🎯 Entra ID Course · Module 4 of 8
Roles & Administrative Units
SC-300 Exam Alignment
SC-300
Implement and manage user identities / Implement authentication and access management: Assign built-in and custom Entra ID roles, implement least-privilege access, create and manage Administrative Units, and understand PIM-eligible vs active role assignments.
- Know the key built-in roles and what each can/cannot do — especially the difference between User Admin and Privileged Auth Admin
- Understand that Entra ID roles and Azure RBAC roles are completely separate role systems
- Know what Administrative Units are, how they scope admin permissions, and what a Restricted Management AU does
- Understand Active vs Eligible role assignments and that PIM eligible assignments require Entra ID P2
Exam Tip: The SC-300 exam tests role selection under least-privilege. A common trap: the User Administrator role can manage users and groups but cannot manage users who have directory roles or reset passwords for privileged admins. For that, Privileged Authentication Administrator is required. Know these boundaries precisely.
Microsoft Entra ID uses a role-based access control (RBAC) system with over 100 built-in roles that control what administrators can do in the directory. Assigning the right role — following least privilege — is a critical security practice. Administrative Units let you scope these roles to a subset of the directory, enabling delegation without granting tenant-wide permissions.
🔑 Entra ID RBAC vs Azure RBAC
⚠️ Two Separate Role Systems
- Microsoft Entra ID roles control identity and directory operations — managing users, groups, apps, CA policies, and Entra settings. Assigned in the Entra admin center or via Graph PowerShell
- Azure RBAC roles control Azure resource management — virtual machines, storage accounts, subscriptions. Assigned in the Azure portal (portal.azure.com)
- A Global Administrator in Entra ID does NOT automatically have Owner or Contributor rights on Azure subscriptions — Azure resource access must be explicitly granted
- However, Global Admins CAN elevate themselves to User Access Administrator on Azure subscriptions if needed (via a setting in Entra ID Properties)
📋 Key Built-in Entra ID Roles
| Role | Can Do | Cannot Do |
|---|---|---|
| Global Administrator | Everything — full access to all features, can reset passwords for any user including other Global Admins | Azure resource management (unless elevated) |
| Global Reader | Read-only access to all settings and reports in the tenant — equivalent read view of Global Admin | Make any changes, reset passwords |
| User Administrator | Create/edit/delete users and groups, reset passwords for non-admin users, manage licences | Manage users who have any directory role, reset passwords of Global Admins or Password Admins |
| Password Administrator | Reset passwords for non-admin users and other Password Administrators | Manage users, create groups, reset passwords for admins above their tier |
| Authentication Administrator | Reset authentication methods and passwords for non-privileged users | Manage authentication methods for users with privileged roles |
| Privileged Authentication Administrator | Reset authentication methods and passwords for ALL users including Global Admins | Global admin operations beyond auth method management |
| Security Administrator | Manage all security features — Conditional Access, Identity Protection, Defender XDR, Secure Score | User management, licence management |
| Conditional Access Administrator | Create, edit, and delete Conditional Access policies and named locations | View sign-in logs, manage users |
| Groups Administrator | Create, edit, delete all groups and group settings including expiration and naming policies | Assign Entra ID roles to users |
| Licence Administrator | Assign and remove licences from users and groups, manage subscription and service plans | Purchase or modify subscriptions |
| Helpdesk Administrator | Reset passwords and manage service requests for non-admin users | Manage users with roles, create groups |
| Application Administrator | Create and manage all app registrations and enterprise apps including credentials | Manage Conditional Access, Identity Protection |
Entra admin center › Identity › Roles & admins
👤 Identity
Users
Groups
Roles & admins
Administrative units
User Administrator — Assignments
🏛️ Administrative Units
Administrative Units (AUs) are containers in Entra ID that let you scope administrator permissions to a subset of users, groups, or devices. Without AUs, role assignments apply to the entire directory. With AUs, you can assign a role so it only applies within that AU — for example, a User Administrator scoped to the HR Administrative Unit can only manage HR users.
| Feature | Without AUs | With Administrative Units |
|---|---|---|
| Role scope | Directory-wide — admin can manage any user | AU-scoped — admin can only manage users in their AU |
| Use case | Small org or centralised IT team | Large orgs, regional IT teams, multi-division companies |
| Restriction | No restriction on who the admin can manage | Admin cannot see or manage users outside their AU |
| Licence required | Free | Entra ID P1 |
Types of Administrative Units
📦 Standard vs Restricted Management AUs
- Standard AU: Scopes admin role assignments. Users in the AU can also be managed by directory-scoped admins (e.g., a Global Admin or directory-scoped User Admin can still manage AU members)
- Restricted Management AU (preview): Members can ONLY be managed by admins explicitly scoped to that AU. Even Global Admins are blocked from modifying members. Use for highly sensitive accounts (executives, finance, security team) that must be isolated from general admin access
🔓 Active vs Eligible Role Assignments (PIM)
With Privileged Identity Management (PIM, requires Entra ID P2), role assignments can be Active or Eligible:
| Assignment Type | How It Works | When to Use |
|---|---|---|
| Active (Permanent) | Role is always active — the user has the permissions continuously with no action required | Service accounts, break-glass accounts, roles needed continuously for daily work |
| Active (Time-limited) | Role is active but expires after a specified date — automatically removed on expiry | Temporary contractors, project-based access, guest admins |
| Eligible (PIM) | User must explicitly activate the role when needed. Activation typically requires MFA, justification, and has a max duration (e.g., 8 hours). Role deactivates automatically | Most privileged roles — Global Admin, Security Admin, User Admin. Best practice for all admin roles |
PowerShell — Role Management via Microsoft Graph
Connect-MgGraph -Scopes 'RoleManagement.ReadWrite.Directory' # List all built-in Entra ID roles Get-MgRoleManagementDirectoryRoleDefinition | Select-Object DisplayName,Description | Sort-Object DisplayName # Find a specific role by name \$role = Get-MgRoleManagementDirectoryRoleDefinition -Filter "DisplayName eq 'User Administrator'" # Assign the role to a user (directory scope = '/') New-MgRoleManagementDirectoryRoleAssignment -RoleDefinitionId \$role.Id -PrincipalId '<user-object-id>' -DirectoryScopeId '/' # Create an Administrative Unit New-MgDirectoryAdministrativeUnit -DisplayName 'London Office' -Description 'AU for London-based users' # List all AUs Get-MgDirectoryAdministrativeUnit | Select-Object DisplayName,Description,Id
💡 Best Practices
- Follow least privilege strictly — assign the most specific role that allows the task. Avoid Global Administrator for tasks that can be done with User Administrator or Licence Administrator
- Keep the number of permanent active Global Administrators to an absolute minimum — Microsoft recommends no more than 2-4 per tenant, all using PIM eligible assignments except for break-glass accounts
- Create at least two break-glass Global Administrator accounts — cloud-only, excluded from all CA policies, with a very strong password stored securely (e.g., sealed envelope in a safe). Monitor them with alerts for any sign-in activity
- Use Administrative Units for regional or departmental IT teams — scope their User Administrator or Password Administrator role to their region's AU only, preventing accidental or malicious access to users outside their remit
- Periodically review all role assignments using Access Reviews (Governance → Access Reviews) — permanent active assignments to privileged roles should be reviewed quarterly
🎓 Interview Q&A
Q: What is the difference between the Authentication Administrator and the Privileged Authentication Administrator roles?
The Authentication Administrator can reset authentication methods and passwords for non-privileged users only — users who do not hold any Entra ID directory role. The Privileged Authentication Administrator can reset authentication methods and passwords for all users including Global Administrators. This distinction matters for security — if an attacker gained access to a Privileged Authentication Administrator account, they could take over any account in the tenant including Global Admins. The Privileged Authentication Administrator role should be treated as a highly sensitive role, assigned via PIM with tight controls.
Q: An organisation has regional IT teams for three offices. Each team should only be able to manage users in their own office. How would you implement this?
Create three Administrative Units — one per office (e.g., London AU, New York AU, Singapore AU). Add each office's users to the corresponding AU. Assign the User Administrator role to each regional IT team scoped to their AU only. This means the London IT team gets User Administrator scoped to London AU — they can manage London users' passwords, licences, and profile attributes but cannot see or manage users in New York or Singapore. This requires Entra ID P1 for AU functionality.
🎯 SC-300 Mock Test
Module 4 — Roles & Administrative Units
5 questions · Scenario-based · Pass mark: 70%
Question 1 of 5
A help desk technician needs to reset passwords for regular employees but should NOT be able to reset passwords for any user who holds an admin role. Which role should they be assigned?
AGlobal Administrator
BPrivileged Authentication Administrator
CPassword Administrator
DUser Administrator
Question 2 of 5
The organisation's Global Administrator also needs to manage Azure virtual machines and storage accounts in an Azure subscription. What additional access do they need?
ANo additional access needed — Global Administrator in Entra ID includes full Azure resource management rights
BThe administrator needs to be assigned an Azure RBAC role (Owner or Contributor) on the Azure subscription — Entra ID roles do not grant Azure resource permissions
CThe administrator needs the Azure Administrator role assigned in Entra ID
DGlobal Administrator automatically gets read-only access to Azure — a separate licence upgrade grants write access
Question 3 of 5
What is the minimum Entra ID edition required to create Administrative Units and scope role assignments to them?
AEntra ID Free
BEntra ID P2
CMicrosoft Entra Governance
DEntra ID P1
Question 4 of 5
An administrator is assigned the User Administrator role scoped to the "Finance" Administrative Unit. What can this administrator do?
AManage users who are members of the Finance AU — reset passwords, update profiles, assign licences. Cannot manage users outside the Finance AU
BManage all users in the tenant but can only view Finance AU members in reports
COnly view Finance AU members — cannot make changes without Global Admin approval
DManage all Finance AU users and also create new Conditional Access policies for Finance users
Question 5 of 5
Using PIM, an administrator is given an "Eligible" assignment for the Security Administrator role with a max activation duration of 4 hours. What must happen before they can use Security Administrator permissions?
ANothing — eligible assignments are automatically active and permissions are always available
BSubmit a support ticket to Microsoft to activate the role
CGet approval from their manager via email — the role activates once the email is forwarded to Microsoft
DActivate the role in PIM (Governance → Privileged Identity Management → My roles) — must complete MFA and provide a justification. The role is then active for up to 4 hours
🔒
This module is locked — Complete Module 3 and pass its mock test to unlock this module.
Complete the quiz above (70%+) to unlock Module 5: Authentication Methods & SSPR