Used to confine a role assignment to a subset of a Microsoft Entra directory, such as just one region's users for a local helpdesk. A unit holds users, groups or devices; units cannot be nested, and including a group does not make its individual members part of the scope.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains Administrative unit in context, with comparison tables and the common traps.
Terms in this definition
- Role assignment
Gives access in Azure RBAC by binding three things together: who (a security principal), what (a role definition) and where (a scope).
- Microsoft Entra
The umbrella brand covering Microsoft's identity and network access portfolio. Internet Access, Private Access, External ID and ID Governance all belong to it, built on top of the core directory service, Entra ID.
- region
A provider-defined grouping in VCF Automation of Supervisors that all share one NSX Local Manager; tenants consume its compute, storage and memory via quotas set per region.
- LSDOU
The sequence in which Group Policy is processed: the local policy first, followed by site, domain and organisational unit policies. The nearest, last-processed setting takes effect unless Enforced or Block Inheritance alters that.
- Scope
Where an access or policy assignment takes effect. It can be set on a single resource, a resource group, a subscription or a management group, and settings flow down from higher levels.
Related terms
- Custom role
Built from the preset permissions that the built-in Microsoft Entra roles also use, and assignable to the whole tenant, an administrative unit or one object. Each user it is assigned to needs Microsoft Entra ID P1; Azure custom roles are a separate thing.