How to restrict Azure subscription creation for specific email domains while allowing administrators?

Question

How to restrict Azure subscription creation for specific email domains while allowing administrators?

Kanha Bhatt 1

Hello Microsoft Community,

We are looking to strengthen our cloud governance and prevent unauthorized users from creating new Azure subscriptions using their corporate identities & personal credit card, while still allowing designated administrators to do so.

Scenario:

We have users in our tenant with domains like @abc.com and @abcglobal.com.

We want to block standard users under these domains from creating self-service/Pay-As-You-Go Azure subscriptions or attaching their corporate accounts to new subscriptions.

We must allow designated IT / Cloud Administrators under these same domains to create and provision subscriptions as needed.

Specific Questions:

Can Azure Policy be used for this? Can a custom Azure Policy definition inspect user attributes (such as UPN or domain name) and deny subscription creation at the root/tenant level?
Recommended Best Practice: If Azure Policy does not evaluate user identity during subscription creation, what is the Microsoft-recommended approach to achieve this lockdown? (e.g., Billing RBAC, Microsoft Entra ID tenant creation settings, or Management Group isolation/quarantine strategies?)

Any architectural guidance, reference documentation, or best practices would be greatly appreciated!

Thank you!

@azure-policy⁠

@⁠azure-governance⁠

⁠@azure-subscriptions⁠

⁠@microsoft-entra-id⁠

VEMULA SRISAI 13,895 Reputation points Microsoft External Staff Moderator

2026-08-28T17:32:01.9366667+00:00
Hello Kanha Bhatt,

Thank you for your question.

Based on the scenario you've described, Azure Policy cannot be used to prevent subscription creation based on a user's UPN, email domain, or other Microsoft Entra ID user attributes. Azure Policy is evaluated after a subscription exists and is intended to govern resources within subscriptions, not control who can create subscriptions.

For this requirement, Microsoft's recommended approach is to control subscription creation through Billing RBAC and subscription creation permissions rather than Azure Policy. Only users who have roles such as Owner, Contributor on the billing hierarchy, or the Azure Subscription Creator role can create new subscriptions. By assigning these permissions only to a designated Cloud/IT Administrator group and removing them from standard users, you can effectively prevent unauthorized subscription creation while still allowing approved administrators to provision subscriptions.

For this requirement, Microsoft's recommended approach is to control subscription creation through Billing RBAC and subscription creation permissions rather than Azure Policy. Only users who have roles such as Owner, Contributor on the billing hierarchy, or the Azure Subscription Creator role can create new subscriptions. By assigning these permissions only to a designated Cloud/IT Administrator group and removing them from standard users, you can effectively prevent unauthorized subscription creation while still allowing approved administrators to provision subscriptions.

Recommended architecture:

Standard Users (@abc.com, @abcglobal.com) → No billing subscription creation permissions.

Cloud/IT Administrators → Assigned Azure Subscription Creator or appropriate Billing roles.

Newly created subscriptions → Automatically governed through Management Groups, RBAC, and Azure Policy controls.

I hope this helps clarify the available controls and governance options. Please let us know your billing agreement type (MCA, EA, CSP, etc.) if you would like more specific guidance tailored to your environment.

How to restrict Azure subscription creation for specific email domains while allowing administrators?

Your answer