1. Restrict access to the Azure Portal for non privileged accounts – Go to Azure AD > User Settings > Restrict access to Azure AD Administration Portal (set to yes)

2. Create new management group and set it as the default for new subscriptions. Applied a policy that restricted all service deployments.

3. There is an internal process for blocking non EA subscriptions through a support ticket and we can only block non-EA offer sign-ups.