Administrative units, including restricted management administrative units, to scope admin roles

An administrative unit (AU) is a container in Microsoft Entra ID that holds users, groups or devices so you can delegate administration of just those objects. Think of a university: each faculty has its own IT staff who should reset passwords for their own students but not for the rest of the campus. Put the faculty's users in an AU, then assign the IT staff a role scoped to that AU.