Microsoft 365 administrative units: scope admins by country or subsidiary

Administrative units in Microsoft 365 let you limit an admin role to part of your tenant, such as one country, region or subsidiary. A country IT admin can then reset passwords, manage licences and edit accounts for their own people only. Administrative units are set up in Microsoft Entra ID, and each service decides how far it honours them.

One tenant often serves several countries or companies. Head office wants one set of rules, local IT wants to handle its own users without raising a ticket, and nobody wants a regional admin who can change an executive's account or browse another subsidiary's data. A separate tenant per country solves delegation but splits collaboration, so most organisations segment the tenant they already have. Our Microsoft 365 governance page shows where administrative units sit next to the other native tools.

This guide covers what administrative units do, which roles can be scoped, where scoping stops in Teams, Exchange, SharePoint and Purview, and how each country or subsidiary can get its own view of governance while the rules stay central.

What is an administrative unit in Microsoft 365?

An administrative unit is a Microsoft Entra ID container that holds users, groups or devices. When you assign a role to an admin with administrative unit scope, that admin can use the role only on the members of the unit. The same role assigned without a unit applies to the whole tenant.

A few rules shape every design:

• Administrative units cannot be nested, so there is no "Europe, then Germany, then Munich" hierarchy. A user can belong to several units, for example one per country and one per division.
• Adding a group to a unit brings the group into scope, not its members. For a scoped admin to manage the people, add the users themselves.
• Scoped Helpdesk, Password, Authentication and User Administrators act only on users who hold no admin role: they cannot reset another admin's password or change their authentication methods.
• A scoped role applies to members only, never to tenant-wide settings. A Groups Administrator scoped to a unit cannot change group expiration or naming policies.

Microsoft's own example is a university where each school has its own IT team. The same pattern fits a group with one subsidiary per country.

How do I let a country IT admin manage only their own users?

Create one administrative unit per country, fill it with that country's users, then give the local admins a scoped role. Common choices are Helpdesk Administrator for password resets, User Administrator for accounts and License Administrator for licences.

You can fill a unit by hand or with a dynamic membership rule that uses the same attributes as dynamic groups, such as user.country -eq 'Germany' or the company name. People who join or move are then picked up without anyone editing a list, as long as the attributes in Microsoft Entra ID are right. A dynamic unit holds users or devices, not both, and dynamic rules for groups are not supported.

The licensing is modest but real:

• Each admin assigned a role over an administrative unit needs Microsoft Entra ID P1. Members only need the Free tier, and creating units needs no paid licence.
• Dynamic units need P1 for every unique user who is a member of one, counted across the tenant.

In the Microsoft 365 admin center, a scoped admin manages users, licences, sign-in blocking and Microsoft 365 groups in their units. Multifactor authentication methods, other group types and devices are handled in the Microsoft Entra admin center or PowerShell instead.

Does a scoped admin only see their own users?

No. Administrative units limit what an admin can change, not what they can see. The Microsoft 365 admin center filters out users outside the admin's units, but the same admin can still browse other users, groups and resources in the Microsoft Entra admin center, in PowerShell and in other Microsoft services, through default user permissions. Directory read access cannot be scoped to a unit either.

So if each subsidiary should see only its own part of the tenant, administrative units alone do not get you there. They control management rights. Who sees which inventory, reports and findings has to be handled at another layer, covered below.

Which Entra ID admin roles can be scoped to an administrative unit?

Only some. Microsoft's list of roles that can be assigned with administrative unit scope includes:

• Helpdesk, Password, User, Authentication and Privileged Authentication Administrator
• Groups Administrator and License Administrator
• Cloud Device Administrator, Printer Administrator and Teams Devices Administrator
• SharePoint Administrator and Teams Administrator, with reduced rights
• Attribute Assignment Administrator and Reader, plus custom roles whose permissions apply to users, groups or devices

What the list leaves out matters as much. Exchange Administrator, Power Platform Administrator and AI Administrator are not on it. A SharePoint Administrator scoped to a unit manages the unit's Microsoft 365 groups and can change the name, URL and external sharing of their connected sites from the Microsoft 365 admin center, but cannot use the SharePoint admin center or SharePoint APIs to manage sites.

How do I stop a Global Admin or the helpdesk from changing sensitive accounts?

Use a restricted management administrative unit. Objects inside it can only be changed by admins assigned at the scope of that unit. Tenant-wide admins, Global Administrators included, are blocked unless they assign themselves a role on the unit, and that assignment is recorded in the Microsoft Entra audit log.

Microsoft gives three uses: protecting executive accounts from helpdesk password resets, keeping sensitive security groups away from tenant-wide group admins, and making sure certain resources are managed only by admins in a specific country or region.

The limits are strict, so plan before you switch it on:

• The restricted setting is chosen when the unit is created and cannot be changed afterwards.
• Members can be users, devices and security groups. Microsoft 365 groups, mail-enabled security groups and distribution groups cannot.
• It blocks changes to Microsoft Entra properties only. Exchange mailbox settings, Intune policies on devices and SharePoint site owners can still be changed by the usual admins.
• Users and groups inside cannot be managed with Microsoft Entra ID Governance features such as access reviews, entitlement management, lifecycle workflows or Privileged Identity Management for groups.
• A tenant can have up to 100 restricted management administrative units.

Microsoft warns that this restriction can break existing workflows, so start with a few accounts and test.

Does scoping work in Teams, Exchange, SharePoint and Purview?

Partly, and each service does it its own way. Administrative units are defined once in Microsoft Entra ID, but every workload decides how far it honours them.

• Teams. Teams admin roles can be scoped to administrative units. A scoped admin manages users in their units, assigns their policies and Direct Routing numbers, and sees PSTN usage reports and Call Quality Dashboard data for them. Teams and channel settings, guest and external access, apps, auto attendants, call queues, Calling Plan and Operator Connect numbers, and tenant-level settings stay out of reach for now. In the Teams admin center a scoped admin works on one unit at a time, while Teams PowerShell covers several at once.
• Exchange Online. Exchange has its own permission model. The Exchange Administrator role in Microsoft Entra ID maps to the Organization Management role group, which covers the whole Exchange organisation. To scope an Exchange admin, you create an Exchange role assignment limited to an administrative unit, a group or a custom recipient scope with New-ManagementRoleAssignment in PowerShell.
• SharePoint. As seen above, a scoped SharePoint Administrator does not manage sites in the SharePoint admin center. For compliance, Microsoft Purview can associate SharePoint sites with an administrative unit through a query on site URL, site name or a refinable property, for data loss prevention and auto-labelling policies only. A new query can take up to five days to populate.
• Microsoft Purview. Role groups for data loss prevention, sensitivity labels, retention, records management, Communication Compliance and Insider Risk Management can be restricted to administrative units, and alerts, Activity explorer and audit search follow that scope. Restricted admins do not see policies created before the restriction, nor historical data. It needs Microsoft Entra ID P1 plus a Microsoft 365 E5 licence or an E5 or F5 Purview add-on.
• Power Platform and Copilot. Power Platform Administrator and AI Administrator are not on Microsoft's list of roles that can be scoped to an administrative unit. Power Platform delegation goes through environments instead, which our guide to Power Platform governance for Copilot Studio covers.

The table sums up what each service lets you delegate by country or subsidiary today.

Is Multi-Geo the same as delegating admin by geography?

Mostly not, although it adds one form of delegation. Microsoft 365 Multi-Geo is about where data is stored: it places users' Exchange, OneDrive, SharePoint, Teams and Copilot data in the geographies you choose, while the tenant keeps a single administration. It also lets you name geo administrators who manage the SharePoint and OneDrive settings of one geography, set in SharePoint PowerShell, while Global and SharePoint Administrators keep access to every geography.

Multi-Geo is an add-on licensed for at least 5% of eligible users, and tenants that buy or use it fall outside the EU Data Boundary. Accounts, licences, Teams, Exchange and Purview are still delegated through administrative units and each service's own roles.

Where does native tenant segmentation stop?

Put together, administrative units give you delegated management rights, not a segmented tenant. Four gaps show up in most multinational or multi-company tenants:

• One model per service. Entra roles, Exchange role assignments, Teams scoped roles and Purview role groups are set up separately, often in different consoles or only in PowerShell. Keeping them aligned as countries and admins change is manual work.
• No regional view. A country admin has no single view of their teams, sites, guests, apps and agents with their own findings. Admin center reports are mostly tenant-wide, apart from the Teams PSTN and call quality data that scoped Teams admins see.
• Visibility is not restricted. Scoped admins still browse the rest of the directory. If one subsidiary must not see another subsidiary's objects, the native tools do not enforce that.
• Gaps in coverage. Outside Multi-Geo geo administrators, SharePoint site management cannot be delegated by country, and the Power Platform and AI Administrator roles cannot be scoped to an administrative unit.

The result is often the opposite of the plan: head office keeps doing local work because local admins cannot, or local admins get tenant-wide roles "for now".

What does tenant segmentation add?

Tenant segmentation, in a governance tool, splits one tenant into segments, each with its own admins and its own view of governance, while the rules stay central:

• A segment is a rule, not a list. It is defined by Microsoft Entra ID attributes such as country, company or department, and re-evaluated each time the tenant is scanned. New or moved users land in the right segment at the next scan, without anyone maintaining a list.
• The same rules everywhere. Head office defines the governance rules once, and every segment is checked against them, so a subsidiary does not drift to a looser guest or sharing policy unnoticed.
• Each admin sees their own segment. Inventory, policy findings, dashboards and reports are cut to the segment, and admins assigned to one segment do not see the others.

Segmentation does not replace administrative units. You still need them, and each service's roles, to decide who can change what in Microsoft 365. Segmentation decides who sees and follows up which part of the governance work.

How do you plan a segmented tenant?

1. Fix the attributes first. Country, company and department in Microsoft Entra ID drive both dynamic administrative units and segments. If that data is incomplete, the segments will be too.
2. Choose one axis. Segment the way the business is run: by subsidiary when the companies are separate, by country when IT is organised locally. Mixing axes multiplies units and roles.
3. Map the roles per service. For each local admin, write down the scoped Entra role, the Exchange role assignment and the Teams role they need, and accept that some tasks stay central.
4. Protect what must not move. Put executive accounts and sensitive security groups in a restricted management unit, and test before you widen it.
5. Keep rules central, decisions local. One rule set for the tenant, with local admins and owners acting on the findings in their segment.
6. Review the scopes. Admins change roles, and subsidiaries are bought and sold. Check on a schedule you set that each segment and scoped role still matches the organisation.

If you are setting up governance from scratch, our Microsoft 365 governance best practices give the order we apply the rules in.

What can you automate, and what stays human?

Good candidates for automation:

• Membership of units and segments, driven by Microsoft Entra ID attributes instead of lists kept by hand
• Checks of the same rules across the tenant on a schedule you set, with findings routed to the owners
• Evidence exported on a schedule or on demand

What should stay with people:

• The segmentation design, and who gets which scoped role
• Exceptions a subsidiary asks for, and the reason for each
• Who may be assigned to a restricted management unit, and when

How Neptune helps

Neptune is an integrator. We select the governance tool that fits your tenant, implement it with your team, train your admins and stay with you afterwards: professional services during the engagement, then a customer success manager. The native Microsoft controls, administrative units included, stay in place; we configure them and build on them. With the tools we integrate:

• Rules stay central while each subsidiary or country admin works only on their own scope, with the inventory, findings and reports for their part of the tenant
• One inventory of teams, sites, apps, flows and agents, with policies for every type of object, ranked by severity
• Owners who review access in Teams by a deadline, with each decision logged with its reason
• Violations tracked by service over time, with evidence exported on a schedule or on demand

See how this fits with the native tools on our Microsoft 365 governance page, or talk to us about your tenant.

Sources

• Administrative units in Microsoft Entra ID
• Assign Microsoft Entra roles, including administrative unit scope
• Dynamic membership rules for administrative units
• Restricted management administrative units
• Using administrative units in Microsoft Teams
• Permissions in Exchange Online
• New-ManagementRoleAssignment
• Administrative units in Microsoft Purview
• Microsoft 365 Multi-Geo overview and requirements
• Add or remove a Multi-Geo geo administrator