Northwind Traders has regional IT teams in North America, Europe, and Asia-Pacific. Each regional team needs to reset passwords and manage licenses only for users in their own region. No regional admin should be able to affect users in another region. What should the admin configure?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Administrative units are like velvet ropes around groups of users — regional IT gets the bouncer role, but only for their section of the club. You create an AU per region, drop users into it, then assign a scoped Helpdesk Administrator to that AU. The regional admin can reset passwords all day, but only for their people — they literally can't see users in other AUs with that scoped role.
Full explanation below image
Full Explanation
Microsoft Entra administrative units (AUs) allow tenant admins to partition the directory into subsets and delegate administrative roles that are scoped only to those subsets. Creating one AU per region (NA, EU, APAC), populating each with the correct users (manually, via dynamic membership rules, or via nested groups), and then assigning the Helpdesk Administrator role scoped to each AU gives regional IT teams exactly the access they need — nothing more, nothing less. This is the principal of least privilege applied at the directory level.
Option A (separate tenants) is a drastic architectural change that creates significant operational complexity — separate licensing, separate identity management, cross-tenant collaboration challenges. Microsoft does not recommend separate tenants for geographic delegation; AUs exist precisely to avoid this.
Option B (Microsoft 365 admin center custom roles) allows you to create roles with specific permission sets, but standard admin roles in Microsoft 365 admin center apply tenant-wide. The admin center does not natively support scoping built-in directory roles (like Helpdesk Administrator) to subsets of users — that is the specific function of administrative units in Entra ID.
Option D (Conditional Access by geographic IP) is completely wrong for this scenario. Conditional Access controls who can sign in under what conditions — it does not restrict which users an admin can manage. A Conditional Access policy can restrict where admins sign in from, but it cannot prevent a North American admin from resetting a European user's password once they're signed in.
Exam tip: Administrative units are the Microsoft Entra mechanism for delegated administration over a subset of users, groups, or devices. They support assigning scoped versions of built-in roles such as Helpdesk Administrator, Password Administrator, and User Administrator.