Administrative units in Microsoft Entra ID

Administrative units in Microsoft Entra ID

An administrative unit is a Microsoft Entra resource that can be a container for other Microsoft Entra resources.

An administrative unit can contain only users, groups, or devices.

Constraints

Here are some of the constraints for administrative units.

• Administrative units can't be nested.

• Administrative units are currently not available in Microsoft Entra ID Governance.

Permission

Privileged Role Administrator, you can use the Microsoft Entra admin center to:

• Create administrative units

• Add users, groups, or devices as members of administrative units

• Manage users or devices for an administrative unit with rules for dynamic membership groups

• Assign IT staff to administrative unit-scoped administrator roles.

Additional resources

Administrative units in Microsoft Entra ID

Create or delete administrative units

Add users, groups, or devices to an administrative unit

Manage users or devices for an administrative unit with rules for dynamic membership groups

Manage rules for dynamic membership groups in Microsoft Entra ID

Rules for devices