Edit

Remove users, groups, or devices from an administrative unit

  • Article
  • 2 minutes to read

When users, groups, or devices in an administrative unit no longer need access, you can remove them.

Prerequisites

  • Azure AD Premium P1 or P2 license for each administrative unit administrator
  • Azure AD Free licenses for administrative unit members
  • Privileged Role Administrator or Global Administrator
  • AzureAD module when using PowerShell
  • AzureADPreview module when using PowerShell for devices
  • Admin consent when using Graph explorer for Microsoft Graph API

For more information, see Prerequisites to use PowerShell or Graph Explorer.

Azure portal

You can remove users, groups, or devices from administrative units individually using the Azure portal. You can also remove users in a bulk operation.

Remove a single user, group, or device from administrative units

  1. Sign in to the Azure portal.

  2. Select Azure Active Directory.

  3. Select one of the following:

    • Users
    • Groups
    • Devices > All devices

  4. Select the user, group, or device you want to remove from an administrative unit.

  5. Select Administrative units.

  6. Add check marks next to the administrative units you want to remove the user, group, or device from.

  7. Select Remove from administrative unit.

    Screenshot of Devices and Administrative units page with Remove from administrative unit option.

Remove users, groups, or devices from a single administrative unit

  1. Sign in to the Azure portal.

  2. Select Azure Active Directory.

  3. Select Administrative units and then select the administrative unit that you want to remove users, groups, or devices from.

  4. Select one of the following:

    • Users
    • Groups
    • Devices

  5. Add check marks next to the users, groups, or devices you want to remove.

  6. Select Remove member, Remove, or Remove device.

    Screenshot showing a list users in an administrative unit with check marks and a Remove member option.

Remove users from an administrative unit in a bulk operation

  1. Sign in to the Azure portal.

  2. Select Azure Active Directory.

  3. Select Administrative units and then select the administrative unit that you want to remove users from.

  4. Select Users > Bulk operations > Bulk remove members.

    Screenshot showing the "Bulk remove members" link on the "Users" pane.

  5. In the Bulk remove members pane, download the comma-separated values (CSV) template.

  6. Edit the downloaded CSV template with the list of users you want to remove.

    Add one user principal name (UPN) in each row. Don't remove the first two rows of the template.

  7. Save your changes and upload the CSV file.

  8. Select Submit.

PowerShell

Use the Remove-AzureADMSAdministrativeUnitMember command to remove users or groups from an administrative unit.

Use the Remove-AzureADMSAdministrativeUnitMember (Preview) command to remove devices from an administrative unit.

Remove users from an administrative unit

$adminUnitObj = Get-AzureADMSAdministrativeUnit -Filter "displayname eq 'Test administrative unit 2'"
$userObj = Get-AzureADUser -Filter "UserPrincipalName eq 'bill@example.com'"
Remove-AzureADMSAdministrativeUnitMember -Id $adminUnitObj.Id -MemberId $userObj.ObjectId

Remove groups from an administrative unit

$adminUnitObj = Get-AzureADMSAdministrativeUnit -Filter "displayname eq 'Test administrative unit 2'"
$groupObj = Get-AzureADGroup -Filter "displayname eq 'TestGroup'"
Remove-AzureADMSAdministrativeUnitMember -Id $adminUnitObj.Id -MemberId $groupObj.ObjectId

Remove devices from an administrative unit

Remove-AzureADMSAdministrativeUnitMember -ObjectId $adminUnitId -MemberId $deviceObjId

Microsoft Graph API

Use the Remove a member API to remove users or groups from an administrative unit.

Use the Remove a member (Beta) API to remove devices from an administrative unit.

Remove users from an administrative unit

DELETE https://graph.microsoft.com/v1.0/directory/administrativeUnits/{admin-unit-id}/members/{user-id}/$ref

Remove groups from an administrative unit

DELETE https://graph.microsoft.com/v1.0/directory/administrativeUnits/{admin-unit-id}/members/{group-id}/$ref

Remove devices from an administrative unit

DELETE https://graph.microsoft.com/beta/administrativeUnits/{admin-unit-id}/members/{device-id}/$ref

Next steps