What this check looks at
Checks whether people can join the tenant by verifying a company email address, or sign up for free and trial subscriptions themselves.
Two tenant-wide switches control self-service sign-up. The first lets someone with an email address on one of the organisation’s domains join the tenant by verifying that address, typically when they sign up for a Microsoft service with their work email. The second lets users sign up for free and trial subscriptions of email-based services themselves. Both are on in many older tenants, and both are changed through Microsoft Graph rather than an admin centre page.
The check fails when email-verified users can join the tenant, and warns at low severity when only self-service subscriptions are allowed. It passes when both are off, and warns that it only partly checked when one of the two settings was not returned.
Accounts created by email verification skip the joiner process: nobody approved them, they are not tied to HR records, they may miss the licences and policies others get, and they are easily forgotten when someone leaves. Self-service subscriptions bring services into use that IT does not know about, with company data in them and no owner.
Why it matters
Email-verified self-service sign-up creates accounts and subscriptions nobody approved, outside joiner processes and licence control. It is how "shadow" Power BI and trial tenants appear.
This is how unmanaged Power BI or Power Apps use usually starts: a manager signs up with a work email, uploads a spreadsheet of client data and shares a dashboard. When they leave, nobody knows the data is there, and nobody can remove access to it.
Unknown accounts and services make subject access requests and breach response under UK GDPR harder, because the organisation cannot say where personal data is held. They also cost money: trials that someone later converts to paid services have to be found and cancelled.
Cyber Essentials expects a process to create and approve user accounts, which email-verified joining bypasses, and the NCSC 10 Steps place joiner and leaver control within identity and access management. The rule maps to ISO/IEC 27001 control A.5.18 (access rights).
How to fix it
Where: Microsoft 365 admin centre → Settings → Org settings → Self-service trials and purchases
Before you start
- Check nobody is waiting on a self-service trial (Power BI and Power Apps are common); buy or assign those licences centrally first.
Step by step
- Look for accounts created this way. In Microsoft Graph PowerShell, run Connect-MgGraph -Scopes User.Read.All,Policy.ReadWrite.Authorization, then Get-MgUser -All -Property DisplayName,UserPrincipalName,CreationType | Where-Object CreationType -eq "EmailVerified". Review each account with the client: bring it into the normal joiner process, or delete it.
- Check nobody relies on a self-service trial. In the Microsoft 365 admin centre, look at Billing > Your products for trial subscriptions, and ask whether anyone is using Power BI, Power Apps or similar on a self-service sign-up. Assign proper licences centrally before switching sign-up off.
- Turn off both settings. Run Update-MgPolicyAuthorizationPolicy -AllowEmailVerifiedUsersToJoinOrganization:$false -AllowedToSignUpEmailBasedSubscriptions:$false. These settings are changed through Microsoft Graph (this cmdlet, or a PATCH to policies/authorizationPolicy in Graph Explorer).
- Review self-service purchases as well. In the Microsoft 365 admin centre, go to Settings > Org settings > Services > Self-service trials and purchases and set each product to Do not allow, unless the client wants people to buy it themselves. This is separate from the settings above and not part of this check, but closes the same gap for paid products.
- Confirm. Run Get-MgPolicyAuthorizationPolicy | Select-Object AllowEmailVerifiedUsersToJoinOrganization, AllowedToSignUpEmailBasedSubscriptions: both should be False. Re-run the assessment to confirm the finding passes.
With PowerShell
Update-MgPolicyAuthorizationPolicy -AllowEmailVerifiedUsersToJoinOrganization:$false -AllowedToSignUpEmailBasedSubscriptions:$false
What users will notice
People can no longer join the tenant by verifying a company email, or start free trials on their own. Accounts and licences come from IT.
How to confirm it worked
Graph Explorer, GET policies/authorizationPolicy: allowEmailVerifiedUsersToJoinOrganization and allowedToSignUpEmailBasedSubscriptions are both false.
Frameworks and controls
This check maps to controls in 12 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B2.a Identity verification, authentication and authorisation |
| DSPT | Standard 4: Managing data access |
| NIS2 | Art. 21(2)(i) Access control and asset management |
| Microsoft Cloud Security Benchmark | IM-1 Use centralised identity and authentication system |
| Zero Trust | Identities |
| SOC 2 | CC6.2 User registration, authorisation and removal |
| NIST SP 800-171 | 3.1.1 Limit system access to authorised users, processes and devices |
| CMMC Level 2 | AC.L2-3.1.1 Authorized Access Control |
| ISO 27001:2022 | A.5.18 Access rightsA.5.16 Identity management |
| CIS Controls v8.1 | 5.1 Establish and maintain an inventory of accounts (IG1) |
| NIST CSF 2.0 | PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization |
| NCSC 10 Steps | Identity and access managementArchitecture and configuration |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Self-service sign-up for email-verified users (Microsoft Learn)