Microsoft Entra ID Governance
GovernanceCreate Tenant
In brief
The tenant creation guide now explicitly states that the required subscription permissions are Azure Resource Manager (ARM) permissions, provided through the Tenant Contributor or Subscription Owner/Creator role.
What Entra admins need to know
Administrators can use the clarified wording to verify the correct subscription permissions before creating a tenant.
This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
- Your organization is a paid customer. Customers using a free tenant or trial subscription can't create additional tenants from the Microsoft Entra admin center. If you need a new tenant, sign up for a free Azure account.
- Your selected Azure subscription is associated with an Enterprise Agreement (EA) or pay-as-you-go billing account. Legacy and modern billing experiences are supported. To identify your billing account type, see View your billing accounts in the Azure portal.
- Your Microsoft Entra tenant allows member users to create add-on tenants. If Restrict non-admin users from creating tenants is set to Yes, your account needs the Tenant Creator role.
- You have the required Azure Resource Manager (ARM) permissions for the selected subscription through the Tenant Contributor or Subscription Owner/Creator role.
- The governing tenant has a configured default governance policy template. The tenant creation service uses only the default template (ID:
default). If the default template isn't defined, the secure add-on tenant creation flow doesn't establish a governance relationship, even if other templates exist.
Create the tenant
@@ -30,7 +30,7 @@ Before you create a governed workforce tenant, confirm that you meet these requi - Your organization is a paid customer. Customers using a free tenant or trial subscription can't create additional tenants from the Microsoft Entra admin center. If you need a new tenant, sign up for a [free Azure account](https://azure.microsoft.com/pricing/purchase-options/azure-account?cid=msft_learn). - Your selected Azure subscription is associated with an [Enterprise Agreement (EA)](/azure/cost-management-billing/manage/understand-ea-roles) or [pay-as-you-go](https://azure.microsoft.com/pricing/offers/ms-azr-0003p?cid=msft_learn) billing account. Legacy and modern billing experiences are supported. To identify your billing account type, see [View your billing accounts in the Azure portal](/azure/cost-management-billing/manage/view-all-accounts). - Your Microsoft Entra tenant allows member users to create add-on tenants. If [**Restrict non-admin users from creating tenants**](~/fundamentals/users-default-permissions.md#restrict-member-users-default-permissions) is set to **Yes**, your account needs the [Tenant Creator](~/identity/role-based-access-control/permissions-reference.md#tenant-creator) role.-- You have the required permissions for the selected subscription through the **Tenant Contributor** or **Subscription Owner/Creator** role.+- You have the required Azure Resource Manager (ARM) permissions for the selected subscription through the **Tenant Contributor** or **Subscription Owner/Creator** role. - The governing tenant has a configured **default** [governance policy template](governance-policy-templates.md). The tenant creation service uses only the default template (ID: `default`). If the default template isn't defined, the secure add-on tenant creation flow doesn't establish a governance relationship, even if other templates exist. ## Create the tenant