Microsoft Entra ID Adds Restricted Management Administrative Units in Preview

Cloud Computing

Microsoft has introduced restricted management administrative units support in public preview for Microsoft Entra ID. The new role-based access control (RBAC) feature lets organizations allow only select IT admins, security teams, or devices to access specific resources.

“Restricted management administrative units allow you to protect specific objects in your tenant from modification by anyone other than a specific set of administrators that you designate. This allows you to meet security or compliance requirements without having to remove tenant-level role assignments from your administrators,” Microsoft explained.

Why organizations should use restricted management administrative units?

According to Microsoft, restricted management administrative units help administrators to manage access in their Microsoft Entra ID tenants. For instance, the security feature protects accounts of highly privileged accounts in enterprise environments (such as senior executives).

Furthermore, organizations can ensure country-level administration of specific security groups and user accounts. Restricted Management Administrative Units can restrict unauthorized people from updating the membership of security groups used to secure sensitive information.

Microsoft Entra ID Adds Restricted Management Administrative Units in Preview

Licensing requirements and limitations

Microsoft also detailed some limitations for restricted management administrative units. The company says that IT admins won’t be able to apply the restricted management setting after creating an administrative unit. Moreover, it’s impossible to change the membership once role-assignable groups are added to restricted management administrative units.

Microsoft notes that organizations should have an Azure AD Premium P1 license to manage each administrative unit. The feature also requires administrative unit members to have Azure AD free licenses. You can learn more about how to use restricted management administrative units on the Microsoft Entra (Azure AD) Blog.

Earlier this week, Microsoft announced that it’s rebranding Azure Active Directory (Azure AD) to Entra ID. The company has also announced two new products called Microsoft Entra Private Access and Microsoft Entra Internet Access.