May 4, 2025
Blog
Granular Permission Control with Microsoft Entra ID: Keep C-Level Accounts Out of Helpdesk Scope
Many organizations delegate Helpdesk roles to IT teams to assist with routine user management—like resetting passwords, modifying authentication methods, and updating user details. But what if you want those teams not to have access to sensitive accounts like C-level executives?
That’s exactly where Administrative Units (AUs) in Microsoft Entra ID come in.
What are Administrative Units?
Administrative Units are logical containers within Entra ID that allow you to scope role-based access to a subset of users, groups, or devices. Unlike directory-wide roles, which apply across the entire tenant, roles assigned via an AU are limited only to the members of that AU.
This means you can:
Segment administrative responsibilities by geography, department, or user type.
Limit Helpdesk access to only a defined set of users.
Prevent unintended changes or data exposure for privileged accounts.
Real-World Use Case: Helpdesk + Executive Protection
Let’s say your organization wants to allow Helpdesk staff to assist general employees, but explicitly prevent them from managing executives. Here’s how you can do it:
Why This Matters
By separating your users into AUs and assigning roles accordingly, you:
Reduce risk of human error or insider threat
Comply with least-privilege principles
Ensure that executive accounts remain untouched unless explicitly permitted
Create a Single Admin Unit for Sensitive User:
Create one Administrative Unit, for example called “ExecUsers_AU”
Add only the sensitive users (e.g. CEO, CFO, legal, board members) to this AU
Assign Scoped Roles to a Trusted Helpdesk Subgroup:
Create a small, approved Helpdesk group (for example, “Helpdesk_Exec_Team”)
Assign that group the Helpdesk or Authentication Admin role scoped only to “ExecUsers_AU”
Do Not Assign Access to General Helpdesk Staff:
The rest of your Helpdesk team should not be assigned roles scoped to this AU
They will continue to support the rest of the organization as usual
The Result:
Only the selected Helpdesk staff will be able to view or manage the sensitive users
Other admins won’t even see those users in Microsoft 365 admin center
You enforce least privilege and reduce risk of error or misuse
Important Notes
AUs don’t nest — users must be added explicitly to each AU they belong to.
To manage group members’ properties, users must also be AU members—not just part of a group in that AU.
Licensing: Creating AUs is free, but role-scoped administration within AUs requires Entra ID P1 licenses.
Final Thoughts
This capability is especially powerful in regulated industries, enterprises with tiered IT support, or any environment with strict identity governance needs.
If you haven’t already scoped your Helpdesk permissions—this is a great place to start.
📎 For implementation details, check Microsoft’s docs on Managing Administrative Units