Most small and mid-sized businesses give their help desk far more power than it needs. Someone needs to reset passwords, so they get User Administrator or Helpdesk Administrator across the whole tenant, which means they can also reset the CEO’s password. Entra administrative units fix this by limiting a role to a defined set of users, groups or devices. Your help desk keeps the rights it needs for the people it supports, and nothing more.
What administrative units are
An administrative unit is a container in Microsoft Entra ID that can hold users, groups or devices. When you assign a role scoped to an administrative unit, that role only applies to the objects inside it. If you assign a role without a scope, it applies to the whole tenant.
Common ways to divide a tenant:
By location: a “Chicago office” unit so the local IT person manages only Chicago staff.
By business unit or subsidiary: each company in a group manages its own users.
By support tier: front-line help desk manages standard staff, while a smaller team handles executives.
Users can belong to more than one administrative unit, so a user can be in both “Chicago” and “Finance”. Administrative units cannot be nested.
Licensing
Creating administrative units works with Microsoft Entra ID Free. Each administrator who is assigned a role scoped to an administrative unit needs a Microsoft Entra ID P1 license. Members only need Entra ID Free, unless you use dynamic membership rules for the unit, in which case each member needs P1. Business Premium, E3 and E5 include P1.
What a scoped role can and cannot do
Scoping has some built-in protections that are worth understanding before you design anything.
Action
Scoped Helpdesk or User Administrator
Reset passwords for standard users in the unit
Yes
Reset passwords for users in the unit who hold admin roles
No
Manage authentication methods for standard users in the unit
Yes, with the Authentication Administrator role
Manage users outside the unit
No
Manage a group’s name and membership when the group is in the unit
Yes
Manage the members of a group in the unit
Only if those users are also added to the unit directly
That last row catches people out. Adding a group to an administrative unit brings the group object into scope, not the people in it. If you want the help desk to manage the users, add the users themselves, or use a dynamic membership rule that adds them automatically.
Setting up a help desk administrative unit
Here is a simple design that works for many businesses: one unit containing all standard staff, managed by the help desk, with executives and admins kept out of it.
Sign in to the Microsoft Entra admin center as at least a Privileged Role Administrator.
Go to Entra ID > Roles & admins > Admin units and select Add.
Name it, for example AU-StandardStaff.
Choose the membership type. For automation, use dynamic membership with a rule such as (user.userType -eq "Member") -and (user.department -ne "Executive"). Make sure the attribute in the rule is controlled by HR or IT, not by users.
On the role assignment step, assign Helpdesk Administrator (password resets) and, if needed, Authentication Administrator (MFA method resets) to your help desk staff or a role-assignable group.
Remove any tenant-wide Helpdesk or User Administrator assignments those staff had before.
Test with a help desk account: reset a standard user’s password (should work), then try an executive (should fail).
If you use Privileged Identity Management, make the scoped assignments eligible rather than permanent, so help desk staff activate the role when they start a shift.
Write the design down. A short table listing each unit, how membership is decided, which roles are scoped to it and who holds them is enough. It answers the auditor’s question of who can reset whose password, and it gives the next IT manager a map instead of a puzzle.
Restricted management administrative units for VIPs
Ordinary administrative units limit what scoped admins can do. They do not stop tenant-wide admins. If a Global Administrator or tenant-wide User Administrator exists, they can still manage everyone.
Restricted management administrative units go further. Objects placed in one can only be modified by administrators assigned a role scoped to that specific unit. Even a Global Administrator cannot change those objects without first assigning themselves a scoped role, which is recorded in the audit logs. Use them for:
Executive accounts, so no help desk technician can reset the CEO’s password or read their BitLocker recovery key.
Sensitive security groups that control access to finance, HR or legal data.
Devices belonging to senior leadership.
The restricted setting is chosen when you create the unit, and applications with Microsoft Graph application permissions cannot modify objects inside it unless they are given a scoped role. Licensing is the same: P1 for each administrator of the unit.
Gotchas and design tips
Conditional Access role targeting ignores scoped roles. Policies that target directory roles do not apply to administrative unit-scoped assignments. Target your help desk group directly in any policy that requires phishing-resistant MFA for admins.
Assign roles to groups, not people. Use a role-assignable group for your help desk and scope the role to the unit. Adding or removing a technician then becomes a group membership change instead of a role change.
Dynamic units need clean attributes. If membership is based on department or office, an empty or misspelled value silently leaves a user outside the unit, and the help desk will not be able to help them. Check for users who belong to no unit at all.
Keep the design simple. Two or three units are easier to run than twenty. Start with standard staff and VIPs, then add locations only if they have their own IT staff.
Pair with Intune scope tags. If local IT also manages devices, use Intune scope tags and role-based access control so device permissions match the same boundaries. Our Intune managed service sets these up together.
Audit regularly. Review who holds scoped roles and who still holds tenant-wide ones. The goal is that very few people need tenant-wide rights at all.
Can an administrative unit contain other administrative units?
No. Administrative units cannot be nested. If you need several levels, use separate units and assign roles to each, or rely on users being members of more than one unit.
Can a scoped help desk admin reset another admin’s password?
No. When a role is scoped to an administrative unit, password resets and authentication method changes only work for non-administrator users. Admin accounts in the unit are protected from scoped admins.
What is the difference between an administrative unit and a restricted management administrative unit?
A normal administrative unit limits what scoped admins can manage but still lets tenant-wide admins manage everything. A restricted management unit blocks tenant-wide admins too, so only admins assigned to that specific unit can modify its objects.
Does your help desk have more access than it needs? Book a free Microsoft 365 security assessment and we will map your admin roles and show you where administrative units can cut the risk.
Most small and mid-sized businesses give their help desk far more power than it needs. Someone needs to reset passwords, so they get User Administrator or Helpdesk Administrator across the whole tenant, which means they can also reset the CEO’s password. Entra administrative units fix this by limiting a role to a defined set of users, groups or devices. Your help desk keeps the rights it needs for the people it supports, and nothing more.
What administrative units are
An administrative unit is a container in Microsoft Entra ID that can hold users, groups or devices. When you assign a role scoped to an administrative unit, that role only applies to the objects inside it. If you assign a role without a scope, it applies to the whole tenant.
Common ways to divide a tenant:
Users can belong to more than one administrative unit, so a user can be in both “Chicago” and “Finance”. Administrative units cannot be nested.
Licensing
Creating administrative units works with Microsoft Entra ID Free. Each administrator who is assigned a role scoped to an administrative unit needs a Microsoft Entra ID P1 license. Members only need Entra ID Free, unless you use dynamic membership rules for the unit, in which case each member needs P1. Business Premium, E3 and E5 include P1.
What a scoped role can and cannot do
Scoping has some built-in protections that are worth understanding before you design anything.
That last row catches people out. Adding a group to an administrative unit brings the group object into scope, not the people in it. If you want the help desk to manage the users, add the users themselves, or use a dynamic membership rule that adds them automatically.
Setting up a help desk administrative unit
Here is a simple design that works for many businesses: one unit containing all standard staff, managed by the help desk, with executives and admins kept out of it.
Entra ID > Roles & admins > Admin unitsand select Add.(user.userType -eq "Member") -and (user.department -ne "Executive"). Make sure the attribute in the rule is controlled by HR or IT, not by users.If you use Privileged Identity Management, make the scoped assignments eligible rather than permanent, so help desk staff activate the role when they start a shift.
Write the design down. A short table listing each unit, how membership is decided, which roles are scoped to it and who holds them is enough. It answers the auditor’s question of who can reset whose password, and it gives the next IT manager a map instead of a puzzle.
Restricted management administrative units for VIPs
Ordinary administrative units limit what scoped admins can do. They do not stop tenant-wide admins. If a Global Administrator or tenant-wide User Administrator exists, they can still manage everyone.
Restricted management administrative units go further. Objects placed in one can only be modified by administrators assigned a role scoped to that specific unit. Even a Global Administrator cannot change those objects without first assigning themselves a scoped role, which is recorded in the audit logs. Use them for:
The restricted setting is chosen when you create the unit, and applications with Microsoft Graph application permissions cannot modify objects inside it unless they are given a scoped role. Licensing is the same: P1 for each administrator of the unit.
Gotchas and design tips
Microsoft’s overview of administrative units in Microsoft Entra ID lists every role that supports administrative unit scope. For help designing delegated admin across Entra ID, Intune and Microsoft 365, our Microsoft 365 security assessment reviews current role assignments, and the NIST CSF assessment maps least privilege controls for compliance.
Frequently asked questions
Can an administrative unit contain other administrative units?
No. Administrative units cannot be nested. If you need several levels, use separate units and assign roles to each, or rely on users being members of more than one unit.
Can a scoped help desk admin reset another admin’s password?
No. When a role is scoped to an administrative unit, password resets and authentication method changes only work for non-administrator users. Admin accounts in the unit are protected from scoped admins.
What is the difference between an administrative unit and a restricted management administrative unit?
A normal administrative unit limits what scoped admins can manage but still lets tenant-wide admins manage everything. A restricted management unit blocks tenant-wide admins too, so only admins assigned to that specific unit can modify its objects.
Does your help desk have more access than it needs? Book a free Microsoft 365 security assessment and we will map your admin roles and show you where administrative units can cut the risk.