Its users, devices and security groups can be changed only by admins who hold a role scoped to the unit itself; tenant-wide Global Administrators are shut out. You have to choose this option as the unit is being created.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains Restricted management administrative unit in context, with comparison tables and the common traps.
Terms in this definition
- AMPRS
An acronym for availability, manageability, performance, recoverability and security: the five design qualities used to sort non-functional requirements and to weigh up trade-offs between design decisions.
- Role
How an actor normally or expectedly behaves, or the part a person takes in a process. A single actor may hold more than one role.
- AGDLP
Nesting pattern: users go into global groups, which go into domain local groups, which receive the permissions. AGUDLP adds universal groups for forests with several domains.
See Restricted management administrative unit in the full glossary