Hi everyone! I'm facing an issue where users in my Azure tenant can create new subscriptions without my approval. One user mentioned that while trying to use Azure Storage Explorer, they were prompted to create an account, which offered $200 in credits. They seemed to think it was fine to delete the subscription afterward. I've reached out to Azure Support, but they haven't provided a clear solution. Has anyone dealt with this kind of situation before?
5 Answers
Set a default management group with strict lockdown rules for Visual Studio or MSDN subscriptions. Also, you could contact Microsoft support to block any Pay-As-You-Go subscription types altogether.
Check out Microsoft’s documentation on managing Azure subscription policies. It seems there are limitations on what can be blocked by policy, and simply restricting users may not be feasible.
You can prevent this by implementing Azure Policy and assigning the right RBAC roles at the management group level. Without proper permissions, users shouldn't be able to create subscriptions in your tenant.
Limit billing roles to only your central IT team, and manage new subscriptions using Infrastructure as Code (IaC). It's generally considered bad practice to block core platform functionality with Azure policy; it's better to control the process.
If the account is from the same domain, it’s standard for users to be able to create subscriptions. You might consider defining a specific management group that enforces stricter policy settings for those subscriptions.
Related Questions
How to Build a Custom GPT Journalist That Posts Directly to WordPress
Cloudflare Origin SSL Certificate Setup Guide
How To Effectively Monetize A Site With Ads