iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Restricted management administrative units (RMAUs) limit who can change selected Microsoft Entra users, devices, and security groups. Administrators need a role assigned at the restricted unit’s scope to modify its protected objects; tenant-wide Global Administrator or Privileged Role Administrator status alone is not enough. The control applies to Entra object management, not every connected Microsoft 365 service, and it can disrupt existing workflows if deployed without planning.
What a restricted management administrative unit does
An administrative unit (AU) is a container for organizing directory objects and scoping administrative permissions. An RMAU adds a stronger boundary: administrators without a role assignment scoped to that unit cannot directly modify its members’ Entra properties. Microsoft describes use cases such as protecting executive accounts and devices, delegating administration by region, and securing groups that control application access. Microsoft’s feature documentation was dated March 4, 2026.
The restriction is about who can manage the Entra objects, not about making them invisible. Administrators can still read standard properties. The control is also not a blanket lock across Microsoft 365: certain operations in connected services remain possible.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Actions blocked for administrators without an RMAU-scoped role
Microsoft lists direct changes to protected users, groups, and devices as blocked when the administrator lacks a role assignment at the RMAU scope. Examples include deleting an object, updating a user’s password, and changing a group’s owners or membership.
#1 Best Overall
- Supports FIDO2 biometric authentication services and FIDO U2F services requiring security key functionality. Secure and flexible authentication across multiple platforms.
- Exceptional biometric performance, 360° readability, and advanced anti-spoofing technology.
- Designed for portability, it comes with a cover to protect the security key when not in use.
- Aligns with cybersecurity measures that comply with key privacy laws and regulations, including GDPR, BIPA, and CCPA. Approved for use in U.S. federal government institutions.
- Passkey compatibility with Microsoft, Google, and Apple for a convenient and secure sign-in experience. Certified for Microsoft Entra ID for secure multifactor integration with Microsoft services.
Operations that may still be allowed
Microsoft documents these examples of actions that can remain possible despite the Entra restriction:
- Changing Exchange email and mailbox settings.
- Applying Intune policies to a protected device.
- Adding or removing a protected group as a SharePoint site owner.
- Adding a protected user, group, or device to an Entra group.
Assess the actual workflow and service boundary rather than treating RMAU membership as a universal Microsoft 365 lock.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Who can manage protected objects?
Only administrators with an applicable role assignment at the restricted unit’s scope can modify its protected members. A tenant-scoped Global Administrator or Privileged Role Administrator cannot change a protected object solely because of that tenant-wide role. These roles can, however, manage the RMAU itself: create or delete it, add or remove members, and assign or remove roles scoped to the unit. They can explicitly assign themselves a scoped role, making that step auditable.
If a scoped administrator leaves or changes jobs, Microsoft’s documented recovery route is for a Global Administrator or Privileged Role Administrator to assign a replacement administrator—or themselves—to the unit. Plan this fallback before moving critical accounts or groups into the unit. The arrangement narrows routine administrative access, but it does not eliminate privileged insider risk because tenant administrators can manage the container and grant scoped access.
Rank #3
- Supports FIDO2 biometric authentication services and FIDO U2F services requiring security key functionality. Secure and flexible authentication across multiple platforms.
- Exceptional biometric performance, 360° readability, and advanced anti-spoofing technology.
- Designed for portability, it comes with a cover to protect the security key when not in use.
- Aligns with cybersecurity measures that comply with key privacy laws and regulations, including GDPR, BIPA, and CCPA. Approved for use in U.S. federal government institutions.
- Passkey compatibility with Microsoft, Google, and Apple for a convenient and secure sign-in experience. Certified for Microsoft Entra ID for secure multifactor integration with Microsoft services.
What can go in an RMAU?
| Object type | Supported as a member? |
|---|---|
| Users | Yes |
| Devices | Yes |
| Security groups | Yes |
| Microsoft 365 groups | No |
| Mail-enabled security groups | No |
| Distribution groups | No |
The restriction concerns Entra properties. Membership in an RMAU does not by itself block every action on the object in Exchange, Intune, or SharePoint.
How to create one
The restricted setting is selected when you create the administrative unit; Microsoft does not provide a way to turn an existing AU into an RMAU afterward. If an existing unit needs this protection, plan a new restricted unit and a controlled membership and role-assignment transition. Microsoft documents creation through the admin center, PowerShell, and Microsoft Graph in its administrative-unit creation guidance.
Rank #4
- FIDO2 + FIDO U2F certified security key, supports PIV credential authentication
- Sits with a low-profile when plugged-in
- Works in every browser without installing any drivers
- Supports desktops, laptops, tablets, and Android mobile devices via USB-C
- Helps protect your accounts from phishing and other cyber-attacks. Prevents your devices from unauthorized use.
Admin center
- Sign in to the Microsoft Entra admin center with at least the Privileged Role Administrator role.
- Open the administrative-unit creation flow described in Microsoft’s administrative-unit guidance.
- During creation, select the restricted management option, then complete the unit’s details and create it.
- Add only supported objects, then assign the administrators who need to manage them at the RMAU scope.
Microsoft also documents PowerShell and Microsoft Graph creation routes. Use the corresponding current procedure in Microsoft’s guidance for those routes; do not assume that creating a standard AU and changing a later setting will make it restricted.
Limitations and deployment checks
Microsoft warns that placing objects in an RMAU severely restricts who can change them and can break existing workflows. Review these constraints before moving production objects:
Best Value
- FIDO2 + FIDO U2F certified and supported USB security key
- Supports Computers, Laptops, Tablets, and Mobile Devices with a USB-C port and/or NFC
- Works without downloading any drivers. Supported OS: Android, Chrome OS, Windows, MacOS, Linux
- Durable design made to last for a long time with everyday use. Water-resistant (IP67)
- Helps protect your accounts from phishing and other cyber-attacks. Prevents your devices from unauthorized use.
- Tenant limit: Microsoft documents a maximum of 100 RMAUs per tenant.
- Licensing: Microsoft’s current feature documentation says each RMAU administrator needs Microsoft Entra ID P1, while members need Microsoft Entra ID Free. Verify your organization’s licensing terms before deployment.
- Governance compatibility: Microsoft says users and groups in an RMAU cannot be managed with the named Entra ID Governance features, including Privileged Identity Management, Entitlement Management, Lifecycle Workflows, and Access Reviews.
- Public group membership: Public membership on a protected group can allow self-service joining. Microsoft identifies this as a temporary limitation and does not recommend public membership for groups in RMAUs.
- Role-assignable groups: Ordinary group ownership cannot be used to change the membership of a role-assignable group placed in an RMAU. Only Global Administrators and Privileged Role Administrators can change that membership, and neither role can be assigned at AU scope.
- Actions without a suitable scoped role: Some operations may have no role that can perform them at the unit scope. Microsoft’s example is a Global Administrator in an RMAU whose password cannot be reset by another administrator through an AU-scoped role; Microsoft says the account must first be removed from the unit.
- Deletion delay: After deleting an RMAU, removal of all protections from former members can take up to 30 minutes.
Pre-deployment checklist
- Confirm each intended member type is supported and identify exactly which accounts, devices, and groups need the boundary.
- Assign and test scoped administrators, including a documented replacement or recovery path.
- Check service integrations, applications, automation, and helpdesk procedures that modify Entra properties.
- Review Entra Governance dependencies and group configuration, especially public membership and role-assignable groups.
- Test the operations users and administrators need before moving critical objects into the unit.
Applications and automation
Applications cannot modify protected objects by default. Microsoft says Graph application permissions alone do not override the restriction. To allow an application to manage protected objects, assign it an Entra role at the RMAU’s scope. Include this requirement when reviewing provisioning, automation, and service integrations.
Availability and release history
This is not a new 2026 launch. Microsoft announced the public preview on July 12, 2023, and its RBAC documentation changelog records general availability in June 2025. The current feature page’s March 4, 2026 date reflects current documentation, not the feature’s launch date. See the Microsoft Entra preview announcement and the RBAC documentation changelog.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitches
