Merge pull request #297995 from PreetiOne/patch-1

Update manage-azure-subscription-policy.md

Author: denrea

articles/cost-management-billing/manage/manage-azure-subscription-policy.md

@@ -1,7 +1,7 @@
 ---
 title: Manage Azure subscription policies
 description: Learn how to manage Azure subscription policies to control the movement of Azure subscriptions from and into directories.
-author: PreetiSGit
+author: PreetiOne
 ms.service: cost-management-billing
 ms.subservice: billing
 ms.topic: how-to
@@ -12,28 +12,38 @@ ms.author: presharm
 
 # Manage Azure subscription policies
 
-This article helps you configure Azure subscription policies for subscription operations to control the movement of Azure subscriptions from and into directories.
+This article helps you to configure Azure subscription policies to control the movement of Azure subscriptions from and into directories. The default behavior of these two policies is set to **Allow Everyone**. Note that the setting of **Allow Everyone** allows all authorized users, including authorized guest users on a subscription to be able to transfer them. It does not mean all users of a directory.    
 
 ## Prerequisites
 
 - Only directory [global administrators](../../active-directory/roles/permissions-reference.md#global-administrator) can edit subscription policies. Before editing subscription policies, the global administrator must [Elevate access to manage all Azure subscriptions and management groups](../../role-based-access-control/elevate-access-global-admin.md). Then they can edit subscription policies.
 - All other users can only read the current policy setting.
+- Subscriptions transferred into or out of a directory must remain associated with a Billing Tenant to ensure billing occurs correctly. 
 
 ## Available subscription policy settings
 
 Use the following policy settings to control the movement of Azure subscriptions from and into directories.
 
 ### Subscriptions leaving a Microsoft Entra ID directory
 
-The policy allows or stops users from moving subscriptions out of the current directory. [Subscription owners](../../role-based-access-control/built-in-roles.md#owner) can [change the directory of an Azure subscription](../../active-directory/fundamentals/active-directory-how-subscriptions-associated-directory.md) to another one where they're a member. It poses governance challenges, so global administrators can allow or disallow directory users from changing the directory.
+The policy allows or stops users from moving subscriptions out of the current directory. [Subscription owners](../../role-based-access-control/built-in-roles.md#owner) can [change the directory of an Azure subscription](../../active-directory/fundamentals/active-directory-how-subscriptions-associated-directory.md) or use transfer features available on the Azure portal and APIs to another directory where they're a member. Global administrators can allow or disallow directory users from changing the directory or transfer of subscriptions.
+- Set this policy to **Permit no one** if you do not want subscriptions to be transferred out of your directory. This policy applies to all authorized subscriptions users including authorized guest users of your directory. 
+- Set this policy to **Allow Everyone** if you want all authorized users including authorized guest users to be able to transfer subscriptions out of your directory.   
 
 ### Subscriptions entering a Microsoft Entra ID directory
 
-The policy allows or stops users from other directories, who have access in the current directory, to move subscriptions into the current directory. [Subscription owners](../../role-based-access-control/built-in-roles.md#owner) can [change the directory of an Azure subscription](../../active-directory/fundamentals/active-directory-how-subscriptions-associated-directory.md) to another one where they're a member. It poses governance challenges, so global administrators can allow or disallow directory users from changing the directory.
+The policy allows or stops users from other directories, who have access in the current directory, to move subscriptions into the current directory. [Subscription owners](../../role-based-access-control/built-in-roles.md#owner) can [change the directory of an Azure subscription](../../active-directory/fundamentals/active-directory-how-subscriptions-associated-directory.md) or transfer them to another directory where they're a member. Global administrators can allow or disallow directory users from transferring these subscriptions.
+- Set this policy to **Permit no one** if you do not want subscriptions to be transferred into your directory. This policy applies to all authorized users, including authorized guest users of your directory. 
+- Set this policy to **Allow Everyone** if you want all authorized users, including authorized guest users in your directory to be able to transfer subscriptions into your directory.   
 
 ### Exempted Users
 
-For governance reasons, global administrators can block all subscription directory moves - in to or out of the current directory. However they might want to allow specific users to do either operations. For either situation, they can configure a list of exempted users that allows the users to bypass the policy setting that applies to everyone else.
+For governance reasons, global administrators can block all subscription directory moves - in to or out of the current directory. However they might want to allow specific users to do both operations. For both situations, they can configure a list of exempted users that allows these users to bypass all the policy settings that apply to everyone else.
+
+#### Important note 
+Authorized users (including guest users) in your directory can create Azure subscriptions in another directory where they have billing permissions and then transfer those subscriptions into your Entra ID directory.  If you don't want to allow this, you should set one or both of the following policies: 
+- Subscriptions leaving Entra ID directory should be set to **Permit no one**.
+- Subscriptions entering Entra ID directory should be set to **Permit no one**.  
 
 ## Setting subscription policy
 
@@ -53,3 +63,4 @@ Non-global administrators can still navigate to the subscription policy area to
 ## Next steps
 
 - Read the [Cost Management + Billing documentation](../index.yml)
+