Azure AD RBAC: Dynamic administrative units now in public preview for users & devices
Howdy folks,
As part of our series of announcements for Azure Active Directory (Azure AD) role-based access control (RBAC), I’m excited to share the public preview of dynamic administrative units.
With dynamic administrative units, you no longer have to manually manage membership of your administrative units (or write your own automation to manage it for you). Instead, Azure AD allows you to specify a query based on user or device attributes, and then maintains the membership for you.
Let's take a look at some of the cool things you can do with these new capabilities:
And you can check out the other announcements in the series here:
- Azure AD RBAC: Custom roles for app management now available
- Azure AD RBAC: Custom roles & administrative units for devices now available
Create a rule for easy user membership management
To create a dynamic membership rule, go to an administrative unit and click on the Properties tab. In this example, we have an administrative unit representing the Human Resources department.
On the Properties blade, set the Membership Type to Dynamic User. Then click Add dynamic query to create a dynamic rule.
Here we’ve used the rule builder to create a basic rule which includes all users whose department is “Human Resources.” You can also build more complex rules using the same syntax you use for dynamic groups (see this page for details on how to do so).
Once you’ve created the rule, click Save to save the rule syntax. Then, click Save again on the Properties blade to save the membership changes to the administrative unit. Within a few minutes, the dynamic groups engine will start to populate the administrative unit with the users that match the rule.
Now, you can go to the Roles and administrators tab to delegate administrative roles over the administrative unit and be assured that the scope will be automatically kept up to date by the dynamic membership engine.
In this example, we’re delegating the ability to manage passwords for employees in the Human Resources department by assigning the Password Administrator role scoped to the Human Resources administrative unit.
Note: We highly recommend assigning the Password Administrator role as an eligible assignment through Privileged Identity Management.
For more information on dynamic administrative units, check out our documentation.
What’s next
Moving forward, we’re looking at adding support for both users and devices in the same dynamic administrative unit and offering additional properties from which you can build dynamic queries. We're also working on more great features in the Azure AD RBAC area related to administrative units and custom roles. Stay tuned for coming announcements.
Best regards,
Alex Simons (Twitter: @Alex_A_Simons)
Corporate VP of Program Management
Microsoft Identity Division
Learn more about Microsoft identity:
- Related Articles: Azure AD RBAC: Custom roles & administrative units for devices now available / Azure AD RBAC: Custom roles for app management now available
- Return to the Azure Active Directory Identity blog home
- Join the conversation on Twitter and LinkedIn
- Share product suggestions on the Azure Feedback Forum
Published on:
Learn moreRelated posts
Azure Queue Storage vs Azure Service Bus for Integrating Dynamics 365 Business Central with External Systems – Part1
When developing cloud-native integrations for Dynamics 365 Business Central (BC), especially in SaaS environments, choosing the right messagin...
Important Update: Server Name Indication (SNI) Now Mandatory for Azure DevOps Services
Earlier this year, we announced an upgrade to our network infrastructure and the new IP addresses you need to allow list in your firewall R...
Azure Function | Publish | ‘attempt to publish the ZIP file failed’ error
While publishing a C# Azure Function from Visual Studio, I encountered the following error: The attempt to publish the ZIP file through XXXXX ...
Azure SDK Release (March 2025)
Azure SDK releases every month. In this post, you find this month's highlights and release notes. The post Azure SDK Release (March 2025) appe...
MWC 2025 Azure Foundry
New Overlapping Secrets on Azure DevOps OAuth
As you may have read, Azure DevOps OAuth apps are due for deprecation in 2026. All developers are encouraged to migrate their applications to ...
Azure Cosmos DB Conf 2025: Learn, Build, and Connect with the Community
Join us for the 5th annual Azure Cosmos DB Conf, a free virtual developer event co-hosted by Microsoft and the Azure Cosmos DB community. This...