How to Assign One Administrator to a Specific Microsoft 365 User Group
Question details
The user needs to delegate password management so that only one designated administrator can manage password changes for a specific group of users.
- Product
- Microsoft 365 / Microsoft Entra ID
- Device & OS
- not provided
- Scenario
- Attempting to assign restrictive, granular admin roles to a single administrator for a distinct subset of Office 365 users.
- Observed behavior
- Microsoft 365 does not offer a fully flexible native feature to restrict password management strictly to one administrator across all administrative scenarios.
Ensure you have Global Administrator or Privileged Role Administrator permissions in Microsoft Entra ID to create administrative units and assign scoped roles.
Delegate Management Using Microsoft Entra Administrative Units
While a strict single-admin limitation isn't natively foolproof, you can use Administrative Units to scope administrative roles to specific user groups.
Microsoft Entra role-based access control (RBAC) uses Administrative Units (AUs) to restrict admin capabilities to a specific portion of your organization. By creating an AU for your target group, you can assign a password admin specifically to that group.
Sign in to the Microsoft Entra admin center (formerly Azure Active Directory) using an account with Global Administrator privileges.
Navigate to 'Roles & admins' from the left sidebar, click on 'Administrative units', and select 'Add'. Enter a name and description for your administrative unit.
After creating the AU, open it and select 'Users'. Click 'Add member' to select and add the specific group of users whose passwords need to be managed.
Navigate to the 'Roles and administrators' tab within the new Administrative Unit. Select the 'Helpdesk Administrator' or 'User Administrator' role, click 'Add assignments', and select the single administrator you want to manage this group.
Submit a Feature Request via the Microsoft Feedback Portal
If Administrative Units do not meet your strict restriction requirements, submit a request directly to Microsoft's product development team.
Looking for a Simpler Office Suite? Try WPS Office
While Microsoft 365 offers complex enterprise administration frameworks, individuals and teams looking for a lightweight, cost-effective solution often prefer WPS Office. It provides powerful productivity tools without the steep learning curve or heavy administrative overhead.
- 1. Download the software: Visit the official WPS Office website and download the free installer for your operating system.
- 2. Install and launch: Run the installer, follow the quick on-screen instructions, and launch the application.
- 3. Open your documents seamlessly: Instantly open and edit your existing Microsoft Office files without any format conversion required.
Frequently Asked Questions
What is an Administrative Unit in Microsoft Entra?
An Administrative Unit is a resource container in Microsoft Entra ID that lets you restrict permissions in a role to a specific portion of your organization. It is commonly used to delegate management tasks, such as password resets, to regional or departmental administrators.
Can a User Administrator reset passwords for Global Admins?
No. Even if assigned to an Administrative Unit, a User Administrator or Helpdesk Administrator cannot reset the passwords of highly privileged roles like Global Administrators, Exchange Administrators, or SharePoint Administrators.
Why isn't there a built-in way to restrict M365 management to just one admin exclusively?
Microsoft 365 operates on a hierarchical Role-Based Access Control (RBAC) model designed for scalable enterprise environments. By design, higher-tier roles (like Global Admins) inherit administrative rights over all resources, preventing strict single-admin micro-management lockouts.
