EIDSCA.AP06 - Default Authorization Settings - User can join the tenant by email validation.

Contributed by Thomas NaunheimAll contributors →

Overview

Controls whether users can join the tenant by email validation. To join, the user must have an email address in a domain which matches one of the verified domains in the tenant.

Self-service sign up for email-verified users - Microsoft Entra ID - Microsoft Learn

Test script

https://graph.microsoft.com/beta/policies/authorizationPolicy
.allowEmailVerifiedUsersToJoinOrganization -eq 'false'

Related links

• Open in Graph Explorer
• authorizationPolicy resource type - Microsoft Graph beta | Microsoft Learn

MITRE ATT&CK

Tactic	Technique	Mitigation
TA0001 - Initial Access - Initial Access

Test Metadata

Field	Value
Test ID	EIDSCA.AP06
Severity	Medium
Suite	Entra ID SCA
Product	Entra ID
Feature	User and directory settings
Area	Access control
Resource type	Tenant
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1136.003 Cloud Account
Supports controls	nist-800-53-r5:AC-2
PowerShell test	Test-MtCheckEidscaAP06
Services	Graph

Source

• Test: tests/eidsca/Test.EIDSCA.AP06.ps1
• Documentation: tests/eidsca/Test.EIDSCA.AP06.md