Azure policy doesn't works on tenant scope and there were no permissions in azure RBAC too for restricting access to create an AAD.

CodePudding user response：

As it's free to create an azure tenant, it's not something you can restrict access to. creating an azure tenant has zero affect on a corporations tenant(s). You can assign RBAC to something you don't own. What is the reason you'd like to prevent a user from creating their own tenant?