Administrative Units
Essential Core Knowledge
Overview
Administrative Units (AUs) provide a security boundary between different business, academic, and central IT units in Microsoft Entra ID.
In this context, an “object” in Entra ID typically refers to:
- Users
- Devices
- Groups
To provide an extra layer of security, administration of objects in each AU is gated by just-in-time Privileged Identity Management (PIM) elevation. To make changes to an object in a given AU, an administrator must first PIM-elevate to the appropriate role within that AU.
Important boundary: AUs scope what you can manage in Entra ID (directory objects). Intune access and visibility are governed separately by Intune RBAC (roles, scope tags, and scope groups).
Architecture
Please note: At this time, AUs are being migrated from a single AU per unit to three AUs, and dynamic rule assignments for Users and Devices are still being developed.
Each unit onboarded into Entra will have three AUs created:
| AU Name | Membership type | Description |
|---|---|---|
AU-[FAMIS CODE]-Groups | Assigned | Contains all security groups for a given unit. Groups are statically assigned to an AU, generally at the time that the group is created by an admin. |
AU-[FAMIS CODE]-Devices | Dynamic | Contains all Entra device objects for a given unit. A device object in Entra is related to, but distinct from, its respective device record in Microsoft Intune. Devices are dynamically assigned based on rules, generally using the FAMIS code present in the hostname (e.g., UEM-[Serial Number]). |
AU-[FAMIS CODE]-Users | Dynamic | Contains all Entra user objects associated with a given unit. This allows unit administrators with AU permissions to be scoped limited write permissions to user objects. Dynamic AU assignment for users is still in testing. |
Intune RBAC and AUs
Intune policy and application assignments typically target Microsoft Entra ID security groups (implemented as scope groups).
- Administrative Units (Entra ID): Scope which directory objects (users, groups, devices) an administrator can manage in Entra ID.
- Intune RBAC: Controls what an administrator can view and do in Intune (e.g., create/edit policies and apps, assign them, view managed devices), typically using Intune roles plus scope groups and scope tags.
In practice, administrators generally need:
- Intune RBAC permissions to create/modify the policy or application and perform assignments in Intune; and
- Appropriate Entra ID permissions (often AU-scoped and PIM-eligible) to create, modify, or manage the Entra groups used for assignments (for example, adding/removing members from a scope group).
Note: Being able to manage an object in an AU does not automatically grant Intune permissions. Likewise, having Intune permissions does not automatically grant the ability to manage the underlying Entra objects unless Entra permissions (often AU-scoped) are also granted.