Configure Azure AD administrative units

Welcome to this lesson on Azure AD Administrative Units, where efficient management and robust control empower your organization to thrive securely. Think of your organization as a bustling city, with each department representing its own district governed by unique rules and responsibilities. Azure AD Administrative Units (AUs) work in a similar way by compartmentalizing your Azure Active Directory resources into distinct containers, making delegation simpler and more secure.

Imagine a company like KodeKloud. With departments such as Development, Marketing, and Sales, you can create an AU for the Development team. This unit will contain only the users and groups associated with that team, thereby restricting administrative tasks exclusively to them.

Within each Administrative Unit, you gain granular control. Administrators assigned to a specific AU manage tasks like password resets, authentication methods, or group management only for that unit, minimizing unintended changes to the broader Azure AD tenant.

Role-Based Permissions Within Administrative Units

Not every role in Azure AD can be scoped to an administrative unit. Some roles, like the Global Administrator, are tenant-wide. Within an AU, the following roles can be delegated:

• Authentication Administrator:
  Can view, set, and reset authentication method information for non-administrative users. For example, if a user loses their phone, an authentication administrator within the AU can update their authentication method.

• Groups Administrator:
  Manages all aspects of groups and group settings (including naming and expiration policies) specifically within the AU.

• Help Desk Administrator:
  Resets passwords for non-administrators and other help desk administrators, and performs tasks such as forcing sign-outs and revoking sessions.

• License Administrator:
  Oversees license assignments by adding, removing, or updating licenses within the AU.

• Password Administrator:
  Responsible for resetting passwords for non-administrative users and other password administrators within the designated AU. Note that password administrators must contact another administrator to reset their own passwords.

• User Administrator:
  Possesses comprehensive rights to manage users and groups, including password resets for many roles except global administrators.

Working with Administrative Units in the Azure Portal

This section guides you through setting up an Administrative Unit using the Azure Portal.

1. Navigate to Azure Active Directory in the Azure Portal, then select Administrative units.
2. Click on Create administrative unit. Provide a name for the unit (e.g., "HRAVew").
3. Notice the option for enabling restricted management. This preview feature protects certain objects from modification by unauthorized administrators. For production environments, leave it set to No.
4. Click Assign roles—this can also be managed later if you prefer—review your settings, and then click Create to finalize the AU.

Once the administrative unit is created, you will see it listed in the Administrative units section.

Within the AU, you can add users, groups, and devices, and assign roles to confidently manage administration tasks. For example, onboarding a user involves selecting them from the available list.

You also have the flexibility to add existing groups or create new ones within the AU. By clicking Add, you can select all available groups from your Azure AD and enroll them into the designated administrative unit.

Under Roles and Administrators, you can view available roles such as Authentication Administrator. For instance, assigning Abigail the Authentication Administrator role within the AU will permit her to reset authentication methods for users (e.g., resetting authentication for user Aldous) confined solely to that specific unit.

Summary

Azure AD Administrative Units provide a powerful mechanism for achieving granular control over your organization's resources. By grouping resources together and delegating specific administrative roles within secure boundaries, you enhance overall security, streamline operations, and simplify complex management environments. With these finely scoped permissions, only designated administrators can manage their respective units, keeping your entire Azure AD tenant secure and well-organized.

Happy managing!