diff --git a/lib/spack/spack/environment/environment.py b/lib/spack/spack/environment/environment.py
index 01a956d6220..3bf64451471 100644
--- a/lib/spack/spack/environment/environment.py
+++ b/lib/spack/spack/environment/environment.py
@@ -1039,9 +1039,19 @@ def env_file_config_scope(self):
             [spack.config.first_existing(self.raw_yaml, spack.schema.env.keys)],
         )
 
+    def _check_disallowed_env_config_mods(scopes):
+        for scope in scopes:
+            with spack.config.override(scope):
+                if spack.config.get("config:environments_root"):
+                    raise SpackEnvironmentError("Need a good message")
+                else:
+                    spack.config.print_section("config")
+
     def config_scopes(self):
         """A list of all configuration scopes for this environment."""
-        return self.included_config_scopes() + [self.env_file_config_scope()]
+        return _check_disallowed_env_config_mods(
+            self.included_config_scopes() + [self.env_file_config_scope()]
+        )
 
     def destroy(self):
         """Remove this environment from Spack entirely."""
diff --git a/lib/spack/spack/test/config.py b/lib/spack/spack/test/config.py
index 091efcea012..41bac1ad72f 100644
--- a/lib/spack/spack/test/config.py
+++ b/lib/spack/spack/test/config.py
@@ -1463,3 +1463,21 @@ def test_environment_errors_if_root_missing(mutable_config, tmpdir):
 
     with pytest.raises(ev.SpackEnvironmentError, match=env_dir):
         env("create", "test")
+
+
+def test_environment_cant_modify_environments_root(tmpdir):
+    filename = tmpdir.join("spack.yaml")
+    with open(filename, "w") as f:
+        f.write(
+            """\
+spack:
+  config:
+    environments_root: /a/black/hole
+  view: false
+  specs: []
+"""
+        )
+    with tmpdir.as_cwd():
+        env("create", "-d", tmpdir.strpath)
+        with pytest.raises(ev.SpackEnvironmentError):
+            env("activate", "-d", tmpdir.strpath)