Managing Administrative Units
Administrative units are collections of users and devices that can be delegated to certain administrators. In on-premises Active Directory, you may choose to delegate control of administrative functions using the Delegation of Control wizard in Active Directory Users and Computers or the Active Directory Administration Center. Unlike on-premises Active Directory, Azure AD is not hierarchical. Delegation must be achieved by defining boundaries and then controlling which users or devices are placed inside the boundaries.
Administrative units can be role-scoped—that is to say, administrators can both be granted administrative roles (such as Helpdesk Administrator) as well as be limited to administrative tasks only for assigned administrative units.
Creating Administrative Units
In the following example, an administrative unit called California (used to hold users in that region) is created. During the creation, administrators are configured...