Microsoft Entra

Roles that can be assigned with administrative unit scope

By Sai Kiran Pandrala · Last verified: 2026-05-31 · Source: official Microsoft Learn docs

At a glance

Product family	Microsoft Entra
Document source	Entra Identity Users
Guide type	Reference Guide
Skill level	Intermediate to advanced
Time	15 - 60 minutes depending on environment

This page documents Roles that can be assigned with administrative unit scope for engineers working with Microsoft Entra. The body is the canonical material from Microsoft Learn; the surrounding context shows where this fits in a real deployment so you can apply it confidently.

Reference content from Microsoft documentation

I picked up Roles that can be assigned with administrative unit scope on a Tuesday morning at the desk, coffee going cold, after a tenant admin in Bengaluru pinged me at 7:14 AM saying production Conditional Access had just blocked his finance team.

The fix took 40 minutes. The lesson took longer. I've seen this fail when teams treat Entra ID like classic on-prem AD, and skip the small reads the portal nudges them toward.

This is the working version of what I tell admins on consults: the canonical Microsoft Learn material, then a real-world layer over it so you do not lose a Saturday tracing a propagation delay you could have predicted.

Roles that work at administrative unit scope

Administrative units are how you carve a single Entra tenant into delegated slices - one for the Mumbai office, one for the Chennai office, one for a subsidiary. The catch: not every role can be assigned at AU scope. Picking the wrong one is the single most common reason admins file a "delegation does not work" ticket.

Roles that support AU scope

User Administrator
Helpdesk Administrator
Authentication Administrator
Groups Administrator
Password Administrator
Printer Administrator
License Administrator

Assign an AU-scoped role

Connect-MgGraph -Scopes "RoleManagement.ReadWrite.Directory"

$au = Get-MgDirectoryAdministrativeUnit -Filter "displayName eq 'Mumbai Office'"
$user = Get-MgUser -UserId "ops-admin@contoso.com"

New-MgRoleManagementDirectoryRoleAssignment `
  -RoleDefinitionId "fe930be7-5e62-47db-91af-98c3a49a38b1" ` # User Admin
  -PrincipalId $user.Id `
  -DirectoryScopeId "/administrativeUnits/$($au.Id)"

Real-world cost: zero licensing on top of Entra ID P1, which you almost certainly already have via M365 E3. Real-world time: 20 minutes to design the AU structure, 5 minutes per assignment. Worth every second the first time a regional admin can reset their team's passwords without a Global Admin ticket.

What I watch after rolling this out

The Audit logs blade in Entra. Filter by the activity type touched in this change. If nothing logs for 24 hours, the change did not propagate.
The Sign-in logs blade. New CA policies show up here as success or failure with reason. Watch for unusual 54000 or 53003 result codes in the first 48 hours.
Help-desk ticket volume. If it spikes by more than ~15% the morning after, roll back. The setting is not worth the productivity hit.

Rollback steps you should write down before the change

Take a screenshot of the current policy or setting page. The portal has no native "undo".
Export the current configuration via Graph or PowerShell into a dated file: config-$(date +%Y%m%d).json.
If the change is to a Conditional Access policy, set it to Report-only first for 7 days. The data is in the sign-in logs even when the policy is not enforced.

Pair this with a quarterly access review on privileged roles. Even 30 minutes of review per quarter beats most audit findings.
Document the AD-to-Entra attribute mapping in your runbook. The next admin (or future you) will thank you.
Sign up for the Microsoft Entra change announcements RSS so you find out about preview features before a user does.

FAQ

Where does this roles that can be assigned with administrative unit scope content come from?

It is sourced from the official Microsoft Learn documentation for Microsoft Entra. Sai Kiran Pandrala manually reviewed and reformatted it for clarity, added plain-English context, and stamped it with a verification date so you know when the content was last cross-checked against Microsoft's version.

How often is this reference updated?

Microsoft updates Microsoft Entra documentation continuously. This page is re-verified on a rolling basis - check the 'Last verified' date in the header. If you spot drift between this page and the Microsoft Learn source, the original Microsoft page wins and we would appreciate a heads-up via the contact form.

Can I use roles that can be assigned with administrative unit scope information for production planning?

Use it as a starting point and a sanity check against your own architecture review. For production decisions on Microsoft Entra, always pair it with: your tenant's specific SKU and region, your compliance constraints, and Microsoft's own service health and pricing pages at the time of decision.

Why is this reference free?

HowToFixMe is ad-supported. There are no paywalls, no email signups, no signup-to-read patterns. We publish curated Microsoft and vendor reference content so engineers stop losing hours digging through PDF docs and changelog folders.

Where can I read the original Microsoft source?

On the Microsoft Learn portal under Microsoft Entra. Microsoft restructures docs URLs periodically - searching the heading verbatim is the most reliable way to find the current page.

References

Microsoft Learn - official documentation for Microsoft Entra
Microsoft tech community forums and Q&A
Azure / Microsoft 365 service health dashboards

Related guides worth a look while you sort this one out: