acquisition, development and maintenance
- 11 Access control
- 6.4 Ensure that 'Restrict non-admin users from creating tenants' is set to 'Yes'
- 5.4 Ensure that 'Restrict non-admin users from creating tenants' is set to 'Yes'
RBI Cyber Security Framework for UCBs
- Annex I (7.1)
- IAM-06.01B Privileged access rights for internal and external employees as well as technical users of the cloud service provider are assigned and changed in accordance with the policy for managing user accounts and access rights (cf. IAM-01) or a separate specific policy.
- IAM-06.02B Privileged access rights are personalised, limited in time according to a risk assessment and assigned as necessary for the execution of tasks ('need-to-know principle').
- 1.3 Ensure that 'Users can create Azure AD Tenants' is set to 'No'
- 1.3 Ensure that 'Restrict non-admin users from creating tenants' is set to 'Yes'
- 2.3 Ensure that 'Restrict non-admin users from creating tenants' is set to 'Yes'
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
iam_user_not_allowed_to_create_tenants - Powerpipe Control:
azure_compliance.control.iam_user_not_allowed_to_create_tenants - Prowler Check:
entra_policy_ensure_default_user_cannot_create_tenants
Last reviewed: 2026-10-13