Administrative units in Microsoft Entra ID

An administrative unit is a Microsoft Entra container that limits a role’s scope to part of the organisation. Use it to let regional or divisional administrators manage only their own users, groups or devices.

How they work

• A unit contains only users, groups or devices. Units cannot be nested, and a user can be a member of several.
• If a role is assigned to someone who is not scoped to a unit, the role applies to the whole tenant.
• Adding a group to a unit puts the group’s own properties and membership under the scope but not its members. A scoped administrator can rename the group or change membership but cannot reset a member’s password or edit the member’s properties unless the member is added to the unit directly.
• Scope applies to management permissions only. People can still browse the directory using default user permissions; in the Microsoft 365 admin center, users outside a scoped admin’s units are filtered out.
• Dynamic membership rules can add users or devices (Microsoft Entra admin center and Graph/PowerShell, not the Microsoft 365 admin center) but cannot add groups.
• Units can be created and populated in the Microsoft 365 admin center, the Microsoft Entra admin center, PowerShell and Graph; a Privileged Role Administrator can do this in the Microsoft Entra admin center.

What a scoped administrator can do in each tool: user property, password, licence and sign-in blocking work in all three (Graph/PowerShell, Entra admin center, Microsoft 365 admin center); scoped MFA credential management is not available in the Microsoft 365 admin center; non-Microsoft 365 group management and group licensing are not available there either; device actions are not available in the Microsoft 365 admin center, and Intune device management is not supported by units.

Restricted management administrative units

A restricted management administrative unit protects objects (for example executive accounts, or sensitive security groups) from changes by anyone who is not explicitly assigned at that unit’s scope, even tenant-wide administrators. A Global Administrator cannot modify the objects unless they assign themselves a role scoped to the unit, which is audited.

Blocked for unscoped administrators: modifying Entra properties, deleting the object, resetting a password, and changing group owners or members. Reading standard properties is allowed. Operations on related Microsoft 365 services are not affected. Warning from Learn: this “severely restricts” who can change objects and can break existing workflows.

Common trap: Adding a group to an administrative unit lets the scoped administrator reset passwords for its members - only the group object comes into scope. The members must be added to the unit directly.

Get the whole book

This note is one section of Ultra Transcenders AB-650: Administering Microsoft 365 and AI Services, an independent study guide that explains every topic the exam covers by technology, with comparison tables, diagrams and the common traps, plus a glossary linked to Microsoft Learn.

About the book · AB-650 terms in the glossary · All AB-650 study notes