Exercise - Scope Relecloud's regional HR admin with an administrative unit

  • 12 minutes

Relecloud's new overseas office needs a regional HR admin scoped to just that office's users—nothing else in the directory. You've just learned the group-scoping gap and the dynamic-unit single-object-type constraint—now build the administrative unit yourself.

Important

Prerequisites for this exercise:

  • Access to a Microsoft Entra tenant with Privileged Role Administrator (or Global Administrator) permissions.
  • Microsoft Entra ID P1 licensing on the users who'll match the dynamic-membership rule.
  • A second account to receive the delegated Helpdesk Administrator role, and at least one test user whose attributes (for example, department or usageLocation) identify them as belonging to the new office.

If your lab tenant doesn't support dynamic group licensing, complete the administrative unit creation with a static membership rule instead, and read through the dynamic-rule step to see the syntax.

Task 1: Create a dynamic administrative unit for the new office

  1. Sign in to the Microsoft Entra admin center at entra.microsoft.com with your Privileged Role Administrator account.

  2. Select Identity > Roles & administrators > Administrative units, then select Add.

  3. Name the unit Relecloud – New Office HR, add a description, and select Next.

  4. Choose Users—an administrative unit's dynamic membership rule can only target a single object type, and this HR admin needs to manage user accounts, not devices or groups.

  5. Set the dynamic membership rule to match the new office, for example:

    (user.department -eq "New Office HR") or (user.usageLocation -eq "SG")

  6. Review and create the administrative unit. Confirm your test user appears under Members after the rule evaluates (this can take a few minutes).

Task 2: Assign a delegated, scoped role

  1. Open the administrative unit you just created, then select Roles and administrators.
  2. Select Helpdesk Administrator, then Add assignments.
  3. Add the second account you set aside as the regional HR admin, and confirm the assignment.
  4. Confirm the assignment shows Scope: Relecloud – New Office HR on the role's assignment details—not the tenant-wide scope Helpdesk Administrator would otherwise carry.
  5. Reflect: sign in as this account (or review its effective permissions) and confirm it can reset passwords and manage users inside the administrative unit, but has no visibility into users outside it. That's the least-privileged outcome a plain group could never deliver—a security group can hold members, but it can't be the scope of a role assignment the way an administrative unit can.

You've now scoped a delegated HR admin to exactly the new office's users with a dynamic administrative unit—precisely the least-privileged boundary Relecloud's overseas expansion needs.