AZ-800 Exam Alignment
AZ-800

Manage and maintain AD DS: Design and implement OU structures, protect objects from accidental deletion, delegate administrative control to specific OUs, and verify delegated permissions.

• Know the three common OU design approaches (by location, by department, by object type) and their trade-offs
• Understand that Delegation of Control lets you grant specific admin tasks to users without making them Domain Admins
• Know how to protect objects from accidental deletion and how to remove that protection when needed
• Know that dsacls is the command-line tool for viewing and modifying OU delegation permissions

Exam Tip: AZ-800 tests delegation scenarios heavily. Know the difference between delegating all tasks vs specific tasks (e.g. resetting passwords only). Also know that delegated permissions are NOT visible in ADUC’s standard view — you must use ADSI Edit or dsacls to audit them.

📁 OU Design Principles

OU design is one of the most consequential early decisions in an AD deployment. The structure you choose affects how GPOs are applied, how you delegate administration, and how easy it is to manage objects at scale. The three common approaches each have trade-offs:

🔧 Creating OUs and Protecting Objects

Active Directory Users and Computers
|
techcareers.local OU structure

🌎 techcareers.local

📁 Builtin

💻 Computers

🏗️ Domain Controllers

👤 Users

📁 London

📁 HR

📁 IT

📁 Finance

📁 Manchester

📁 Groups

London OU → HR sub-OU

Name	Type	Protected
Jane Smith	User	✅ Yes
HR-PC01	Computer	✅ Yes
TC-HR-London	Security Group	✅ Yes

ⓘ 🔒 icon in ADUC indicates objects protected from accidental deletion. Right-click → Properties → Object tab to manage.

🔐 Delegation of Control

Delegation of Control lets you grant specific administrative permissions on an OU to a user or group — without adding them to Domain Admins. This is the foundation of least-privilege administration in AD DS.

# Create a nested OU structure
New-ADOrganizationalUnit -Name 'London' -Path 'DC=techcareers,DC=local' -ProtectedFromAccidentalDeletion $true
New-ADOrganizationalUnit -Name 'HR' -Path 'OU=London,DC=techcareers,DC=local' -ProtectedFromAccidentalDeletion $true
New-ADOrganizationalUnit -Name 'IT' -Path 'OU=London,DC=techcareers,DC=local' -ProtectedFromAccidentalDeletion $true

# Remove protection (required before deleting an OU)
Set-ADOrganizationalUnit -Identity 'OU=Finance,OU=London,DC=techcareers,DC=local' -ProtectedFromAccidentalDeletion $false

# Protect an individual user object from accidental deletion
Set-ADObject -Identity 'CN=Jane Smith,OU=HR,OU=London,DC=techcareers,DC=local' -ProtectedFromAccidentalDeletion $true

# View delegation ACEs on an OU
dsacls 'OU=HR,OU=London,DC=techcareers,DC=local'

# Report all OUs that are NOT protected
Get-ADOrganizationalUnit -Filter 'ProtectedFromAccidentalDeletion -eq $false' | Select-Object Name,DistinguishedName

💡 Best Practices

• Enable ProtectedFromAccidentalDeletion on every OU at creation time — it takes one extra parameter and prevents costly mistakes
• Never nest OUs more than 5 levels deep — deep nesting makes GPO inheritance complex and slows down management
• Delegate to groups, not individual users — so that delegation stays valid when people change roles
• Document every delegation made via the wizard — there is no built-in report, so maintain a spreadsheet or use dsacls audits
• Use the custom task option in the wizard for precise delegation (e.g. only the pwdLastSet attribute for password resets)
• Avoid granting Domain Admin rights — almost every administrative task can be delegated at the OU level with proper planning

🎓 Interview Q&A