# Ensure That ‘Subscription Entering AAD Directory’ and ‘Subscription Leaving AAD Directory’ Is Set To ‘Permit No One’

- Source: https://support.icompaas.com/support/solutions/articles/62000229827-ensure-that-subscription-entering-aad-directory-and-subscription-leaving-aad-directory-is-set-to-
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [General](https://support.icompaas.com/support/solutions/62000037933) › [Azure Compliance / Control / Check](https://support.icompaas.com/support/solutions/folders/62000168797)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Description:

Restricting Subscription entering AAD directory and Subscription leaving AAD directory to Permit no one prevents unauthorized movement of Azure subscriptions between tenants and helps maintain strong tenant security and governance.

  

Rationale:

Restricting subscriptions from entering or leaving the directory prevents unauthorized tenant transfers, protects billing and resource ownership, and helps maintain tenant security and governance.

  

Impact:

Positive: Ensures strict governance over subscription lifecycle, prevents hijacking or accidental transfer, and ensures compliance with organizational security policies.  
Negative: Administrators must use formal approval processes for subscription migrations, which may add operational overhead.

  

Default Value:

The default configuration may allow certain privileged roles to initiate subscription transfers unless explicitly restricted.

  

Pre-Requisites:

-   Global Administrator or Privileged Role Administrator permissions
    
-   Microsoft Entra ID access
    
-   Access to Tenant Properties and Cross-Tenant Settings
    

  

Test Plan:

1.  Sign in to the Azure Portal at [https://portal.azure.com](https://portal.azure.com/)
    
2.  Open Microsoft Entra ID
    
3.  Select Properties
    
4.  Open Access management for Azure resources
    
5.  Verify the Access management for Azure resources toggle is set to Off
    
6.  Confirm subscriptions cannot enter or leave the directory
    

![](https://support.icompaas.com/assets/kb/87958f9cc5d4d7e5.png)

7.  If the toggle is set to On, follow the implementation steps
    

Implementation Steps:

1.  Sign in to the Azure Portal at [https://portal.azure.com](https://portal.azure.com/)
    
2.  Open Microsoft Entra ID
    
3.  Select Properties
    
4.  Open Access management for Azure resources
    
5.  Set the Access management for Azure resources toggle to Off
    

![](https://support.icompaas.com/assets/kb/b52a1bf28d191235.png)

6.  Save the changes
    

Backout Plan:

1.  Sign in to the Azure Portal at [https://portal.azure.com](https://portal.azure.com/)
    
2.  Open Microsoft Entra ID
    
3.  Select Properties
    
4.  Open Access management for Azure resources
    
5.  Set the Access management for Azure resources toggle to On
    
6.  Save the changes
    

## Reference:

-   [https://learn.microsoft.com/azure/role-based-access-control/elevate-access-global-admin](https://learn.microsoft.com/azure/role-based-access-control/elevate-access-global-admin)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.