Administrative Units

Audience: Platform Engineering, Identity & Access Management, Distributed Unit Administrators

Scope: Structure and management of Administrative Units (AUs) for delegated administration

Out of scope: Azure resource scoping, Conditional Access policies

Quick Reference

What is an Administrative Unit?

An Administrative Unit (AU) is a container in Entra ID that restricts administrative permissions to a specific portion of the organization. Think of it as a "scope boundary" for delegated administration.

Key Concepts

Why We Use AUs

1. Least Privilege: Unit admins can only manage their own groups
2. Self-Service: Units can create/modify their scope groups without IT intervention
3. Separation of Duties: Prevents cross-unit interference
4. Audit Trail: Clear ownership of group management actions

AU Naming Convention

AU-[SCOPE]

Examples:

• AU-CLEN — College of Engineering
• AU-IT — Division of Technology Services
• AU-OAL — Open Access Labs

Special AUs

AU Architecture

Current State: Group Scoping

graph TD
    subgraph "Administrative Unit: AU-CLEN"
        DSG["DSG - CLEN - Managed Workstations"]
        USG["USG - CLEN - Endpoint Admins"]
        ESG["ESG - CLEN - Standard Experience"]
        RSG["RSG - CLEN - Endpoint Operator"]
    end
    
    Admin["Unit Admin\n(Groups Administrator)"] -->|Scoped to AU-CLEN| DSG
    Admin -->|Scoped to AU-CLEN| USG
    Admin -->|Scoped to AU-CLEN| ESG
    Admin -->|Scoped to AU-CLEN| RSG
    
    GlobalAdmin["Platform Engineering\n(Global Admin)"] -->|Full Access| DSG
    GlobalAdmin --> USG
    GlobalAdmin --> ESG
    GlobalAdmin --> RSG

How it works:

1. All scope groups (DSG, USG, ESG, RSG, FSG, CSG) are created inside the unit's AU
2. Unit admins are assigned "Groups Administrator" scoped to their AU
3. Unit admins can create, modify, and delete groups within their AU
4. Unit admins cannot see or modify groups outside their AU

Future State: Device Scoping

graph TD
    subgraph "Administrative Unit: AU-CLEN-Devices"
        Devices["College of Engineering\nManaged Devices"]
    end
    
    DeviceAdmin["Unit Device Admin\n(Cloud Device Administrator)"] -->|Scoped to AU-CLEN-Devices| Devices

Planned capabilities:

• Scope Cloud Device Administrator to unit devices only
• Scope Intune Administrator actions to AU members
• Enable device wipe/reset delegation without full tenant access

Creating an Administrative Unit

Prerequisites

PowerShell Script

# Connect to Microsoft Graph
Connect-MgGraph -Scopes "AdministrativeUnit.ReadWrite.All"

# Variables - UPDATE THESE
$scopeTag = "CLEN"
$description = "College of Engineering"

# Create the Administrative Unit
$params = @{
    displayName = "AU-$scopeTag"
    description = $description
    visibility = "HiddenMembership"
}

$au = New-MgDirectoryAdministrativeUnit -BodyParameter $params
Write-Host "Created AU: $($au.DisplayName) with ID: $($au.Id)"

Entra Portal Steps

1. Navigate to Entra ID → Roles and administrators → Admin units
2. Click + Add
3. Configure:
   • Name: AU-[SCOPE] (e.g., AU-CLEN)
   • Description: Unit full name
   • Restricted management: No (unless special case)
   • Membership type: Assigned
4. Click Create

Assigning Groups to an AU

All scope groups must be assigned to their unit's AU at creation time.

PowerShell Script

# Connect to Microsoft Graph
Connect-MgGraph -Scopes "AdministrativeUnit.ReadWrite.All", "Group.ReadWrite.All"

# Variables - UPDATE THESE
$scopeTag = "CLEN"
$groupName = "DSG - CLEN - Managed Workstations"
$groupDescription = "All CLEN-managed Windows workstations"

# Get the AU
$au = Get-MgDirectoryAdministrativeUnit -Filter "displayName eq 'AU-$scopeTag'"

if (-not $au) {
    Write-Error "AU-$scopeTag not found. Create the AU first."
    exit 1
}

# Create the group
$groupParams = @{
    displayName = $groupName
    description = $groupDescription
    mailEnabled = $false
    mailNickname = ($groupName -replace '\s', '-')
    securityEnabled = $true
    groupTypes = @()
}

$group = New-MgGroup -BodyParameter $groupParams
Write-Host "Created group: $($group.DisplayName)"

# Add group to AU
$memberParams = @{
    "@odata.id" = "https://graph.microsoft.com/v1.0/groups/$($group.Id)"
}

New-MgDirectoryAdministrativeUnitMemberByRef -AdministrativeUnitId $au.Id -BodyParameter $memberParams
Write-Host "Added $($group.DisplayName) to $($au.DisplayName)"

Delegating Administration

Assigning Scoped Roles

To delegate group management to a unit admin:

# Connect to Microsoft Graph
Connect-MgGraph -Scopes "RoleManagement.ReadWrite.Directory", "AdministrativeUnit.Read.All"

# Variables - UPDATE THESE
$scopeTag = "CLEN"
$adminUpn = "jsmith@tamu.edu"

# Get the AU
$au = Get-MgDirectoryAdministrativeUnit -Filter "displayName eq 'AU-$scopeTag'"

# Get the user
$user = Get-MgUser -Filter "userPrincipalName eq '$adminUpn'"

# Get the Groups Administrator role
$role = Get-MgRoleManagementDirectoryRoleDefinition -Filter "displayName eq 'Groups Administrator'"

# Create the scoped role assignment
$assignmentParams = @{
    "@odata.type" = "#microsoft.graph.unifiedRoleAssignment"
    principalId = $user.Id
    roleDefinitionId = $role.Id
    directoryScopeId = "/administrativeUnits/$($au.Id)"
}

New-MgRoleManagementDirectoryRoleAssignment -BodyParameter $assignmentParams
Write-Host "Assigned Groups Administrator to $adminUpn scoped to AU-$scopeTag"

Available Scoped Roles

Onboarding Checklist

When onboarding a new unit, ensure these AU-related steps are completed:

Troubleshooting

# Check role assignments for a user
$user = Get-MgUser -Filter "userPrincipalName eq 'admin@tamu.edu'"
Get-MgRoleManagementDirectoryRoleAssignment -Filter "principalId eq '$($user.Id)'" | 
    Select-Object RoleDefinitionId, DirectoryScopeId

$au = Get-MgDirectoryAdministrativeUnit -Filter "displayName eq 'AU-CLEN'"
$group = Get-MgGroup -Filter "displayName eq 'DSG - CLEN - Managed Workstations'"

$memberParams = @{
    "@odata.id" = "https://graph.microsoft.com/v1.0/groups/$($group.Id)"
}

New-MgDirectoryAdministrativeUnitMemberByRef -AdministrativeUnitId $au.Id -BodyParameter $memberParams

Related Resources

• Scope Groups & Naming — Group naming conventions
• Custom RBAC Roles — Intune RBAC roles
• Workstation Onboarding — Full onboarding process
• Microsoft Docs: Administrative Units — Official documentation