You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
In Azure Active Directory (Azure AD), you can add groups to an administrative unit (AU) for more granular administrative scope of control.
22
22
23
-
For steps to prepare to use PowerShell and Microsoft Graph for administrative unit management, see [Getting started](roles-admin-units-manage.md#getting-started).
23
+
For steps to prepare to use PowerShell and Microsoft Graph for administrative unit management, see [Get started](roles-admin-units-manage.md#get-started).
In Azure Active Directory (Azure AD), you can add users to an administrative unit (AU) for more granular administrative scope of control.
22
22
23
-
For steps to prepare to use PowerShell and Microsoft Graph for administrative unit management, see [Getting started](roles-admin-units-manage.md#getting-started).
23
+
For steps to prepare to use PowerShell and Microsoft Graph for administrative unit management, see [Get started](roles-admin-units-manage.md#get-started).
In Azure Active Directory (Azure AD), you can assign users to an Azure AD role with a scope limited to one or more administrative units (AUs) for more granular administrative control.
22
22
23
-
For steps to prepare to use PowerShell and Microsoft Graph for administrative unit management, see [Getting started](roles-admin-units-manage.md#getting-started).
23
+
For steps to prepare to use PowerShell and Microsoft Graph for administrative unit management, see [Get started](roles-admin-units-manage.md#get-started).
# Troubleshooting and FAQ for administrative units in Azure Active Directory
20
+
# Azure AD administrative units: Troubleshooting and FAQ
21
21
22
-
For more granular administrative control in Azure Active Directory (Azure AD), you can assign users to an Azure AD role with a scope limited to one or more administrative units (AUs). You can find sample PowerShell scripts for common tasks at https://docs.microsoft.com/powershell/azure/active-directory/working-with-administrative-units?view=azureadps-2.0.
22
+
For more granular administrative control in Azure Active Directory (Azure AD), you can assign users to an Azure AD role with a scope that's limited to one or more administrative units (AUs). For sample PowerShell scripts for common tasks, see [Work with administrative units](https://docs.microsoft.com/powershell/azure/active-directory/working-with-administrative-units?view=azureadps-2.0).
23
23
24
24
## Frequently asked questions
25
25
26
-
**Q: I am not able to create an administrative unit**
26
+
**Q: Why am I unable to create an administrative unit?**
27
27
28
-
**A:** Only a Global Administrator or Privileged Role Administrator can create an administrative unit in Azure AD. Check that the user trying to create the administrative unit is assigned either the Global Administrator or Privileged Role Administrator role.
28
+
**A:** Only a *Global Administrator* or *Privileged Role Administrator* can create an administrative unit in Azure AD. Check to ensure that the user who's trying to create the administrative unit is assigned either the *Global Administrator* or *Privileged Role Administrator* role.
29
29
30
-
**Q: I added a group to the administrative unit, but the members of the group are still not showing up in the administrative unit**
30
+
**Q: I added a group to the administrative unit. Why are the group members still not showing up there?**
31
31
32
-
**A:** When you add a group to the administrative unit, that does not result in adding all the members of the group to the administrative unit. Users must be directly assigned to administrative unit.
32
+
**A:** When you add a group to the administrative unit, that does not result in all the group's members being added to it. Users must be directly assigned to the administrative unit.
33
33
34
-
**Q: I just added / removed a member of the administrative unit and it is still showing up in the UI**
34
+
**Q: I just added (or removed) a member of the administrative unit. Why is the member not showing up (or still showing up) in the user interface?**
35
35
36
-
**A:** Sometimes processing of the addition or removal of one or more members of the administrative unit might take a few minutes to reflect under the **Administrative units** page. You may choose to wait for a few minutes for it to reflect under the administrative units. Alternatively, you can go directly to the associated resource's properties and see if the action has been completed. For more information about users and groups in AUs, see [List administrative units for a user](roles-admin-units-add-manage-users.md) and [List administrative units for a group](roles-admin-units-add-manage-groups.md).
36
+
**A:** Sometimes, processing of the addition or removal of one or more members of the administrative unit might take a few minutes to be reflected on the **Administrative units** page. Alternatively, you can go directly to the associated resource's properties and see whether the action has been completed. For more information about users and groups in AUs, see [List administrative units for a user](roles-admin-units-add-manage-users.md) and [List administrative units for a group](roles-admin-units-add-manage-groups.md).
37
37
38
-
**Q: As a delegated password administrator on an administrative unit, I am unable to reset a specific user's password**
38
+
**Q: I am a delegated password administrator on an administrative unit. Why am I unable to reset a specific user's password?**
39
39
40
-
**A:** An administrator assigned over an administrative unit you can reset password only for users assigned to your administrative unit. Make sure that the user for which the password reset is failing belongs to the administrative units over which you have been assigned the role. If the user belongs to the same administrative unit and you still can't reset the password of the user, check the roles that are assigned to the user. To prevent an elevation of privilege, an administrative unit scoped administrator cannot reset the password of a user that is assigned to a role with an organization-wide scope.
40
+
**A:** As an administrator of an administrative unit, you can reset passwords only for users who are assigned to your administrative unit. Make sure that the user whose password reset is failing belongs to the administrative unit to which you've been assigned. If the user belongs to the same administrative unit but you still can't reset their password, check the roles that are assigned to the user.
41
+
42
+
To prevent an elevation of privilege, an administrative unit-scoped administrator can't reset the password of a user who's assigned to a role with an organization-wide scope.
41
43
42
44
**Q: Why are administrative units necessary? Couldn't we have used security groups as the way to define a scope?**
43
45
44
-
**A:** Security groups have an existing purpose and authorization model. A User administrator, for example, can manage membership of all security groups in the Azure AD organization, such as to use groups to manage access to applications like Salesforce. A User administrator should not have the ability to manage the delegation model itself, which would be the result if security groups were extended to support "resource grouping" scenarios. Administrative units, like Organizational Units in Windows Server Active Directory, are intended to provide a way to scope administration of a wide range of directory objects. Security groups themselves can be members of resource scopes. Using security groups to define the set of security groups an administrator can manage could become confusing.
46
+
**A:** Security groups have an existing purpose and authorization model. A *User Administrator*, for example, can manage membership of all security groups in the Azure AD organization. The role might use groups to manage access to applications such as Salesforce. A *User Administrator* should not be able to manage the delegation model itself, which would be the result if security groups were extended to support "resource grouping" scenarios. Administrative units, such as organizational units in Windows Server Active Directory, are intended to provide a way to scope administration of a wide range of directory objects. Security groups themselves can be members of resource scopes. Using security groups to define the set of security groups that an administrator can manage could become confusing.
45
47
46
48
**Q: What does it mean to add a group to an administrative unit?**
47
49
48
-
**A:** Adding a group to an administrative unit brings the group itself into the management scope of any User administrator who is also scoped to that admin unit. User admins for the administrative unit can manage the name and membership of the group itself. It does not grant the User admin for the administrative unit any permission to manage the users of the group (for example, reset their passwords). To grant the User Administrator the ability to manage users, the users have to be direct members of the administrative unit.
50
+
**A:** Adding a group to an administrative unit brings the group itself into the management scope of any *User Administrator* who is also scoped to that administrative unit. User administrators for the administrative unit can manage the name and membership of the group itself. It does not grant the *User Administrator* for the administrative unit permissions to manage the users of the group (for example, to reset their passwords). To grant the *User Administrator* the ability to manage users, the users have to be direct members of the administrative unit.
49
51
50
52
**Q: Can a resource (user or group) be a member of more than one administrative unit?**
51
53
52
-
**A:** Yes, a resource can be a member of more than one administrative unit. The resource can be managed by all organization-wide and administrative unit-scoped admins who have permissions over the resource.
54
+
**A:** Yes, a resource can be a member of more than one administrative unit. The resource can be managed by all organization-wide and administrative unit-scoped administrators who have permissions over the resource.
53
55
54
56
**Q: Are administrative units available in B2C organizations?**
55
57
56
58
**A:** No, administrative units are not available for B2C organizations.
57
59
58
60
**Q: Are nested administrative units supported?**
59
61
60
-
**A:** Nested administrative units are not supported.
62
+
**A:** No, nested administrative units are not supported.
63
+
64
+
**Q: Are administrative units supported in PowerShell and the Graph API?**
61
65
62
-
**Q: Are administrative units supported in PowerShell and Graph API?**
66
+
**A:** Yes. You'll find support for administrative units in [PowerShell cmdlet documentation](https://docs.microsoft.com/powershell/module/Azuread/?view=azureadps-2.0-preview)and [sample scripts](https://docs.microsoft.com/powershell/azure/active-directory/working-with-administrative-units?view=azureadps-2.0-preview).
63
67
64
-
**A:** Yes. Support for Administrative Units exists in [PowerShell cmdlet documentation](https://docs.microsoft.com/powershell/module/Azuread/?view=azureadps-2.0-preview) and [sample scripts](https://docs.microsoft.com/powershell/azure/active-directory/working-with-administrative-units?view=azureadps-2.0-preview), and support is in the Microsoft Graph for the [administrativeUnit resource type](https://developer.microsoft.com/graph/docs/api-reference/beta/resources/administrativeunit).
68
+
Find support for the [administrativeUnit resource type](https://developer.microsoft.com/graph/docs/api-reference/beta/resources/administrativeunit) in Microsoft Graph.
65
69
66
70
## Next steps
67
71
68
-
-[Administrative units to restrict scope for roles overview](directory-administrative-units.md)
# Manage administrative units in Azure Active Directory
20
20
21
-
For more granular administrative control in Azure Active Directory (Azure AD), you can assign users to an Azure AD role with a scope limited to one or more administrative units (AUs).
21
+
For more granular administrative control in Azure Active Directory (Azure AD), you can assign users to an Azure AD role with a scope that's limited to one or more administrative units (AUs).
22
22
23
-
## Getting started
23
+
## Get started
24
24
25
-
1. To run queries from the following instructions via [Graph Explorer](https://aka.ms/ge), please ensure the following:
25
+
1. To run queries from the following instructions via [Graph Explorer](https://aka.ms/ge), do the following:
26
26
27
-
1. Go to Azure AD in the portal, and then in the applications select Graph Explorer and provide admin consent to Graph Explorer.
27
+
a. In the Azure portal, go to Azure AD. In the applications list, select **Graph Explorer**, and then select **Grant admin consent to Graph Explorer**.
28
28
29
-
29
+
30
30
31
-
1. In the Graph Explorer, ensure that you select the beta version.
31
+
b. In Graph Explorer, select the **beta** version.
32
32
33
-
33
+
34
34
35
-
1.Please use the preview version of Azure AD PowerShell. Detailed instructions are here.
35
+
1.Use the preview version of Azure AD PowerShell.
36
36
37
37
## Add an administrative unit
38
38
39
-
### Azure portal
39
+
### Use the Azure portal
40
40
41
-
1.Go to Active Directory in the portal and select Administrative Units in the left panel.
41
+
1.In the Azure portal, go to Azure AD, and then, in the left pane, select **Administrative units**.
42
42
43
-
43
+
44
44
45
-
1. Select **Add*** and provide the name of the administrative unit and optionally can add a description for the administrative unit.
45
+
1. Select **Add** and then enter the name of the administrative unit. Optionally, add a description of the administrative unit.
46
46
47
-
47
+
48
48
49
49
1. Select **Add** to finalize the administrative unit.
50
50
51
-
### PowerShell
51
+
### Use PowerShell
52
52
53
-
Install Azure AD PowerShell (preview version) before trying to perform the actions below:
53
+
Install Azure AD PowerShell (preview) before you try to run the following commands:
The values highlighted above can be modified as required.
58
+
You can modify the values that are enclosed in quotation marks, as required.
59
59
60
-
### Microsoft Graph
60
+
### Use Microsoft Graph
61
61
62
62
Http Request
63
63
POST /administrativeUnits
@@ -69,22 +69,24 @@ The values highlighted above can be modified as required.
69
69
70
70
## Remove an administrative unit
71
71
72
-
In Azure Active Directory (Azure AD), you can remove an admin unit that you no longer need as a unit of scope for administrative roles.
72
+
In Azure AD, you can remove an administrative unit that you no longer need as a unit of scope for administrative roles.
73
73
74
-
### Azure portal
74
+
### Use the Azure portal
75
75
76
-
Go to **Azure AD > Administrative units** in the portal. Select the administrative unit to be deleted and then select **Delete**. After confirming **Yes**, the administrative unit will be deleted.
76
+
1. In the Azure portal, go to **Azure AD** > **Administrative units**.
77
+
1. Select the administrative unit to be deleted, and then select **Delete**.
78
+
1. To confirm that you want to delete the administrative unit, select **Yes**. The administrative unit is deleted.
77
79
78
-
80
+
0 commit comments