How to Restrict Microsoft 365 Administrators by Organizational Unit
Question details
The user needs to restrict the visibility and management scope of Microsoft 365 administrators to specific traditional Active Directory Organizational Units (OUs).
- Product
- Microsoft 365 Admin Center
- Device & OS
- not provided
- Scenario
- Configuring delegated administration and role-based access control based on Organizational Units in a Microsoft 365 environment.
- Observed behavior
- The Microsoft 365 admin center does not natively support restricting an administrator's visibility to users in specific traditional Active Directory organizational units.
Verify your current directory environment setup to determine if you are using traditional on-premises Active Directory, Azure AD, or Azure AD Domain Services, as management capabilities vary by platform.
Utilize Azure AD Domain Services for Delegated Administration
Identify your environment type and use Azure AD Domain Services (Azure AD DS) to apply delegated administration, as the standard Microsoft 365 admin portal lacks traditional OU filtering.
Traditional Active Directory OUs are structurally different from Azure AD and Microsoft 365 management frameworks. Because of this, the Microsoft 365 admin center generally cannot restrict administrators to viewing users only in specific traditional OUs.
However, if your organization uses Azure AD Domain Services (Azure AD DS), you have the ability to create custom organizational units and configure delegated administration effectively.
Check with your IT department to clarify whether the organization has an active Azure subscription and if Azure AD Domain Services is enabled.
Log in to the Azure portal using global administrator credentials instead of the standard Microsoft 365 admin center.
Navigate to the Azure AD Domain Services section to create custom Organizational Units and delegate administrative permissions at the custom OU level using Azure role-based access control (RBAC).
Contact Microsoft 365 Technical Support
Reach out to official Microsoft support to escalate configuration issues and gain access to specialized resources.
Try WPS Office as a Lightweight Office Alternative
While Microsoft 365 enterprise environments often require complex administrative unit configurations and directory management, WPS Office provides a streamlined, free, and lightweight alternative for individual and team document creation with zero administrative hassle.
- 1. Visit the WPS Office website: Go to the official WPS Office website to download the free installation package.
- 2. Install the software: Run the installer and follow the on-screen instructions to set up the lightweight office suite on your computer.
- 3. Start creating documents: Open WPS Office and immediately begin working on your documents, spreadsheets, and presentations without needing to configure complex admin accounts.
Frequently Asked Questions
Can I restrict Microsoft 365 administrators to specific on-premises OUs?
No, the Microsoft 365 admin center does not natively support restricting administrator visibility or management scope based on traditional on-premises Active Directory Organizational Units. You must manage those restrictions directly in your on-premises AD or use Azure AD Administrative Units.
How do Administrative Units help with Microsoft 365 delegated administration?
Administrative Units (AUs) in Azure AD are the cloud equivalent of OUs. By assigning users or groups to an AU, you can assign an administrator to manage only the users within that specific Administrative Unit, which bypasses the standard limitations of the Microsoft 365 admin center.
What is the difference between Azure AD DS and traditional Active Directory for OUs?
Traditional Active Directory uses on-premises OUs which do not directly map their visibility restrictions to Microsoft 365. Azure AD Domain Services (Azure AD DS) provides managed domain services in the cloud, allowing you to create custom OUs where delegated administration can be applied natively within the Azure ecosystem.
