How to Assign Password Reset Permissions to Specific Microsoft 365 Users
Question details
Configure a Password Administrator role so that a specific person can only reset passwords for a designated subset of users, such as a branch or department, rather than all users in the organization.
- Product
- Microsoft 365
- Device & OS
- not provided
- Scenario
- Delegating administrative permissions to localized IT support or branch managers without granting tenant-wide access.
- Observed behavior
- The standard Password Administrator role grants broad access to reset passwords for almost all non-admin users, which lacks the granular scoping required for branch-specific management.
Ensure you have Global Administrator or Privileged Role Administrator permissions in Microsoft 365/Entra ID, and verify that your tenant has Microsoft Entra ID P1 or P2 licenses to support Administrative Units.
Use Administrative Units to Scope Password Reset Permissions
Create an Administrative Unit in Microsoft Entra ID to group the specific users, and then assign the Password Administrator role scoped only to that unit.
Because standard groups do not automatically restrict the scope of administrative roles, you must use Administrative Units (AUs). AUs allow you to subdivide your organization and assign roles that are effective only within that specific boundary.
Sign in to the Microsoft Entra admin center (or Microsoft 365 Admin Center and navigate to Identity) using a Privileged Role Administrator account.
Navigate to 'Azure Active Directory' > 'Administrative units'. Click 'Add', provide a name for the branch or group, and save.
Open the newly created Administrative Unit, select 'Users', and click 'Add member' to include only the users whose passwords the delegated admin should be able to reset.
Within the Administrative Unit, go to 'Roles and administrators'. Select the 'Password Administrator' role, click 'Add assignments', and select the specific person who will manage these users.
Looking for a cost-effective Microsoft Office Alternative?
While Microsoft 365 provides extensive enterprise administration features, it can be costly and complex to manage. If your organization simply needs powerful productivity tools without the heavy IT overhead, try WPS Office. It offers a free, lightweight suite that is highly compatible with Microsoft Word, Excel, and PowerPoint.
Frequently Asked Questions
Can I use standard Microsoft 365 security groups to limit password reset permissions?
No. Assigning an administrative role to a standard security group does not limit the scope of their administrative power. They will still be able to reset passwords for all eligible users in the tenant. You must use Administrative Units to achieve scoping.
Who can a scoped Password Administrator reset passwords for?
A scoped Password Administrator can only reset passwords for non-administrators who are explicitly added to their assigned Administrative Unit. They cannot reset passwords for Global Admins or users outside their unit.
Are Administrative Units available in the free tier of Microsoft Entra ID?
No, to assign administrative roles with scope restricted to an Administrative Unit, your tenant requires a Microsoft Entra ID P1 or P2 license.
