Restrict organization creation via Microsoft Entra tenant policy
Azure DevOps Services
Learn how to turn on the Microsoft Entra tenant policy, which restricts users from creating an organization in Azure DevOps. This policy is turned off, by default.
Prerequisites
Permissions: To manage this policy, be an Azure DevOps Administrator in Microsoft Entra ID. Being a Project Collection Administrator isn't required.
If you don't see the policy section in Azure DevOps, it means you aren't an administrator. To check your role, sign in to the Azure portal, and then go to Microsoft Entra ID > Roles and administrators. If you aren't an Azure DevOps Administrator, contact your administrator for assistance.
Turn on the policy
Sign in to your organization (
https://dev.azure.com/{yourorganization}).Select
Organization settings.
Select Microsoft Entra ID, and then switch the toggle to turn on the policy, restricting organization creation.
Optional
Create allowlist
Warning
We recommend using groups with your tenant policy allow list. If you use a named user, be aware that a reference to the named user's identity will reside in the United States, Europe (EU), and Southeast Asia (Singapore).
When the policy is enabled, all users are restricted from creating new organizations. To grant exceptions, add users to an allowlist. Users on the allowlist can create new organizations but can't manage the policy.
Select Add Microsoft Entra user or group.
Create error message
When administrators, who aren't on the allowlist, try to create an organization they get an error.
To customize this error message, do the following steps:
In the policy settings in Azure DevOps, select Edit display message.
Enter your customized message, and then select Save.
The error message is customized.
Note
Administrators, who aren't on the allow list, can't connect their organization to the Microsoft Entra tenant where the policy is turned on.
