JUMP TO SECTIONChoose a lesson section
Admin delegation is a permissions design problem.
Northstar Services has regional help desks, contractors joining in waves, specialized Finance attributes and a sign-in page used across multiple departments. Each concern has a different control: administrative units, custom security attribute roles, company branding or bulk identity operations. Choosing the wrong tool can overgrant permissions or quietly omit the data your workflow needs.
One tenant. Four different administrative boundaries.
Administrative units
Who can the help desk actually manage?An administrative unit (AU) defines which users, group objects or devices fall within supported directory role scope. An AU isn't a new tenant, a Conditional Access targeting tool or a way to hide all directory data.
VERIFY: Verify the member objects, AU-scoped role and any other effective tenant-wide assignments.Custom security attributes
Who defines security labels, and who assigns their values?Attribute sets contain security-focused definitions for supported users and service principals. The people who define attributes can be different from those allowed to assign values. These permissions aren't bundled into the Global Administrator role.
VERIFY: Review Definition versus Assignment roles, attribute-set scope and audit records.Company branding
What do users see—and what doesn't branding prove?Default company branding affects tenant sign-in experiences; supported themes can style particular apps. Localization, ownership and safe content matter. A logo alone isn't proof that a website is legitimate.
VERIFY: Verify licensing, Organizational Branding Administrator rights and supported browsers/languages.Bulk identity operations
How do you create many accounts without creating a mess?Entra's bulk CSV tasks and Graph PowerShell can provision accounts and make supported lifecycle updates at scale. Always check actual results, row-level failures, duplicate identity risk, protected attributes and safe credential handoff.
VERIFY: Validate inputs, least privilege, first-wave pilot results, selective retries and audit trails.Limit the help desk's permissions, not the user's identity.
An administrative unit is a directory resource that holds selected users, groups or devices. Assigning a supported Entra administrator role at AU scope limits that role's management actions to its supported members. It doesn't create an isolated tenant, hide all directory records, or automatically enforce Conditional Access.
Define the delegated boundary
Identify exactly which objects a regional support team must manage. Northstar's Tidewater AU includes intended users, while its West Coast help desk serves a different scope.
Select an AU membership mode
Use assigned members for deliberate small sets, or a supported Dynamic User / Dynamic Device rule to keep qualifying objects in sync. Dynamic rules don't mix object types; dynamically including groups is unsupported.
Assign a supported role at AU scope
Use an appropriate administrator role such as Helpdesk Administrator for its supported operations. A Privileged Role Administrator can establish the AU model. AU-scoped admins generally need Entra ID P1/P2.
Inspect effective role assignments
All assignments are additive. If the operator also holds a tenant-wide User Administrator assignment, AU scope doesn't cancel it. Inspect standing and eligible/active roles before testing.
Prove both permission outcomes
Test an approved action on a regional user and verify the equivalent action is denied for someone outside scope. Capture the audit event and a rollback plan before widening assignments.
The group object
Adding a group to an AU scopes supported administration of the group—not the users inside it.
To reset a member's password, ensure the user itself is included in the AU.Dynamic membership
Dynamic User and Dynamic Device AUs can follow supported attribute-based membership rules.
Dynamic group-object membership is not supported, and dynamic member licensing must be verified.Security boundary
AUs limit supported management permissions, not every directory read or sign-in control.
Do not treat an AU as a universal data isolation or Conditional Access mechanism.Licensing
Creating an AU differs from assigning AU-scoped administrator roles.
Check P1/P2 licensing for the AU administrator; dynamic user membership adds licensing requirements for affected users.Northstar can delegate group management on a regional AU group without giving that operator password reset authority over every member of that group. Add users to the AU directly or through supported dynamic-user membership and confirm effective assignments. A separate tenant-wide role can still grant broader access.
Advanced scope check: ordinary AU or restricted management AU?
Northstar's security team wants regional help-desk delegation, but its executive identities need a stronger administration boundary. These are two distinct administrative-unit models. An ordinary AU scopes a supported role; it does not cancel separate tenant-wide assignments. A restricted management AU protects member objects against modification by ordinary tenant-scoped administrators, including Global Administrators, unless the administrator has an appropriate role at the restricted AU scope.
Regional help desk can still reset an out-of-region password.
The operator has AU-scoped Helpdesk Administrator and an additional tenant-wide User Administrator role. The broad role remains effective; narrowing one assignment does not subtract another.
Check: List all active and eligible assignments, their scopes and the target user's AU membership. Remove or narrow the unnecessary tenant-wide grant through an approved role change.A tenant-wide administrator cannot edit a protected executive account.
Restricted management AUs behave differently from ordinary AUs. Supported changes to protected members require an appropriate role assigned at that restricted AU scope; tenant-wide Global Administrator alone does not bypass the member protection.
Check: Inspect the restricted AU's role assignments and audit events. Its management setting is chosen at creation and cannot later be toggled on an existing AU.Security isolation creates governance trade-offs.
Restricted AU members cannot be managed by Microsoft Entra Identity Governance features such as PIM, entitlement management, lifecycle workflows or access reviews. Role-assignable group membership has additional restrictions.
Check: Inventory existing governance and recovery workflows before moving identities into a restricted AU. Validate licensing, management ownership and a recovery administrator.For either AU type, prove an allowed operation and a denied operation using controlled test identities, then correlate the result with directory audit logs. Being able to see an object in a directory listing does not prove authority to manage it.
Who defines the label? Who is allowed to assign it?
Custom security attributes are business-specific security metadata stored on supported user and service principal objects. The attribute set groups definitions, but assigning a value requires different permissions from defining its allowable values. Unlike normal profile properties, attribute values have distinct roles and sensitive audit considerations.
Create a purposeful attribute set
For Northstar, the Contracts set might contain Workstream or InformationClass. Attribute set names can't be renamed or deleted, so agree on the naming convention and stewardship first.
Define values with the correct role
Attribute Definition Administrator can define the attribute and allowed types/values. Definition permissions do not by themselves grant authority to assign those values to objects.
Delegate assignment separately
Attribute Assignment Administrator can update values on supported users and service principals, optionally restricted to a specific attribute set. Global Administrator alone is not enough.
Verify value, reader access and logs
Confirm the stored attribute only in a supported authorized view. Use attribute-specific reader/audit roles where required, and avoid writing sensitive values to broad directory exports.
Microsoft deliberately separates custom security attribute definition and assignment roles. If an operator can change a normal user profile but not a custom attribute value, inspect the attribute-specific assignment and set scope instead of broadly granting additional tenant administration.
Make sign-in recognizable without confusing branding with security.
Default branding can provide a banner, page colors, favicon, message and supported layout at Microsoft Entra sign-in. Organizational Branding Administrator is the minimum role for tenant branding changes, with eligible licensing. App-specific themes and localized variants can override parts of the default where supported.
Default tenant branding
Use Entra ID → Custom branding with Organizational Branding Administrator and eligible licensing. Choose supported banner, colors, header/footer, layout and safe messages.
App-specific themes
Where supported, themes apply to selected enterprise applications and fall back to default branding for unset values. Preview different screen sizes and test supported application flows.
Localized experiences
Browser-language variants can override the default experience. Check that translations, help desk instructions and accessibility remain accurate; no internal secrets in public copy.
2026 CSS restrictions
For tenants created after January 5, 2026, Microsoft no longer offers company-branding custom CSS. From July 21, 2026, older tenants without existing CSS can't begin configuring it. Layout/position CSS is being phased out; use supported templates and current guidance.
Microsoft has limited custom company branding CSS availability and is retiring unsupported positioning properties. Prefer supported templates, test localization and accessibility, and teach users that a familiar logo isn't proof they are on a legitimate Microsoft sign-in URL.
120 users. Two failures. Zero reasons to rerun everything blindly.
Entra's admin center provides bulk-create, delete and download workflows. Bulk creation uses a downloaded CSV template with exact required column names. For more controlled automation, Microsoft Entra or Graph PowerShell can import CSV data, check whether each user already exists, create only approved missing identities and report results. Permissions and source-of-authority decisions matter just as much as the script.
Determine the authoritative identity source
For a hybrid user whose identity originates in AD DS, correct the source and synchronization workflow; don't blindly create a separate cloud user with the same UPN.
Download the current Entra bulk-create CSV
Preserve the exact current template headers. Required fields include display name, user principal name and initial password. Additional unsupported columns can be silently ignored.
Review permissions and pilot input
Use a least-privilege User Administrator or an appropriately scoped Microsoft Graph/Entra PowerShell identity and permission set. Validate domain, unique UPN, business approval and initial credential handling.
Submit and reconcile results
The bulk operation can partially succeed. Check the bulk-results file and actual user objects; never blindly replay a successful batch when only individual rows failed.
Finish onboarding and log safely
Assign the intended attributes/roles/licenses with supported subsequent operations, communicate initial credentials through a secure channel, require supported registration and verify expected access.
Use current Microsoft Entra/Graph PowerShell modules with explicit read/write permissions. In an idempotent workflow, validate and match UPN/object identifiers before any create or update action, handle partial failures, avoid placing credentials in logs and verify results. Do not create cloud duplicates of AD-sourced users.
The setting says No. Why can the action still succeed?
Northstar's security baseline disables member application registration, limits group creation and restricts who can join Windows devices. Yet an operator can still register an application, edit a group or reset an out-of-region user's password. The key is understanding which layer controls each action: member defaults, object ownership, administrator role assignments, administrative-unit scope, or device join settings.
Member and guest defaults
Default permissions for registering apps, creating security or Microsoft 365 groups and inviting guests are distinct from object ownership and administrator roles.
COMMON TRAPDisabling app registration for members does not undo an Application Developer role or an existing application owner's permitted management rights.VERIFYCompare user type, member settings, role grants, owned object IDs, action result and directory audit events.Group creation versus ownership
The member setting for creating new security groups isn't the same as an existing group's owner being allowed to manage that group's assigned membership.
COMMON TRAPA group owner is not automatically a Groups Administrator. Dynamic membership rules have additional roles and support constraints.VERIFYReview creation setting, group type, membership rule, owner IDs and an actual allowed/denied change.Admin role and AU scope
An AU limits supported role actions on member user, group or device objects, but an unrelated tenant-wide role remains additive.
COMMON TRAPPutting a group object in an AU does not put all its users in that AU. The Entra admin portal's browsing restrictions do not replace role scope.VERIFYInventory direct, group and active PIM role assignments, supported actions, target object and the AU's direct members.Device join and device registration
The users-allowed-to-join setting controls supported Entra join flows; device registration, hybrid join, local administrator and Intune compliance are separate concerns.
COMMON TRAPAn Entra join policy doesn't automatically constrain hybrid-joined devices. Device count limits affect joined and registered devices but not hybrid join.VERIFYCheck platform, join type, selected group, join quota, local admin assignment and actual device sign-in/registration.Restrict access to the Microsoft Entra administration portal mainly discourages casual navigation by non-administrators. It does not prevent Microsoft Graph or PowerShell access or block all portal deep links. Use appropriate role assignments, supported security controls and evidence rather than presenting the portal toggle as enforcement.
Validate the baseline without breaking access
Capture the starting permissions
Record current member and group settings, effective direct/group/PIM roles, AU assignments and device join policies before editing anything.
Name exactly what must be blocked
Distinguish creating a new group from editing an owned group, registering an application from managing an existing application, or joining a Windows device from registering it.
Pilot scoped changes
Use approved pilot identities and devices. Preserve emergency administration, break-glass procedures, ownership and a rollback owner.
Prove both sides of the boundary
Test an explicitly permitted operation and an explicitly denied operation for the same scenario. Confirm outcome in Entra audit or sign-in logs as appropriate.
Reconcile and document
Record before/after configuration and results, license/client caveats, help-desk impact, approval and the path to reverse the change.
Change a fictional tenant baseline and work through five Northstar user, group, AU and device-access investigations.
See what an AU really allows—and solve the ticket.
Try the scope boundary simulator, then work four Northstar cases: regional delegation, attribute administration, partial CSV provisioning and supported sign-in branding. Each asks you to choose the safest next action from the available evidence.
What can the delegated admin actually change?
Northstar assigned the Tidewater Staff group object to a regional administrative unit. Try changing membership and role scope to see which users the administrator can manage.
Conceptual simulation of supported user-management role scope, not a live tenant or complete role-permission evaluator. AU scope does not automatically restrict ordinary directory visibility.
Four real-world decisions, from delegation to onboarding.
Examine the evidence, trace the boundary, then choose the action that limits risk while getting the work done.
The regional help desk is accidentally managing another region.
AVAILABLE EVIDENCE
- A group called Tidewater Staff is assigned to the Tidewater administrative unit.
- The AU-scoped Helpdesk Administrator can change the group name but cannot reset a particular member's password.
- The same user also has a tenant-wide User Administrator assignment.
Use the documented permissions and supported workflows.
Administrative scope, licensing and branding features can change. Verify Microsoft's latest prerequisites before applying these decisions in a production Entra tenant.
Scoped in theory. Restricted in practice?
Practice 019 includes 16 concept cards, 16 explained questions and two multi-step Northstar identity investigations, plus a five-checkpoint tenant settings clinic.