Streamline User Management in Azure AD: A Guide to Administrative Units

In an era where digital security and user management are paramount, Azure Active Directory (Azure AD) has emerged as a crucial player in the IT landscape. With its suite of tools designed to streamline administrative tasks, it empowers organizations to manage user permissions and roles effectively. One of the standout features within Azure AD is the ability to set up Administrative Units and leverage the My Staff portal—a combination that's both a security boon and an efficiency tool for managing user access, particularly within educational and organizational settings. Let’s explore how this can be harnessed to delegate password resets securely, step by step.

The Scenario: Empowering Specific Roles​

Imagine being the Head of Year in a school setting. Each year brings new challenges, and managing student accounts shouldn't be a part of that. Using Azure AD's Administrative Units, you can empower specific staff members—say, the Head of Year—to manage tasks like password resets for only their student cohort, without granting them blanket administrative privileges. It’s about precision in control, allowing them to focus on the Year 11 students while keeping other year groups off-limits.

Prerequisites for Delegation in Azure AD​

Before diving into the setup, it's essential to note that to utilize group-based delegation, you must have Azure AD Premium. This license facilitates the creation of administrative units and the role-based access required for such tasks.

Step-By-Step Guide to Setting Up Administrative Units​

1. Creating an Administrative Unit​

Start by logging into the Azure Portal with a global administrator account:

• Navigate to Azure Active Directory and select Administrative Units.
• Click on + Add to create a new unit. Name it appropriately (e.g., Year 11 Support AU).
• After naming, click on Review + Create, then select Create.

2. Assigning Roles​

Next, assign the appropriate role to the Head of Year within the newly created Administrative Unit:

• Return to Azure Active Directory > Administrative Units and click on your newly created unit.
• Go to Roles and Administrators and then click + Add assignments.
• Here, select the User Administrator role. This gives permission for actions like password resets for group members.
• Add the Head of Year’s email (e.g., head.year11@school.com) and click Assign.

3. Adding Group Members​

Once roles are assigned, you can add specific group members to the Administrative Unit:

• Inside the Year 11 Support AU, navigate to the Members tab and click + Add members.
• Select the Year 11 Students group—make sure this group encompasses all relevant students. Remember, using a group facilitates easier management; any new students added will automatically inherit permissions.

4. Testing Permissions​

It’s time to verify if everything functions as intended:

• Open a private/incognito browser and go to My Staff Portal.
• Log in using the Head of Year’s credentials.
• The interface should only display members from the Year 11 group. Selecting a student should allow for a password reset.
• Confirm that students from other year groups are not visible, maintaining tight security.

5. Testing with a Global Administrator​

To ensure everything is functioning correctly, log in as a global administrator:

• Access Azure Active Directory > Users.
• Confirm that the global administrator can reset passwords for all users across the organization.

Publishing the My Staff Portal​

To enhance accessibility for the Head of Year, consider adding My Staff Portal as a tile in Microsoft 365:

1. Navigate to the Microsoft 365 Admin Center, go to Settings > Org Settings.
2. Select Services > Custom App Launcher Tiles and click + Add a custom tile.
3. Fill in the details:
   • Name: My Staff
   • URL: My Staff Portal
   • Description: Manage Year 11 student accounts and reset passwords.
   • Icon: Upload an appropriate image or select a default.
4. Save the tile. Now, the Head of Year can easily find and access the My Staff portal.

Key Benefits of Group-Based Delegation​

• Simplified Management: By using groups, management activities become less cumbersome since individual assignments are unnecessary.
• Dynamic Updates: If the Year 11 Students group is dynamic, any newly added members will be included in the Administrative Unit automatically.
• Enhanced Usability: The streamlined interface of My Staff ensures that staff only see pertinent information, reducing confusion and improving overall productivity.

Conclusion: A More Secure Future​

With Azure AD's Administrative Units and the My Staff portal, organizations can streamline user management and securely delegate critical tasks like password resets. This intricate dance of permissions not only enhances operational efficiency but also keeps security risks at bay. For schools, companies, and any organization looking to improve their IT governance, this feature is a powerful ally. So, what are you waiting for? Dive into Azure AD and start simplifying your administrative processes today!
For further exploration or discussions on Azure AD and its capabilities, feel free to share your experiences and tips in the comments below!

---

Source: Medium Setting Up Administrative Units and Using the My Staff Portal in Azure Active Directory