According to the Microsoft SC-300: Identity and Access Administrator Study Guide and Microsoft Learn content under "Manage Azure AD tenants and configure tenant properties", self-service sign-up (also known as viral sign-up) allows users to create accounts in an existing Azure AD tenant using an email domain associated with that tenant. This feature lets external or ungoverned users create identities if it is not explicitly disabled, which can cause unauthorized account creation in the organization's namespace.
To stop users from performing self-service sign-ups using the organization's verified domain (e.g., contoso.
com), administrators must disable the AllowEmailVerifiedUsers setting in Azure Active Directory using PowerShell. This configuration change prevents users from automatically creating accounts with the organization's domain when registering for Microsoft 365 or other Azure services.
The cmdlet used to configure tenant-level settings like this is Set-MsolCompanySettings from the MSOnline module.
The specific PowerShell command would be:
Set-MsolCompanySettings -AllowEmailVerifiedUsers $false
This command disables self-service sign-up for email-verified users, ensuring that only administrators can create accounts in the tenant.
Other cmdlets in the options serve different purposes:
* Set-MsolDomainFederationSettings - Used for configuring federation settings for a domain.
* Update-MsolFederatedDomain - Used to update or repair federation trust settings.
* Set-MsolDomain - Used to configure domain-specific properties (e.g., authentication type).
As per Microsoft's official documentation:
"To prevent users from self-service sign-up using your organization's verified domain, set AllowEmailVerifiedUsers to $false using Set-MsolCompanySettings."