# Restricted management administrative units: protect executive and admin accounts > Create a restricted management administrative unit in Microsoft Entra ID, add sensitive users, devices and groups, and limit who can modify them. Source: https://www.epifive.com/blog/restricted-management-administrative-units · Published 2026-10-17 · EpiFive A restricted management administrative unit (restricted management AU) is a Microsoft Entra administrative unit that blocks everyone except the administrators you explicitly assign to it from changing its members. Create one with the restricted setting switched on, add the accounts, devices or security groups you want to shield, and then assign a small set of administrators with a role scoped to that unit. Tenant-wide administrators, including Global Administrators, can no longer change the Microsoft Entra properties of those objects. ## Who this is for and what you will have at the end This guide is for identity administrators who need to protect a small set of sensitive objects, such as executive accounts and their devices, or security groups that grant access to sensitive applications, without removing existing tenant-level role assignments from the helpdesk and group administrators. By the end you will have created a restricted management AU, added members to it, assigned a scoped role to a trusted administrator, confirmed that tenant-level administrators are blocked, and learned the limitations that tend to break existing workflows. You will also know how to find the changes in the audit log and how to recover when the scoped administrator leaves. ## What problem restricted management solves Microsoft's documentation gives two examples of the exposure. A Helpdesk Administrator can potentially gain access to a CEO's account by resetting its password, and a tenant-level Groups Administrator can add users to security groups that grant access to financial data in SharePoint. A normal administrative unit does not fix this, because tenant-scoped roles still apply to the unit's members. Restricted management is designed for exactly this case: it protects specific objects from modification by anyone other than the people you designate. The documented use cases are: - Protecting executive accounts and their devices from Helpdesk Administrators who would otherwise reset passwords or read BitLocker recovery keys. - Implementing a compliance control so that certain resources can only be managed by administrators in a specific country or region. - Restricting management of security groups that control access to sensitive applications to specific administrators. Even Global Administrators cannot modify the objects unless they explicitly assign themselves to a role scoped to the restricted unit, which is an auditable event. ### Regular versus restricted administrative units | Behaviour | Regular administrative unit | Restricted management administrative unit | | --- | --- | --- | | Purpose | Delegate admin rights over a subset of objects | Protect objects from everyone except designated admins | | Tenant-scoped roles still apply to members | Yes | No, they are blocked | | Supported members | Users, devices, and all group types | Users, devices and security groups only | | Setting can be changed after creation | Not applicable | No, it must be set at creation | | Tenant limit | Not covered here | 100 restricted units | ## Prerequisites - A Microsoft Entra ID P1 licence for each administrator of the restricted unit, and Microsoft Entra ID Free licences for the members. - The Privileged Role Administrator role to create the unit, add members and assign scoped roles. Global Administrator and Privileged Role Administrator can both manage restricted units, but neither can modify the objects inside them. - The Microsoft Graph PowerShell module if you use the scripts below. - Two working emergency access accounts that are not members of the unit. See [Break-glass accounts and Conditional Access](https://www.epifive.com/blog/conditional-access-break-glass-accounts). - A list of the objects to protect, and a list of the people who legitimately need to manage them. Before you start, read the limitations section further down. Placing objects in a restricted unit severely restricts who can change them, and Microsoft warns that this can break existing workflows. ## Step 1: Create the restricted management administrative unit ### Using the admin center 1. Sign in to the Microsoft Entra admin center as at least a Privileged Role Administrator. 2. Browse to **Entra ID** > **Roles & admins** > **Admin units**. 3. Select **Add**. 4. Enter a **Name** and, optionally, a description. 5. Set the **Restricted management administrative unit** toggle to **Yes**. 6. Optionally, on the **Assign roles** tab, select a role and the users to assign it to with this unit's scope. 7. On **Review + create**, check the settings and select **Create**. Setting the toggle is the only chance you get. The restricted setting cannot be changed after the unit exists. ### Using Microsoft Graph PowerShell Connect with the permission needed to write administrative units, then create the unit with the `IsMemberManagementRestricted` property set to `$true`. ```powershell Connect-MgGraph -Scopes "AdministrativeUnit.ReadWrite.All" $params = @{ DisplayName = "Contoso Executive Division" Description = "Contoso Executive Division administration" Visibility = "HiddenMembership" IsMemberManagementRestricted = $true } $restrictedAU = New-MgDirectoryAdministrativeUnit -BodyParameter $params ``` `Visibility = "HiddenMembership"` is the value Microsoft uses in its example. ### Using Microsoft Graph The equivalent request sets `isMemberManagementRestricted` to `true`: ```http POST https://graph.microsoft.com/v1.0/directory/administrativeUnits { "displayName": "Contoso Executive Division", "description": "This administrative unit contains executive accounts of Contoso Corp.", "isMemberManagementRestricted": true } ``` ## Step 2: Add members to the unit Only users, devices and security groups can be members of a restricted unit. Adding a group to an administrative unit brings the group object itself into the unit's management scope, but not the members of that group. If you want to protect the people in a group, add the users individually. ### Admin center 1. Browse to **Entra ID** > **Roles & admins** > **Admin units** and select the unit. 2. Select **Users**, **Groups** or **Devices**. 3. Select **Add member**, **Add** or **Add device**, choose the objects in the **Select** pane and select **Select**. For many users, open the unit, select **Users** > **Bulk operations** > **Bulk add members**, download the CSV template, add one user principal name per row without removing the first two template rows, upload the file and select **Submit**. You can also start from the object: open the user, group or device, select **Administrative units** and then **Assign to administrative unit**. ### PowerShell ```powershell $adminUnitObj = Get-MgDirectoryAdministrativeUnit -Filter "DisplayName eq 'Contoso Executive Division'" # Add a user $userObj = Get-MgUser -Filter "UserPrincipalName eq 'ceo@contoso.com'" $odataId = "https://graph.microsoft.com/v1.0/users/" + $userObj.Id New-MgDirectoryAdministrativeUnitMemberByRef -AdministrativeUnitId $adminUnitObj.Id -OdataId $odataId # Add a security group $groupObj = Get-MgGroup -Filter "DisplayName eq 'Finance Data Access'" $odataId = "https://graph.microsoft.com/v1.0/groups/" + $groupObj.Id New-MgDirectoryAdministrativeUnitMemberByRef -AdministrativeUnitId $adminUnitObj.Id -OdataId $odataId ``` To add a device, build the reference from the device object ID in the same way: `https://graph.microsoft.com/v1.0/devices/{device-id}`. ### Graph API ```http POST https://graph.microsoft.com/v1.0/directory/administrativeUnits/{admin-unit-id}/members/$ref { "@odata.id": "https://graph.microsoft.com/v1.0/users/{user-id}" } ``` Use the same request with a `groups` or `devices` path in `@odata.id` for those object types. ## Step 3: Assign a scoped administrator Once objects are in the restricted unit, tenant-level helpdesk roles stop working on them. Someone must be able to manage the objects, so assign a role scoped to the unit. Only roles that support administrative unit scope can be used. Among them are Helpdesk Administrator, Password Administrator, Authentication Administrator, User Administrator, Groups Administrator, License Administrator and Cloud Device Administrator, plus custom roles that include at least one permission relevant to users, groups or devices. Pick the narrowest role that covers the job. For an executive support desk that only resets passwords, Helpdesk Administrator or Password Administrator is enough. For the wider thinking behind role choice, see [Least-privilege Entra admin roles](https://www.epifive.com/blog/entra-admin-roles-least-privilege). ### Admin center 1. Browse to **Entra ID** > **Roles & admins** > **Admin units** and select the unit. 2. Select **Roles and administrators** and then select the role. 3. Select **Add assignments**, choose the users or role-assignable groups, and select **Add**. ### PowerShell ```powershell Connect-MgGraph -Scopes "Directory.Read.All","RoleManagement.Read.Directory","User.Read.All","RoleManagement.ReadWrite.Directory" $user = Get-MgUser -Filter "userPrincipalName eq 'execsupport@contoso.com'" $roleDefinition = Get-MgRoleManagementDirectoryRoleDefinition -Filter "displayName eq 'Helpdesk Administrator'" $adminUnit = Get-MgDirectoryAdministrativeUnit -Filter "displayName eq 'Contoso Executive Division'" $directoryScope = '/administrativeUnits/' + $adminUnit.Id $roleAssignment = New-MgRoleManagementDirectoryRoleAssignment ` -DirectoryScopeId $directoryScope -PrincipalId $user.Id ` -RoleDefinitionId $roleDefinition.Id ``` The scope string matters. `/administrativeUnits/` means the principal can manage the members of the unit according to the assigned role. It does not let them manage the unit itself. ### Graph API ```http POST https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignments { "@odata.type": "#microsoft.graph.unifiedRoleAssignment", "principalId": "", "roleDefinitionId": "", "directoryScopeId": "/administrativeUnits/" } ``` A role that does not support this scope returns `400 Bad Request` with the message "The given built-in role is not supported to be assigned to a single resource scope." ### Scoped roles only act on non-administrators Certain permissions apply only to users who hold no administrator role when the role is assigned at administrative unit scope. A scoped Helpdesk Administrator can reset the password of a user in the unit only if that user has no administrator role. The restricted actions include reading and modifying authentication methods, resetting passwords, modifying sensitive properties such as phone numbers and alternate email addresses, and deleting or restoring accounts. If you put an administrator account in the unit, a scoped Helpdesk Administrator will not be able to manage it. The Privileged Authentication Administrator role can view, set and reset authentication methods for any user, administrator or not. ### Service principals and guest users Service principals and guest users cannot use a role assignment scoped to an administrative unit unless they also have permission to read the objects. Assign the Directory Readers role, or another role with read permissions, at tenant scope. Directory read permissions cannot currently be scoped to an administrative unit. ## What is blocked and what still works For administrators who are not assigned at the unit's scope, the restriction applies to operations that change the Microsoft Entra properties of the objects. Operations on related objects in Microsoft 365 services are not affected. | Operation | Result for tenant-scoped admins | | --- | --- | | Read standard properties such as user principal name or photo | Allowed | | Modify any Microsoft Entra property of the user, group or device | Blocked | | Delete the user, group or device | Blocked | | Update a user's password | Blocked | | Modify group owners or members | Blocked | | Add the object to other groups in Microsoft Entra ID | Allowed | | Modify email and mailbox settings in Exchange | Allowed | | Apply policies to a device with Intune | Allowed | | Add or remove a group as a SharePoint site owner | Allowed | | Assign licences and update usage location | Allowed | Two points deserve attention. First, the restriction covers the Entra object only. Mailbox settings, Intune device policy and licence assignment continue to work for the roles that normally hold them, so a restricted unit is not a complete lockdown of an executive's account. Second, owners of groups or devices that you add to the unit lose the ability to manage them, as do roles assigned directly on the resource. A role scoped to a different restricted unit that also contains the object does work. A role scoped to a different regular administrative unit that contains the object does not. ## Verification 1. Sign in to the Microsoft Entra admin center as a tenant-scoped administrator, such as a Helpdesk Administrator who is not assigned to the unit, and open one of the protected users. The **Overview** page shows: "This user is a member of a restricted management administrative unit. Management rights are limited to administrators scoped on that administrative unit." For groups the message appears on the **Members** page. 2. Try a password reset as that administrator. It should be blocked. 3. Sign in as the scoped administrator you assigned in Step 3 and repeat the reset. It should succeed for a non-administrator user. 4. Confirm the unit's setting with PowerShell: ```powershell Get-MgDirectoryAdministrativeUnit -Filter "DisplayName eq 'Contoso Executive Division'" | Select-Object DisplayName, IsMemberManagementRestricted ``` 5. Check the audit log. Creating the unit is recorded as **Add administrative unit** in the AdministrativeUnit category with `IsMemberManagementRestricted` = true. Adding or removing members is recorded as **Add member to restricted management administrative unit** and **Remove member from restricted management administrative unit**. Role changes appear in the RoleManagement category as **Add member to role scoped over Restricted Management Administrative Unit** and the matching removal activity. For long-term retention, see [Send Entra sign-in and audit logs to Log Analytics](https://www.epifive.com/blog/entra-logs-log-analytics-retention). ## Limitations that break workflows Review these before moving production objects. - **No conversion.** The restricted setting is fixed at creation. - **No Entra ID Governance features.** Groups and users in a restricted unit cannot be managed with Privileged Identity Management, entitlement management, lifecycle workflows or access reviews. Do not put groups that you manage with PIM for Groups into a restricted unit. See [PIM for Groups and access reviews](https://www.epifive.com/blog/pim-for-groups-access-reviews) for what you would lose. - **Public groups.** If a group's visibility is `Public`, users can join it with self-service group membership. Microsoft does not recommend public membership for groups in restricted units and describes this as a temporary limitation. - **Role-assignable groups.** Their membership cannot be modified once they are in the unit. Group owners cannot manage them, and only Global Administrators and Privileged Role Administrators, neither of which can be assigned at unit scope, can modify membership. - **Administrator accounts as members.** A Global Administrator inside a restricted unit cannot have their password reset by any other administrator, because no role assignable at unit scope can reset a Global Administrator's password. You would have to remove the account from the unit first, then reset it as a Global Administrator or Privileged Role Administrator. - **Applications.** Applications cannot modify objects in a restricted unit by default, and Microsoft Graph application permissions do not apply. Assign a Microsoft Entra role to the application at the unit's scope. - **Deletion delay.** After you delete a restricted unit, it can take up to 30 minutes for the protections to be removed from the former members. - **Quota.** A tenant can have at most 100 restricted management administrative units. ## Troubleshooting ### A helpdesk administrator reports they can no longer reset a password This is the intended effect. The user is in the restricted unit, so only administrators with a role scoped to that unit can reset the password. Either direct the request to the scoped administrators or add the helpdesk staff to the scoped role. ### The scoped administrator left the company A Global Administrator or Privileged Role Administrator can assign another administrator, or themselves, to the restricted unit to regain access. Assigning themselves is recorded in the audit log. ### The role assignment returns a 400 error The response "The given built-in role is not supported to be assigned to a single resource scope" means the role cannot be scoped to an administrative unit. Choose one of the roles that supports unit scope or a suitable custom role. ### A guest or service principal cannot use the scoped role Assign Directory Readers, or another role that includes read permissions, at tenant scope, as described earlier. ### An automation script now fails on protected accounts Graph application permissions do not apply to restricted objects. Give the application's service principal a role scoped to the unit. ## Closing checklist - Identify the objects to protect: executive users and devices, sensitive security groups. - Confirm none of the groups rely on PIM, access reviews or entitlement management. - Create the unit with **Restricted management administrative unit** set to **Yes**. - Add users, devices and security groups. Remember that adding a group does not add its members. - Assign the narrowest scoped role to a small named group of administrators, and keep at least one backup. - Test as a tenant-scoped administrator and as a scoped administrator. - Check that the audit log records the creation, membership and role changes. - Document who can regain access if the scoped administrators leave. ## References - https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/admin-units-restricted-management - https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/admin-units-manage - https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/admin-units-members-add - https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/manage-roles-portal ## Frequently asked questions ### Can a Global Administrator still modify objects in a restricted management administrative unit? Not directly. A Global Administrator at tenant scope is blocked from modifying the Microsoft Entra properties of those objects. They can, however, manage the administrative unit itself, including assigning themselves a role scoped to it. Microsoft describes that self-assignment as an auditable event. ### Can I turn an existing administrative unit into a restricted one? No. The restricted management setting must be applied when the administrative unit is created and cannot be changed afterwards. To protect objects that are already in a regular administrative unit, create a new restricted unit and add the objects to it. ### Which object types can go in a restricted management administrative unit? Users, devices and security groups. Microsoft 365 groups, mail-enabled security groups and distribution groups can be members of a regular administrative unit but not of a restricted one. ### What licence do I need? Each administrator of a restricted management administrative unit needs a Microsoft Entra ID P1 licence. Members of the unit need Microsoft Entra ID Free licences.