Administrative Units (AUs) in Microsoft Entra ID are often associated with delegated administration and organisational segmentation.  

In this article we will specifically discuss leveraging Administrative Units to ensure privileged access security groups are kept secure. 

Essentially, Administrative Units can be used to control who can administer Device, User and Group objects in Entra ID. This means that the groups assigned to the AU can only be managed by users who have been assigned the appropriate role at the appropriate Administrative Unit scope. For example, a senior engineer can be granted the Group Administrator role at the Administrative Unit level, meaning only the senior engineers with the respective PIM role can elevate and then amend these privileged groups. 

One of the primary reasons for adopting Administrative Units is to help prevent the threat of less senior administrators with broad directory permissions, such as User Administrators or Groups Administrators (at the global tenant level), from being able to elevate their own permissions by simply adding themselves to groups that are used to assign privileged roles, licenses or access rights. 

The Challenge 

Many organisations use security groups to assign access to: 

• Azure subscriptions and resource groups 

• Enterprise applications 

• SharePoint sites 

• Conditional Access exclusions 

• Microsoft Entra roles through Privileged Identity Management (PIM) 

• Administrative access to critical infrastructure 

In a traditional Entra ID deployment, a user assigned the Groups Administrator role can manage most groups within the directory. Whilst this may be operationally convenient, it can also introduce a significant security concern. 

Consider the following scenario: 

1. A Groups Administrator has permission to manage all security groups. 

2. A privileged security group exists which grants Global Administrator eligibility via PIM. 

3. The Groups Administrator adds themselves as a member. 

4. They activate the role and obtain elevated privileges. 

Although auditing and monitoring may identify this activity after the fact, the privilege escalation has already occurred. 

How Administrative Units Help 

Administrative Units introduce an additional layer of scoping. 

Instead of administrative roles applying across the entire directory, they can be assigned at the Administrative Unit level. The result is that administrators only gain management rights over the users, devices, or groups contained within that specific AU. 

By placing privileged access groups into a dedicated Administrative Unit, organisations can: 

• Restrict who can manage those groups 

• Separate operational administration from privileged administration 

• Reduce opportunities for privilege escalation 

• Improve compliance and governance controls 

• Implement stronger segregation of duties 

The key benefit is that even if an administrator holds a directory-wide role such as User Administrator or Groups Administrator, they can be prevented from modifying sensitive groups that are protected through Administrative Unit scoping. 

Real world example 

Imagine an organisation has three groups which are used to assign users with highly privileged Entra ID roles: 

• Corp-PIM-GlobalAdmins

• Corp-PIM-ExchangeAdmins 

• Corp-PIM-SecurityAdmins 

Rather than allowing standard identity administrators to manage these groups, the organisation creates an Administrative Unit called: Privileged Roles and Groups 

The three groups are added to the Administrative Unit, and only a small number of senior engineers are assigned the relevant administrative role, which is scoped specifically to that AU. 

The outcome is simple: 

Administrator Role / Group	Able to manage standard groups	Able to manage privileged groups assigned to the AU
Groups Administrator	Yes	No
User Administrator	Yes	No
Senior Engineer (assigned to the AU)	Yes	Yes

This creates clear separation between day-to-day administration and privileged access management. 

Whilst security is often the primary driver, Administrative Units also deliver several governance benefits. 

Benefits Beyond Security 

Improved separation: Many regulatory frameworks require a separation between those who manage user accounts and those who approve or grant privileged access. Administrative Units make this easier to implement by providing clear administrative boundaries. 

Reduces administrative risk: Mistakes happen. Restricting access to these high-impact groups reduces the likelihood of accidental membership changes that could affect production systems or critical services. 

Better auditing: When privileged groups are isolated within a dedicated Administrative Unit, it becomes significantly easier to identify who has administrative responsibility and who is authorised to make changes. 

Delegation becomes more scalable: as environments grow, organisations often need to delegate administration without exposing sensitive resources. Administrative Units enable a more scalable model where permissions can be delegated safely without granting excessive directory-wide rights. 

Final thoughts and considerations 

Before implementing this approach, there are a few key considerations: 

• Administrative Units should be part of a wider privileged access strategy rather than a standalone control. 

• Privileged Identity Management (PIM) should still be used wherever possible for role activation and approval workflows. 

• Regular Access reviews should be implemented for privileged groups. 

• Administrative Unit role assignments should be regularly reviewed and monitored. 

• Breakglass and emergency access accounts should remain appropriately governed. 

Administrative Units are frequently overlooked when discussing Microsoft Entra ID security controls, yet they can play a critical role in protecting privileged access paths. 

By placing privileged security groups within dedicated Administrative Units and tightly controlling who can administer them, organisations can significantly reduce the risk of privilege escalation, improve separation of duties, and strengthen their overall identity governance posture. 

As more organisations move towards role-based access control and Zero Trust principles, Administrative Units provide another valuable mechanism for ensuring that administrative permissions are granted only where they are genuinely required, and nowhere else. 

Tip: If you’re already using Privileged Identity Management to govern your Entra roles, review the security groups that underpin those assignments. Protecting the groups themselves is just as important as protecting the roles they grant. 

Hope this helps and thanks for reading!