Lesson 7 — Microsoft Entra Roles and Administrative Units
Not every administrator should be a Global Administrator.
Microsoft Entra provides built-in administrative roles that assign specific permissions, while Administrative Units can restrict where those permissions apply.
This lesson explains role-based administration, least privilege, scoped delegation, common administrator roles and the investigation process used when unexpected privileged assignments or administrative changes appear.
What you will learn
This lesson explains how Entra roles define administrative capability and how Administrative Units limit administrative scope.
Learning objectives
After completing this lesson, you should be able to explain how Microsoft Entra assigns and scopes administrative permissions.
- Explain the purpose of Microsoft Entra roles.
- Apply the principle of least privilege.
- Recognise important built-in administrator roles.
- Explain how Administrative Units scope administration.
- Investigate unexpected role assignments and privileged changes.
The problem this solves
Giving every administrator broad tenant-wide permissions creates unnecessary exposure.
Microsoft Entra roles separate administrative duties, while Administrative Units help limit those duties to specific users, groups or devices.
What are Microsoft Entra roles?
Microsoft Entra roles are collections of permissions used to administer identity, access, applications, security and directory resources.
Instead of granting unrestricted control, organisations can assign a role that matches a specific operational responsibility.
Administrative convenience should never be the reason someone receives Global Administrator.
Least privilege
Least privilege means granting only the permissions required to perform an approved task.
The assignment should also be limited by time, scope and business need wherever possible.
Separation of duties
Separation of duties reduces the chance that one account can perform every sensitive action without oversight.
For example, the person approving privileged access does not always need to be the same person receiving it.
Broad privilege compared with least privilege
| Broad administration | Least-privilege administration |
|---|---|
| Many permanent Global Administrators | Specific roles assigned for defined duties |
| Tenant-wide access by default | Administrative scope limited where possible |
| Permissions remain active continuously | PIM provides eligible, time-limited activation |
| Difficult to determine why access exists | Assignments are justified, reviewed and audited |
| One compromise can affect the entire tenant | Reduced blast radius and clearer accountability |
Common built-in Microsoft Entra roles
| Role | Typical responsibility | Security consideration |
|---|---|---|
| Global Administrator | Full access to Microsoft Entra administrative features. | Keep assignments extremely limited and protect with PIM, MFA and Conditional Access. |
| Privileged Role Administrator | Manages role assignments and Privileged Identity Management. | Can influence who receives powerful administrative access. |
| User Administrator | Manages users, groups and selected password reset activities. | May affect account lifecycle and access through group membership. |
| Security Administrator | Manages security configuration and reviews security information. | Powerful security role but not equivalent to full tenant administration. |
| Authentication Administrator | Manages authentication methods for non-privileged users. | Authentication method changes can affect account recovery and takeover risk. |
| Privileged Authentication Administrator | Manages authentication methods for all users, including privileged accounts. | Highly sensitive because it can alter strong authentication for administrators. |
| Cloud Application Administrator | Manages enterprise applications and application registrations. | Application permissions and credentials can create persistent access. |
| Helpdesk Administrator | Performs limited password resets and support tasks. | Useful for support teams when broader user administration is unnecessary. |
| Conditional Access Administrator | Creates and manages Conditional Access policies. | Policy changes can weaken or strengthen tenant-wide access controls. |
| Global Reader | Provides read-only visibility across many administrative features. | Useful for audits and investigations without granting change permissions. |
Global Administrator
Global Administrator is the broadest Microsoft Entra role and can manage almost every aspect of the tenant.
Organisations should maintain only a small number of carefully protected accounts with this capability.
Privileged Role Administrator
This role manages Entra role assignments and PIM configuration.
Because it can grant privilege to others, it requires the same level of monitoring and protection as other highly privileged roles.
User and Helpdesk roles
User Administrator supports broader identity lifecycle tasks, while Helpdesk Administrator provides narrower support capabilities.
Choose the smaller role when the operational requirement is limited to routine support.
Authentication roles
Authentication Administrator and Privileged Authentication Administrator can change authentication methods.
These changes should be monitored because adding a new method can provide another route into an account.
How role assignments are made
Direct assignments may be simple, but group-based and PIM-managed assignments often provide better governance, review and consistency.
Active assignments
An active assignment provides the role permissions immediately.
Permanent active assignments increase standing privilege and should be limited to genuine operational requirements.
Eligible assignments
An eligible assignment requires the user to activate the role through PIM before administrative permissions become available.
Activation can require MFA, justification, approval and a limited duration.
What are Administrative Units?
Administrative Units are Microsoft Entra containers used to organise directory resources and delegate management over a limited scope.
They are useful when regional, departmental, campus or business-unit administrators should manage only a defined subset of the organisation.
Scoped administration
A scoped role assignment combines an administrator role with an Administrative Unit.
The administrator receives the role capability only for the objects contained within that unit, where the role and object type support scoping.
Administrative Unit membership
Users, groups and devices can be organised into Administrative Units depending on the supported scenario.
Membership design should reflect how administration is actually delegated, not simply mirror an organisational chart without purpose.
Where Administrative Units help
| Scenario | Example delegation |
|---|---|
| Regional operations | Melbourne support staff manage Melbourne users without managing Sydney users. |
| Education | Campus administrators manage identities for their own school or campus. |
| Business divisions | HR or operational administrators manage users in a defined division. |
| Service providers | Delegated operators manage a defined customer or organisational segment. |
| Sensitive populations | Restricted Administrative Units can provide stronger protection for selected high-value users. |
Administrative Units are not separate tenants
Administrative Units delegate management scope inside one Microsoft Entra tenant.
They do not create separate security boundaries, directories or independent tenants.
Scope limitations matter
Not every Entra role or administrative action supports Administrative Unit scoping.
Always confirm whether the role and resource type behave as expected before relying on the scope as a control.
Secure role design workflow
Investigating suspicious administrator activity
The role assignment tells you what the account could do. The audit trail tells you what it actually did.
Review the assignment
Determine who assigned the role, which role was granted, whether the assignment was permanent and what scope applied.
Check for a ticket, approval, justification and expected change window.
Review the sign-in
Inspect the administrator's IP address, device, location, authentication details, risk level and Conditional Access result.
A legitimate role assignment can still be abused if the administrator account or session was compromised.
Real-world investigation scenario
The analyst should preserve the audit evidence, revoke sessions, contain affected accounts, review every change made after the assignment and determine whether additional persistence was created.
Role-assignable groups
Role-assignable groups allow selected Entra roles to be assigned through controlled group membership.
Changes to these groups are privileged events and should be monitored as closely as direct role assignments.
Service principals and applications
Applications and service principals can hold powerful directory or workload permissions even when no human administrator role is visible.
Privileged access reviews should include application permissions, credentials and ownership.
Common mistakes
| Mistake | Why it creates risk | Better practice |
|---|---|---|
| Giving Global Administrator for convenience | The account receives far more power than the task requires. | Select the smallest role that supports the approved task. |
| Using permanent active assignments | Privilege remains available even when it is not needed. | Use PIM eligible assignments and short activation windows. |
| Ignoring Administrative Units | Regional or departmental administrators receive unnecessary tenant-wide scope. | Apply scoped role assignments where supported. |
| Never reviewing role assignments | Stale access accumulates as people change jobs or leave. | Run periodic access reviews and remove obsolete assignments. |
| Monitoring only Global Administrator | Other roles can reset authentication, alter applications or weaken access controls. | Monitor all sensitive roles and role-assignable groups. |
| Assuming a role assignment is the full story | Attackers may use applications, groups or workload permissions instead. | Review directory roles, groups, applications and post-assignment activity together. |
Key takeaways
- Microsoft Entra roles divide administrative permissions into defined responsibilities.
- Global Administrator should be rare, protected and normally activated through PIM.
- Least privilege reduces both attack surface and the impact of compromise.
- Administrative Units can restrict supported administrative roles to selected directory objects.
- Role assignments should be time-limited, justified, reviewed and auditable.
- Investigations must correlate role assignments, sign-ins, audit activity and downstream administrative changes.
Related Agent Foskett resources
Continue learning
Microsoft Entra Roles and Administrative Units
Microsoft Entra roles provide delegated administrative permissions for users, security, authentication, applications, Conditional Access and privileged role management.
Microsoft Entra Academy Lesson 7 — Roles and Administrative Units
This Agent Foskett Microsoft Entra Academy lesson explains built-in administrator roles, least privilege, scoped delegation, Administrative Units and privileged assignment investigations.
