DevOps PeachEntra roles such as User Administrator apply to the whole tenant by default. An Administrative Unit (AU) is a container of users, groups or devices so you can assign a role only within that AU — for example letting the Hanoi IT team reset passwords for Hanoi staff without touching users in other branches.
flowchart TB T["Tenant example.com"] --> A1["AU Ops-HN<br/>users HN"] T --> A2["AU Ops-HCM<br/>users HCM"] R1["IT HN<br/>User Administrator<br/>scope: AU Ops-HN"] --> A1 R2["IT HCM<br/>Helpdesk Administrator<br/>scope: AU Ops-HCM"] --> A2
Process
- Create the AU (Entra admin center → Roles & admins → Admin units).
- Add users, groups or devices to the AU (by hand or with a dynamic rule).
- Assign a suitable role (User Administrator, Helpdesk Administrator…) with the AU as scope.
- Assign that role to the group's administrators.
Notes
- Adding a group to an AU brings only the group object into scope, not its members; to manage each user's password, add the users directly.
- AUs cannot be nested and are not OUs: no GPOs, no directory tree.
- Licensing: creating AUs works on Free; each admin assigned a role scoped to an AU needs P1; dynamic rules for AUs need P1 for members.
- The Azure CLI has no dedicated command group for AUs; manage them in the portal, with Microsoft Graph PowerShell or the Graph API.
| Command | Meaning |
|---|---|
az ad group member list --group devops-team -o table |
See a group's members before deciding which users to add to an AU |
Typical designs
AUs are usually cut along the lines of who supports whom:
| Split | Example |
|---|---|
| Geography | One AU per branch or country |
| Department | Finance, Engineering, Sales |
| Institution | One AU per school in an education tenant |
Membership can be assigned or dynamic. A dynamic rule such as user.city -eq "Hanoi" keeps the AU current as people join or move, provided the attribute is maintained in HR or AD.
Restricted management AUs
A restricted management AU protects its members even from tenant-level admins: only administrators assigned at the AU scope can change them. It suits sensitive accounts such as executives or break-glass accounts. The setting must be chosen when the AU is created.
AU scope versus Azure RBAC scope
AUs limit Entra roles (who can manage users, groups, devices). They have no effect on Azure resources: rights on VMs or storage still come from Azure RBAC at management group, subscription, resource group, or resource scope. Keep the two models apart when you design delegated administration.
Managing AUs from code
With Microsoft Graph PowerShell, New-MgDirectoryAdministrativeUnit creates an AU and New-MgDirectoryAdministrativeUnitMemberByRef adds members. Scripted creation keeps branch AUs consistent and is easier to review than many portal clicks.
Combine AU-scoped roles with Privileged Identity Management where licensed, so local admins activate their role only when needed.