Microsoft 365 Certified: Administrator ExpertDeploy and manage a Microsoft 365 tenantHard
A company is using Microsoft 365 and has several departments, each with its own set of SharePoint sites and Microsoft Teams. The IT department wants to create a new administrator role that can manage SharePoint site collections and Teams settings ONLY for the Sales department, without affecting other departments. Which type of administrative unit should be created to delegate this specific scope of administration?
- AAdministrative unit
- BMicrosoft 365 group
- CSecurity group
- DDistribution group
Show answer & explanationAnswer & explanation
Correct answer: A. Administrative unit
Administrative units (AUs) in Azure AD allow administrators to define a more granular scope of administrative control over users, groups, and devices. By creating an AU for the Sales department and adding relevant users, groups, and devices to it, an administrator can be delegated permissions to manage only those resources within that AU, achieving the required departmental scope.
Why the other options are wrong
- B. Microsoft 365 groups are for team collaboration and resource sharing, not for defining administrative delegation boundaries.
- C. Security groups are for assigning access to resources, not for delegating administrative scope over other resources.
- D. Distribution groups are for sending emails to multiple recipients and have no administrative delegation capabilities.
Azure AD Administrative Units
An Azure AD Premium feature that allows the creation of logical containers to group users, groups, or devices, enabling granular delegation of administrative roles to specific scopes.
- Requires Azure AD Premium P1 or P2 license.
- Used to delegate administrative permissions to a subset of the organization.
- Supports delegation for roles like User Administrator, Group Administrator, Helpdesk Administrator.
Memory trick: Think of Administrative Units as custom-sized boxes that hold users/groups, letting you give a key to only that box.