Administrative Units

Administrative units help us subdivide our organization into any unit that we want, and then we can assign specific administrators who can manage members of the given unit. An administrative unit is an Entra ID resource that acts as a container for other Entra ID resources. Administrative units help restrict permissions in the roles that we define for our organization, and they can only contain users, groups, or devices.

We can use administrative units to delegate the help desk administrator role to regional support specialists so they can manage users only in the region that they support. We can even create custom roles to limit or add capabilities to the roles as needed. This provides us with a good deal of control.