Back to Checks
azure

Authorization policy restricts non-admin users from creating tenants

entra_policy_ensure_default_user_cannot_create_tenants
Service: entraSeverity: medium
OfficialBuilt-inVerified
Categories:identity-accesse3
Resource Type:NotDefined

Microsoft Entra authorization policy governs whether default users can create new tenants. This evaluates if tenant creation is disabled for non-admin users via allowed_to_create_tenants=false.

Prowler logoProwlerprowler-provider-azure

Risk

Permitting default users to create tenants fuels shadow IT and identity sprawl. Creators become Global Administrators of unmanaged tenants, eroding confidentiality and integrity through unsanctioned apps and unmonitored data flows, and degrading availability of centralized governance.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks entra_policy_ensure_default_user_cannot_create_tenants

Recommendation

Apply least privilege: set allowed_to_create_tenants=false so only vetted admins or the Tenant Creator role (managed with PIM) can create tenants. Enforce separation of duties, require approvals, and monitor audits. Review this setting regularly to prevent tenant sprawl and maintain defense in depth.

Remediation

CLI

Update-MgPolicyAuthorizationPolicy -AuthorizationPolicyId authorizationPolicy -BodyParameter @{ defaultUserRolePermissions = @{ allowedToCreateTenants = $false } }

Terraform

resource "azuread_authorization_policy" "<example_resource_name>" {
  default_user_role_permissions {
    allowed_to_create_tenants = false # Critical: disables tenant creation for non-privileged users
  }
}

Other

1Go to Microsoft Entra admin center (https://entra.microsoft.com)
2Navigate: Microsoft Entra ID > Users > User settings
3Set "Restrict non-admin users from creating tenants" to Yes
4Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.entra.entra_client import entra_client


class entra_policy_ensure_default_user_cannot_create_tenants(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []

        for tenant_domain, auth_policy in entra_client.authorization_policy.items():
            report = Check_Report_Azure(metadata=self.metadata(), resource=auth_policy)
            report.subscription = f"Tenant: {tenant_domain}"
            report.resource_name = getattr(auth_policy, "name", "Authorization Policy")
            report.resource_id = auth_policy.id
            report.status = "FAIL"
            report.status_extended = (
                "Tenants creation is not disabled for non-admin users."
            )

            if getattr(
                auth_policy, "default_user_role_permissions", None
            ) and not getattr(
                auth_policy.default_user_role_permissions,
                "allowed_to_create_tenants",
                True,
            ):
                report.status = "PASS"
                report.status_extended = (
                    "Tenants creation is disabled for non-admin users."
                )

            findings.append(report)

        return findings

References