How Do You Block Entra Self-Service Sign-Up for contoso.com?

Why the Answer Is Correct

Email-verified self-service sign-up for Microsoft 365 services is a tenant-level directory setting stored on the authorization policy object, which is why Update-MgPolicyAuthorizationPolicy is the required cmdlet. Setting the AllowedToSignUpEmailBasedSubscriptions property to False stops new users whose address matches a verified domain such as contoso.com from creating accounts through the automated sign-up flow. This is the Microsoft Graph equivalent of the older Set-MsolCompanySettings -AllowEmailVerifiedUsers $false command, and it is the exact control Microsoft documents for blocking self-service sign-up. Note that the change is forward-looking: it prevents new sign-ups but does not delete accounts that were already created, which must be cleaned up separately. The suggested answer key and the community's unanimous vote both agree on this cmdlet.

Why the Other Options Are Wrong

Update-MgDomain edits properties of a verified domain object — isDefault, supportedServices, authentication type or password notification window — and has no parameter that disables self-service sign-up, so it cannot satisfy the requirement even though the scenario mentions contoso.com. Update-MgPolicyPermissionGrantPolicyExclude modifies a permission grant policy that governs which delegated permissions are excluded from user consent for OAuth applications, a completely different control plane. Update-MgDomainFederationConfiguration configures federation settings such as the passive or active sign-in URI for a federated domain and applies only when the domain is federated rather than managed. None of these three touch the email-verified sign-up setting, so none of them prevent contoso.com users from creating accounts.

Community Comment Notes

As northgaterebel explained, the fix is to run Update-MgPolicyAuthorizationPolicy with "AllowedToSignUpEmailBasedSubscriptions" set to False and links the Microsoft Learn self-service sign-up article. JFROG concurs and points to the Microsoft 365 documentation section on blocking users from signing up, which reinforces that this is a tenant-wide subscription sign-up control rather than a domain setting. anonymousarpanch also selected the authorization policy cmdlet, describing it as the place where tenant-level settings such as guest access are adjusted — a reminder that one policy object carries several tenant-wide switches, so reading the parameter list carefully matters. There are no dissenting comments, so the consensus is unambiguous.