Skip to content
MitoMito Docs

EIDSCA.AP06: Default Authorization Settings - User can join the tenant by email validation.
ID EIDSCA.AP06
Severity Medium
Suite EIDSCA
Product Entra ID
Feature User and directory settings
Security area Access control
Resource type Tenant
User impact of fixing Low
Effort to fix Low
Framework controls nist-800-53-r5:AC-2 Account Management
MITRE ATT&CK T1136.003
Reads from Microsoft Graph

What this checks and how to fix it

Section titled “What this checks and how to fix it”

Controls whether users can join the tenant by email validation. To join, the user must have an email address in a domain which matches one of the verified domains in the tenant.

Self-service sign up for email-verified users - Microsoft Entra ID - Microsoft Learn

Test script

Section titled “Test script”
https://graph.microsoft.com/beta/policies/authorizationPolicy
.allowEmailVerifiedUsersToJoinOrganization -eq 'false'
Section titled “Related links”

MITRE ATT&CK

Section titled “MITRE ATT&CK”
mindmap
  root{{MITRE ATT&CK}}
    (Tactic)
      TA0001 - Initial Access - Initial Access
    (Mitigation)


    (Technique)
Tactic Technique Mitigation
TA0001 - Initial Access - Initial Access

Mito check, based on EIDSCA. Author: Cloud-Architekt. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.