Skip to content
Menu
ChrisOnSecurity
  • Blog
  • Microsoft Security portals
  • Presentations
  • GitHub
  • About me
  • Impressum
  • Disclaimer
ChrisOnSecurity

Getting started with Azure AD Administrative Units

Posted on 20. April 202020. April 2020

Azure AD always had a big advanced over on-premises Active Directory: a very granular RBAC approach when it come to administration. However, there is also a downside – roles can only be applied globally without a limited scope. This has changed now. Being in a PowerShell based preview for quite some time, Azure AD Administrative Units (AUs) can now be easily defined via the Azure Portal.

This enables administrators to cluster users and groups, and delegate administrative access to entities inside a particular AU only.

Configure Administrative Units via GUI

Administrative Units can now be found in Azure Active Directory:

Creating them is quite easy by setting a name and description. After that, they appear right away in the AU list:

Each AU consists of users, groups, and the corresponding roles and administrators:

You can then go ahead and add users and groups to the AU:

Each AU also has its own set of administrators. Those are:

  • Authentication administrators
  • Groups administrators
  • Helpdesk administrators
  • License administrators
  • Password administrators
  • User administrator

Each role is independent from the global ones in Azure AD. So you can easily delegate administrative access to users that should only administer a certain AU.

The role also appears on the user’s Azure AD profile and it luckily also indicates in which AU the role was assigned:

Now, my test user Geralt can edit resources from the MAIN AU, but not other groups and user:

Summing things up

The Azure AD RBAC model has been not flexible enough to delegate administrative access to only certain entities. Administrative Units are now a great solution for that problem.

You might have noticed that AUs only contain users and groups at the moment. Of course, there are other elements that should be considered – mainly regarding device management in Intune. Luckily, Intune already has support for customized RBAC roles:

So, Administrative Units and Intune roles can be used in combination to delegate most tasks for local branch offices.

Thanks for reading!

Chris

@ChrisOnSecurity@infosec.exchange

Recent posts

  • What’s new: Microsoft 365 Security & Compliance December 2022
  • What’s new: Microsoft 365 Security & Compliance November 2022
  • Counter MFA spam attacks with Azure Active Directory
  • Windows 11 security – a first look
  • Conditional Access – device identification using certificates

@ChrisOnSecurity

Tweets by ChrisOnSecurity

Recent posts

  • What’s new: Microsoft 365 Security & Compliance December 2022
  • What’s new: Microsoft 365 Security & Compliance November 2022
  • Counter MFA spam attacks with Azure Active Directory
  • Windows 11 security – a first look
  • Conditional Access – device identification using certificates

Tags

Administration Administrative Units Android AV Azure Active Directory Azure AD Azure Sentinel Client Security Conditional Access Conditional Access App Control Defender ATP Delegation EDR EMS Enterprise Mobility + Security Identity Protection Information Protection & Compliance Linux M365 M365 E3 Mail Security MCAS MDAPT MDATP MFA Microsoft 365 Microsoft 365 E3 Microsoft 365 Security Microsoft Cloud App Security Microsoft Defender ATP Microsoft Ignite Mobile Security Monitoring Network Control Office 365 Office ATP passwordless Perimeter Security Baseline Session Control Sysmon Unified Incidents User submissions Web Content Filtering Windows 10 Enterprise
©2023 ChrisOnSecurity | WordPress Theme by Superbthemes.com
We use cookies on our website to give you the most relevant experience by remembering your preferences and repeat visits. By clicking “Accept”, you consent to the use of ALL the cookies.
Cookie settingsACCEPT
Manage consent

Privacy Overview

This website uses cookies to improve your experience while you navigate through the website. Out of these, the cookies that are categorized as necessary are stored on your browser as they are essential for the working of basic functionalities of the website. We also use third-party cookies that help us analyze and understand how you use this website. These cookies will be stored in your browser only with your consent. You also have the option to opt-out of these cookies. But opting out of some of these cookies may affect your browsing experience.
Necessary
Always Enabled
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
Non-necessary
Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.
SAVE & ACCEPT