Restricted Management Administrative Units: Because Dave From the Helpdesk Shouldn’t Reset the CEO’s Password

Restricted management administrative units in Microsoft Entra ID let you put a fence around the accounts that would ruin your week if the wrong person changed them. Think executives, HR staff, payroll groups and your break glass accounts.

Here is the uncomfortable bit. Anyone with Helpdesk Administrator can reset the password of an ordinary user, and in most tenants that includes the CEO. User Administrator and Groups Administrator can go further, and Global Administrator can do the lot.

Dave on the helpdesk is probably lovely. Dave’s account after he clicks a convincing phishing email is a different person entirely.

This guide covers what restricted management administrative units (RMAUs) block, which admin roles lose access and which keep it, and how to set one up in the portal and with Microsoft Graph PowerShell. I also cover audit log checks, a break glass use case and the gotchas that will quietly break your HR automation.

Never miss a guide: subscribe here and check out my YouTube channel.

What are restricted management administrative units?

A normal administrative unit is about delegation. You scope a role so the Leeds helpdesk manages Leeds users and nobody else. I covered that side in why you should use administrative units in Entra.

A normal unit narrows what the scoped admin can touch, but tenant-wide admins still see and change everything. Restricted management administrative units flip that around. Objects inside become off limits to anyone who isn’t explicitly scoped to the unit, and tenant-scoped roles drop to read access for those objects.

Think of it as the locked drawer in the HR office. Everyone has a key to the building, two people have a key to the drawer, and the site manager can get a copy cut, but it goes in the log book.

Not every object type can go in. Here is what each type of unit supports:

Object type	Administrative unit	Restricted management administrative unit
Users	Yes	Yes
Devices	Yes	Yes
Security groups	Yes	Yes
Microsoft 365 groups	Yes	No
Mail-enabled security groups	Yes	No
Distribution groups	Yes	No

The full feature reference is on Restricted management administrative units in Microsoft Entra ID (Microsoft Learn).

Which admin roles lose access, and which still work

This is the table I wish I had seen first. “Manage the unit” means creating or deleting it, adding or removing members and assigning roles scoped to it, including to yourself.

Who	Change objects inside the RMAU?	Manage the unit itself?
Global Administrator (tenant scope)	No	Yes
Privileged Role Administrator (tenant scope)	No	Yes
User Administrator, Helpdesk Administrator, Groups Administrator and any other tenant-scoped built-in or custom role	No	No
Admins scoped to a regular administrative unit that also contains the object	No	No
Owners of groups or devices placed in the RMAU	No	No
A role scoped to this RMAU, or to another RMAU the object is in	Yes, within that role	No

So the scoped admin manages what is inside the unit, while Global Administrators and Privileged Role Administrators control who is inside it and who gets the keys. If the only scoped admin leaves, one of those two roles can assign a replacement or themselves.

It also matters what the restriction covers. It protects the Microsoft Entra properties of the object, not everything connected to it:

Action by an admin not scoped to the unit	Result
Read standard properties such as user principal name and photo	Allowed
Edit Microsoft Entra properties, delete the object or reset a password	Blocked
Change owners or members of a protected group	Blocked
Add a protected user, group or device to another group	Allowed
Change mailbox settings in Exchange	Allowed
Apply Intune policies to a protected device	Allowed
Assign licences or change usage location	Allowed
Add a protected group as a SharePoint site owner	Allowed

An Exchange admin can still fiddle with the CEO’s mailbox, so be careful before you promise leadership total protection. RMAUs protect the identity, not everything the identity touches.

Prerequisites and licensing

What you need	Details
Microsoft Entra ID P1	For each administrator assigned a role scoped to the unit. Members only need Microsoft Entra ID Free.
Privileged Role Administrator or Global Administrator	To create the unit, add members and assign scoped roles.
Microsoft Graph PowerShell SDK (optional)	For the PowerShell route, with the AdministrativeUnit.ReadWrite.All and RoleManagement.ReadWrite.Directory scopes.
A list of who goes in and who manages them	Agree it with HR or leadership first, not at 4:55pm on a Friday.
Tenant limit	Up to 100 restricted management administrative units per tenant.

How to set up restricted management administrative units in 6 steps

Step 1: Decide what goes in and who manages it

Start with a short list. Good candidates are:

• Executive accounts and their devices, so the helpdesk can’t reset their passwords or read their BitLocker recovery keys.
• HR and payroll staff, plus the security groups that grant access to HR and finance apps.
• Your emergency access accounts (more on that below).
• Accounts in a region where compliance says only local admins may manage them.

Then name the people who will manage each unit. Two is a sensible number. If you scope a role to your entire IT team, you have rebuilt the original problem with extra steps.

Step 2: Create the restricted management administrative unit

1. Sign in to the Microsoft Entra admin centre as at least a Privileged Role Administrator.
2. Go to Entra ID > Roles & admins > Admin units and select Add.
3. Enter a name, such as Executive Protection AU, and a description.
4. Set Restricted management administrative unit to Yes.
5. Move on to the Assign roles tab.

Step 3: Assign roles scoped to the unit

On the Assign roles tab (or later from the unit’s Roles and administrators page), pick a role and the people who should hold it. User Administrator covers most executive support work. Groups Administrator suits protected groups and Cloud Device Administrator suits protected devices.

In my lab I assigned User Administrator to two admins and nobody else, then selected Review + create and Create.

Scoped Helpdesk and Password Administrators can only reset passwords for users without admin roles. If the unit contains admins, pick the role to match. The full list of roles that work at this scope is in Roles that can be assigned with administrative unit scope (Microsoft Learn).

Step 4: Add users, devices and groups

1. Open the unit from Entra ID > Roles & admins > Admin units.
2. Select Users, Groups or Devices.
3. Select Add member, Add or Add device, choose the objects and select Select.

You can also work from the object itself. Open the user, group or device, select Administrative units, then Assign to administrative unit. For a long list of users, Users > Bulk operations > Bulk add members takes a CSV.

Step 5: Test it with a tenant-wide admin

Sign in as a Global Administrator who is not scoped to the unit, open a protected user and try to edit them. You should see this banner:

This user is a member of a restricted management administrative unit. Management rights are limited to administrators scoped on that administrative unit.

For users and devices, the banner appears on the Overview page. For groups, it appears on the Members page instead. In my lab, Edit properties and Delete were greyed out for José Teixeira while I was signed in as Global Administrator, which is the most satisfying greyed-out button I have ever seen.

Step 6: Check the audit logs

1. Go to Entra ID > Monitoring & health > Audit logs.
2. Filter Category to AdministrativeUnit for unit and membership changes, or RoleManagement for scoped role assignments.
3. Open an entry for the detail. Creating a restricted unit shows IsMemberManagementRestricted set to true.

Activity	Category
Add administrative unit	AdministrativeUnit
Add member to restricted management administrative unit	AdministrativeUnit
Remove member from restricted management administrative unit	AdministrativeUnit
Add member to role scoped over Restricted Management Administrative Unit	RoleManagement
Remove member from role scoped over Restricted Management Administrative Unit	RoleManagement

Create restricted management administrative units with Microsoft Graph PowerShell

If you build tenants more than once, script it. Connect with the scopes you need, then create the unit with IsMemberManagementRestricted set to true.

Connect-MgGraph -Scopes "AdministrativeUnit.ReadWrite.All","RoleManagement.ReadWrite.Directory","User.Read.All"

$params = @{
    DisplayName                  = "Executive Protection AU"
    Description                  = "Executive accounts and devices"
    IsMemberManagementRestricted = $true
}
$rmau = New-MgDirectoryAdministrativeUnit -BodyParameter $params
$rmau | Select-Object DisplayName, Id, IsMemberManagementRestricted

Next, assign a role scoped to the unit. Note the directory scope format, which is /administrativeUnits/ followed by the unit’s ID.

$admin = Get-MgUser -Filter "userPrincipalName eq 'exec.support@contoso.com'"
$role  = Get-MgRoleManagementDirectoryRoleDefinition -Filter "displayName eq 'User Administrator'"

New-MgRoleManagementDirectoryRoleAssignment `
    -DirectoryScopeId "/administrativeUnits/$($rmau.Id)" `
    -PrincipalId $admin.Id `
    -RoleDefinitionId $role.Id

Then add members. Users, groups and devices all use the same cmdlet with a different OData path.

$ceo = Get-MgUser -Filter "userPrincipalName eq 'ceo@contoso.com'"
New-MgDirectoryAdministrativeUnitMemberByRef -AdministrativeUnitId $rmau.Id `
    -OdataId "https://graph.microsoft.com/v1.0/users/$($ceo.Id)"

Prove it worked: inventory and audit checks

Six months from now, someone will ask what is protected and who can change it. This lists every restricted unit and its members:

Connect-MgGraph -Scopes "AdministrativeUnit.Read.All","AuditLog.Read.All"

Get-MgDirectoryAdministrativeUnit -All -Property "id,displayName,isMemberManagementRestricted" |
    Where-Object IsMemberManagementRestricted |
    ForEach-Object {
        $au = $_
        Get-MgDirectoryAdministrativeUnitMember -AdministrativeUnitId $au.Id -All |
            Select-Object @{n='Unit';e={$au.DisplayName}},
                          @{n='Member';e={$_.AdditionalProperties.displayName}},
                          @{n='Type';e={$_.AdditionalProperties.'@odata.type'}}
    }

And this pulls recent membership and scoped role changes from the audit log, which is where a Global Administrator quietly helping themselves would show up:

$activities = @(
    "Add member to restricted management administrative unit",
    "Remove member from restricted management administrative unit",
    "Add member to role scoped over Restricted Management Administrative Unit",
    "Remove member from role scoped over Restricted Management Administrative Unit"
)
foreach ($activity in $activities) {
    Get-MgAuditLogDirectoryAudit -Filter "activityDisplayName eq '$activity'" -Top 50 |
        Select-Object ActivityDateTime, ActivityDisplayName,
            @{n='InitiatedBy';e={$_.InitiatedBy.User.UserPrincipalName}},
            @{n='Target';e={$_.TargetResources[0].DisplayName}}
}

If your Entra audit logs already go to a Log Analytics workspace, turn the same idea into an alert rule so you don’t rely on someone remembering to run a script:

AuditLogs
| where OperationName in ("Remove member from restricted management administrative unit",
    "Add member to role scoped over Restricted Management Administrative Unit")
| project TimeGenerated, OperationName, InitiatedBy, TargetResources

Restricted management administrative units for break glass accounts

Emergency access accounts are Global Administrators that sit in the corner doing nothing, which makes them a tempting target. Placing them in an RMAU means no other admin can quietly reset, disable or delete them without first taking them out of the unit.

Give the break glass accounts their own unit, separate from the executives, and keep scoped roles to the absolute minimum. Then alert on anyone removing a member from that unit or assigning a role over it, exactly as you alert on a break glass sign-in. My break glass account guide covers the passkeys, Conditional Access exclusions and sign-in alert.

Protecting executives and HR with restricted management administrative units

Executives are the classic case. Put the accounts and their devices in a unit, scope User Administrator and Cloud Device Administrator to an executive support pair, and the helpdesk can no longer reset the chief executive’s password or pull a BitLocker key from their laptop.

HR is where it gets fiddly. HR staff accounts and the security groups that gate HR and payroll apps fit nicely. The HR team’s Microsoft 365 group can’t go in, so its Teams membership stays with your normal admins.

The bigger catch is automation. If your joiners and leavers run on Microsoft Entra Lifecycle Workflows, protected users fall outside it, and your leaver process needs a manual step. That is exactly the kind of gap insider threats love.

Restricted management administrative units gotchas

No conversion later. The restricted setting is fixed when you create the unit. Plan the names and purpose before you click Create.

ID Governance. Groups and users in an RMAU can’t be managed with PIM for Groups, entitlement management, Lifecycle Workflows or access reviews. If you rely on PIM for Groups, keep those groups out.

Apps and scripts. Applications can’t modify objects in an RMAU by default, and Microsoft Graph application permissions don’t apply. Assign the app’s service principal a role scoped to the unit, plus Directory Readers (or similar) at tenant scope so it can read the objects.

Role-assignable groups. Once one is in an RMAU, group owners lose management rights and only Global Administrators and Privileged Role Administrators can change its membership.

Public groups. A security group set to public membership can still be joined through self-service group management. Keep protected groups private.

Deleting the unit. Protection can take up to 30 minutes to lift from former members, so don’t panic if the banner hangs around while the kettle boils.

Not a wall. A Global Administrator can still remove a member or assign themselves a scoped role. That is by design, and it is why the audit alert matters more than the fence.

Should you use restricted management administrative units?

Yes, for a small and deliberate set of accounts. Executives, HR, payroll groups and break glass accounts are the obvious starting point, and the setup takes less time than the meeting where you agree who goes in.

Don’t use them for everything. Each protected object loses access to some ID Governance features and breaks automation that hasn’t been scoped properly, so keep the list short and review it with your other privileged access controls.

If you only do three things today: create one RMAU for your executives, scope it to two trusted admins, and set up an alert on membership changes. Then put the kettle on.

Restricted management administrative units FAQs

Further reading

• Restricted management administrative units in Microsoft Entra ID (Microsoft Learn)
• Create or delete administrative units (Microsoft Learn)
• Assign roles with administrative unit scope (Microsoft Learn)
• Manage emergency access accounts in Microsoft Entra ID (Microsoft Learn)
• Microsoft Entra audit log categories and activities (Microsoft Learn)
• Why use administrative units to delegate Entra administration
• Break glass accounts: setup, passkeys and alerts
• SC-300 exam study guide

Found this useful? Buy me a coffee, and if you handle subject access requests, have a look at Redact Ninja for redacting PDFs without sending files to a server.