CreativeTechsBaseline
tenant security posture
CTB-06 · Tier 1 · Silent · M365

Non-admins cannot create tenants or self-service subscriptions

CIS M365 5.1.2.3 · L1EIDSCA AP05 / AP06Huntress Non-admin tenant creation · MediumMaester MT.10683 authorities
0
Tenants failing
0
Tenants meeting
0
Measured
REQUIRED
Disposition
The settingWhat we hold this to
CreativeTechs minimum
allowedToCreateTenants = false. allowedToSignUpEmailBasedSubscriptions = false. allowEmailVerifiedUsersToJoinOrganization = false.
Benchmark position
CIS M365 5.1.2.3 (L1) — 'Restrict non-admin users from creating tenants' set to Yes. EIDSCA.AP05 and AP06 both recommend 'false'. Our minimum matches all three.
Where the switch is
Entra admin centre → Identity → Users → User settings → Restrict non-admin users from creating tenants = Yes. Email-based signup sits in the same authorization policy (PowerShell below).
https://entra.microsoft.com
How to verify
Graph: /policies/authorizationPolicy  →  defaultUserRolePermissions.allowedToCreateTenants eq false, allowedToSignUpEmailBasedSubscriptions eq false, allowEmailVerifiedUsersToJoinOrganization eq false
Across the fleet
Client
State
Evidence
Blackwing
UNKNOWN
No Secure Score evidence — awaiting Maester.
BravicaOne
UNKNOWN
No Secure Score evidence — awaiting Maester.
CMG Law
UNKNOWN
No Secure Score evidence — awaiting Maester.
CreativeTechs
UNKNOWN
No Secure Score evidence — awaiting Maester.
DCG One
UNKNOWN
No Secure Score evidence — awaiting Maester.
Diversified Management Services
UNKNOWN
No Secure Score evidence — awaiting Maester.
Double Z
UNKNOWN
No Secure Score evidence — awaiting Maester.
Electric Pen
UNKNOWN
No Secure Score evidence — awaiting Maester.
Graphiti Associates
UNKNOWN
No Secure Score evidence — awaiting Maester.
Guidance Engineering
UNKNOWN
No Secure Score evidence — awaiting Maester.
India Tree
UNKNOWN
No Secure Score evidence — awaiting Maester.
MIR Corp
UNKNOWN
No Secure Score evidence — awaiting Maester.
Phinney Bischoff
UNKNOWN
No Secure Score evidence — awaiting Maester.
Quiver Dental
UNKNOWN
No Secure Score evidence — awaiting Maester.
RHO Architects
UNKNOWN
No Secure Score evidence — awaiting Maester.
Retail Voodoo
UNKNOWN
No Secure Score evidence — awaiting Maester.
Riverstone
UNKNOWN
No Secure Score evidence — awaiting Maester.
SSF
UNKNOWN
No Secure Score evidence — awaiting Maester.
Slingshot Architecture
UNKNOWN
No Secure Score evidence — awaiting Maester.
Stoke
UNKNOWN
No Secure Score evidence — awaiting Maester.
Turnstyle
UNKNOWN
No Secure Score evidence — awaiting Maester.
Urban Animal
UNKNOWN
No Secure Score evidence — awaiting Maester.
WLIHA
UNKNOWN
No Secure Score evidence — awaiting Maester.
Zak Designs
UNKNOWN
No Secure Score evidence — awaiting Maester.
Why it matters
Self-service signup creates shadow tenants and viral licences outside our visibility and offboarding.
How we check
Maester MT.1068, CIS.M365.5.1.2.3, EIDSCA.AP05/AP06.
Fix — M365
Entra → User settings → restrict non-admin tenant creation = Yes. Disable email-based subscription signup and join-tenant-by-email.
Fix — Google
Admin → account settings → restrict user-initiated signups.
User notices
None.
Expected pushback
None. This one is free.