1.3MS-102Advanced

Est: ~15 mins•Verified: 2026-08

Administrative Units (AU) & Cross-Tenant Access Settings

Delegate scoped administration across regional or departmental boundaries using Microsoft Entra Administrative Units (AU) and secure B2B collaboration with Cross-Tenant Access Settings.

Tags:#Microsoft 365#MS-102#Entra ID#Administrative Units#Cross-Tenant#B2B#Zero Trust

Overview

In large, decentralized enterprises or multi-tenant organizations, tenant-wide administrative roles (such as User Administrator or Helpdesk Administrator) violate the principle of least privilege. Microsoft Entra ID provides two architectural solutions:

Administrative Units (AUs): Restrict the administrative scope of directory roles to specific users, groups, or devices. A regional helpdesk lead can reset passwords for EMEA employees only, without touching US employees.
Restricted Management Administrative Units: Protects high-value users (e.g., C-suite, Executives) by blocking standard tenant-wide admins from modifying them unless explicitly assigned to the AU.
Cross-Tenant Access Settings: Controls how users in your organization collaborate with external Microsoft Entra organizations (B2B collaboration and B2B direct connect), including Inbound & Outbound trust settings for MFA and compliant devices.

---

When to Use: Scoped AU vs Tenant-Wide Roles

Scope	Permission Reach	Best Used For
Tenant-Wide Role	Entire directory (all users, groups, and devices).	Global IT architects and centralized identity administrators.
Standard Administrative Unit	Only members explicitly added to the AU (dynamically or assigned).	Regional IT teams (e.g., Germany Branch Helpdesk, APAC Operations).
Restricted Management AU	Blocks tenant-wide admins; only assigned AU admins have access.	Executive protection, security researchers, sensitive project teams.
Cross-Tenant Access	Trust external tenant MFA, compliant devices, or Hybrid Entra Join.	Seamless multi-tenant business partner or subsidiary collaboration.

---

Prerequisites

Administrator Permissions:

Privileged Role Administrator or Global Administrator to create Administrative Units and assign scoped roles.
Security Administrator to modify Cross-Tenant Access Settings.
Microsoft Entra ID P1 or P2 license.

---

Portal Path

TEXT

Microsoft Entra Admin Center (https://entra.microsoft.com)
├── Identity
│   ├── Roles & admins > Administrative units
│   │   ├── + New administrative unit
│   │   ├── Assign roles (Scoped role assignment)
│   │   └── Properties (Restricted management toggle)
│   └── External Identities
│       └── Cross-tenant access settings
│           ├── Default settings (Inbound / Outbound access)
│           └── Organizational settings (Add partner tenant ID / domain)
│               └── Trust settings (Trust MFA from external tenant)

---

Step-by-Step Implementation

Step 1: Create an Administrative Unit for Regional Delegation

Navigate to Microsoft Entra Admin Center > Identity > Roles & admins > Administrative units.
Click + New administrative unit.
Name: AU-EMEA-Operations
Description: Scoped administration for European branch users and devices.
Membership type: Dynamic user or Assigned.

Example Dynamic rule: (user.country -eq "Germany") -or (user.country -eq "France")

Click Next: Assign roles.
Select User Administrator > assign your EMEA Helpdesk Lead.
Click Review + create.

Step 2: Configure Cross-Tenant Inbound Trust Settings

Navigate to External Identities > Cross-tenant access settings.
Under Organizational settings, click + Add organization.
Enter partner tenant domain or Tenant ID (e.g., partnercorp.com).
Click on Inbound access > select Trust settings tab:

Check Trust multifactor authentication (MFA) from Microsoft Entra tenants.
Check Trust compliant devices.
Check Trust Microsoft Entra hybrid joined devices.

Save changes. External users from partnercorp.com will not be prompted for redundant MFA if they already satisfied MFA in their home tenant.

---

Microsoft Graph PowerShell SDK

PowerShell: Deploy Administrative Unit and Scope Role

PowerShell

# Connect to Microsoft Graph
Connect-MgGraph -Scopes "AdministrativeUnit.ReadWrite.All", "RoleManagement.ReadWrite.Directory"

# 1. Create the Administrative Unit
$auParams = @{
    displayName        = "AU-Finance-Department"
    description        = "Scoped delegation for Finance staff"
    membershipRule     = '(user.department -eq "Finance")'
    membershipRuleProcessingState = "On"
}

$newAU = New-MgDirectoryAdministrativeUnit -BodyParameter $auParams
Write-Host "Administrative Unit Created: $($newAU.Id)" -ForegroundColor Green

# 2. Retrieve the User Administrator Role Template
$roleTemplate = Get-MgRoleManagementDirectoryRoleDefinition -Filter "displayName eq 'User Administrator'"

# 3. Assign User Administrator scoped specifically to this AU
$adminUser = Get-MgUser -Filter "userPrincipalName eq 'helpdesk.lead@domain.com'"

$roleAssignment = @{
    principalId     = $adminUser.Id
    roleDefinitionId = $roleTemplate.Id
    directoryScopeId = "/administrativeUnits/$($newAU.Id)"
}

New-MgRoleManagementDirectoryRoleAssignment -BodyParameter $roleAssignment
Write-Host "Assigned User Administrator scoped to AU-Finance-Department." -ForegroundColor Yellow

---

Verification Checklist

VERIFICATION CHECKLIST

0/4 (0%)

Helpdesk admin can reset passwords and update properties of users within their assigned AU.

Attempt by scoped helpdesk admin to modify a user outside their AU returns access denied (Authorization_RequestDenied).

Users belonging to a Restricted Management AU cannot have their passwords reset by tenant-wide User Administrators.

Cross-tenant partner users satisfy Conditional Access MFA requirement seamlessly using their home tenant token.

Common Pitfalls & Troubleshooting Matrix

Issue	Root Cause	Resolution
Scoped admin cannot manage Microsoft 365 Groups	AU scoped admin lacks Groups Administrator role.	Assign both User Administrator and Groups Administrator scoped to the AU if group management is required.
Global Admin blocked from modifying user	Target user is inside a Restricted Management AU.	Explicitly assign the administrator to the Restricted AU; tenant-wide roles are bypassed by design.
External partner user gets repeated MFA prompts	Inbound trust settings do not have Trust MFA enabled for that partner's Tenant ID.	Navigate to Cross-tenant access settings > Partner organization > Inbound > Trust settings and check MFA trust.
Dynamic AU members not updating	Dynamic membership processing delay or incorrect syntax.	Verify rule syntax and monitor processing status in the AU overview page.

---

Real-World Architecture / Flow

Interactive Topology & Workflow

Microsoft Entra Tenantgovernance

Stage 1

Central IT (Global Administrator / Tenant-Wide Scope)

---

Audit & Monitoring

Monitor AU modifications in Entra Audit Logs:
Service: Core Directory
Activity: Add member to administrative unit, Add scoped role membership.
Track cross-tenant sign-in activity:
Service: Sign-in Logs > Filter by Cross-tenant access type: B2B collaboration.

---

Rollback & Emergency Recovery

Deprovision Administrative Unit:

```powershell

Remove-MgDirectoryAdministrativeUnit -AdministrativeUnitId $newAU.Id

```

(Note: Deleting an AU does not delete the user accounts within it; it only deletes the scoping boundary).

---

Official Documentation Reference

---

Exam Blueprint & Pro Tips (MS-102)

Exam Blueprint & High-Yield Traps

MS-102 High-Yield Rules:

AU Boundary: Deleting an Administrative Unit does NOT delete the users, groups, or devices inside it. It only removes the administrative delegation boundary.
Restricted Management AU: The ultimate defense against rogue helpdesk administrators. Standard tenant-wide Global Admins cannot modify users inside a Restricted AU without explicitly assigning themselves to it.
MFA Trust Requirements: Inbound MFA trust requires that the partner organization's tenant issues MFA claims; your Conditional Access policies recognize these claims without re-prompting the user.

PREVIOUS TOPIC1.2 Privileged Identity Management (PIM) & JIT Access NEXT TOPIC2.1 Entra Connect Sync: Password Hash Sync & Staging