Many organizations delegate Helpdesk roles to IT teams for routine user management, such as resetting passwords, changing authentication methods and updating user details. But what if you don’t want those teams to have access to sensitive accounts, such as your C-level executives?
That’s exactly what administrative units (AUs) in Microsoft Entra ID are for.
What are administrative units?
Administrative units are logical containers in Entra ID that let you scope role-based access to a subset of users, groups or devices. A role assigned through an AU applies only to the members of that AU.
But a regular AU doesn’t protect its members: a tenant-wide Helpdesk Administrator can still reset their passwords. To keep the Helpdesk away from executive accounts you need a restricted management administrative unit, where only admins assigned a role on that AU can change its members.
This means you can:
- Split admin responsibilities by geography, department or user type.
- Limit Helpdesk access to a defined set of users.
- Prevent unintended changes or data exposure for sensitive accounts.
A real-world use case: Helpdesk and executive protection
Say your organization wants Helpdesk staff to support employees, but explicitly not to manage executives. Here’s how:
- Create a restricted management administrative unit. For example ExecUsers_AU. Select Restricted management administrative unit when you create it (you can’t change it later), and add only the sensitive users: CEO, CFO, legal, board members.
- Assign scoped roles to a trusted Helpdesk subgroup. Create a small, approved Helpdesk group (for example Helpdesk_Exec_Team) and give it the Helpdesk Administrator or Authentication Administrator role, scoped only to ExecUsers_AU.
- Don’t give the general Helpdesk access. The rest of the team gets no roles scoped to this AU. Even with Helpdesk Administrator across the whole tenant, they can’t change the users in it.
The result:
- Only the selected Helpdesk staff can reset passwords, change authentication methods or edit the sensitive users.
- Tenant-wide admins, including Global Administrators, can’t change them without assigning themselves a role on the AU, and that assignment is recorded in the audit log.
- You enforce least privilege and reduce the risk of error or misuse.
Why this matters
By splitting users into AUs and assigning roles accordingly, you:
- Reduce the risk of human error or insider threat.
- Follow the principle of least privilege.
- Make sure executive accounts stay untouched unless explicitly permitted.
The bottom line
This capability is especially powerful in regulated industries, in organizations with tiered IT support and in any environment with strict identity governance needs. If you haven’t scoped your Helpdesk permissions yet, this is a great place to start.
Want to know who has broader admin rights than they need? Griffin31 checks your tenant’s settings continuously and shows you what to fix first.