You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Learn how to turn on the Microsoft Entra tenant policy, which restricts users from creating an organization in Azure DevOps. This policy is turned off, by default.
20
+
By default, any user in a Microsoft Entra tenant can create new Azure DevOps organizations. You can enable the **Restrict organization creation** policy to control this behavior. When you turn on this policy, only users and groups on the allowlist can create organizations. All other users, including Azure DevOps administrators, are blocked unless explicitly added to the allowlist.
21
+
22
+
> [!NOTE]
23
+
> This policy only affects the creation of new organizations. It doesn't change access to existing organizations or affect their settings.
21
24
22
25
## Prerequisites
23
26
@@ -27,9 +30,9 @@ Learn how to turn on the Microsoft Entra tenant policy, which restricts users fr
27
30
28
31
## Turn on the policy
29
32
30
-
To turn on the policy that restricts users from creating new organizations, do the following steps:
33
+
To turn on the policy that restricts users from creating new organizations, follow these steps:
31
34
32
-
1. Sign in to your organization (```https://dev.azure.com/{Your_Organization}```).
35
+
1. Sign in to your organization (`https://dev.azure.com/{Your_Organization}`).
After you enable the policy, you can customize its behavior by creating an allowlist for exceptions and customizing the error message users see when they can't create organizations.
47
+
After you enable the policy, you can manage which users and groups are allowed to create organizations, and customize the error message that blocked users see.
45
48
46
-
### Create allowlist
49
+
### Add users or groups to the allowlist
47
50
48
51
> [!WARNING]
49
52
> We recommend using groups with your tenant policy allowlist. If you use a named user, a reference to the named user's identity resides in the United States, Europe (EU), and Southeast Asia (Singapore).
50
53
51
-
When the policy is enabled, only users on the allowlist can create new organizations.
54
+
Users or groups on the allowlist can create organizations when you enable the **Restrict organization creation**policy. All other users, including Azure DevOps administrators, are blocked unless they're on this list.
52
55
53
-
Select **Add Microsoft Entra user or group**.
56
+
To add a user or group to the allowlist:
54
57
55
-
For more information, see [Add organization users and manage access](add-organization-users.md).
58
+
1. Go to **Organization settings** > **Microsoft Entra ID**.
59
+
2. Under **Allow list**, select **Add Microsoft Entra user or group**.
60
+
3. Search for and select the user or group, and then save your changes.
56
61
57
-
### Create error message
62
+
For more information, see [Add organization users and manage access](add-organization-users.md).
58
63
59
-
To customize the error message, do the following steps:
64
+
### Customize the error message
60
65
61
-
1. In the policy settings in Azure DevOps, select **Edit display message**.
66
+
You can change the error message that users see when they're blocked from creating an organization.
62
67
63
-
2. Enter your customized message, and then select **Save**.
68
+
1. Go to **Organization settings** > **Microsoft Entra ID**.
69
+
2. Select **Edit display message**.
70
+
3. Enter your customized message, and then select **Save**.
0 commit comments