# Use restricted management administrative units only after workflow testing > Restricted management administrative units can block tenant-scoped administrators from modifying selected Entra objects, and that stronger boundary can also break established support and automation paths. - Canonical URL: https://update.dsesecurity.com/updates/entra-restricted-administrative-units-workflow-testing/ - Publisher: Detection Systems & Engineering (DSE Security) - Author: DSE Security Editorial Team - Published: 2026-08-25T21:35:32+00:00 - Modified: 2026-08-25T21:36:17+00:00 - Last reviewed by DSE: 2026-08-25 - Resource type: Guide - DSE priority: Important - Topics: Cybersecurity, IT, Microsoft 365 & Identity - Reading time: 3 minutes ## What you need to know Restricted management administrative units can block tenant-scoped administrators from modifying selected Entra objects, and that stronger boundary can also break established support and automation paths. ## Potentially affected Microsoft Entra tenants considering restricted management administrative units for executives, sensitive devices, or security groups. ## DSE recommendation Model every administrative and automated dependency, pilot protected objects, test emergency support, and monitor denied operations before broad placement. ## Article Bottom line: A restricted management administrative unit can protect selected Microsoft Entra users, devices, and security groups from modification by administrators who are not explicitly assigned at that restricted scope. Microsoft also warns that the restriction can break existing workflows. Deploy it as an administrative-boundary change with dependency testing and a recoverable support design. ## Source fact: what Microsoft documents Microsoft’s [restricted management administrative unit documentation](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/admin-units-restricted-management) says that objects in such a unit can be modified only by administrators with an explicit role assignment at that unit’s scope. Tenant-scoped roles, including highly privileged roles, do not automatically retain modification rights to those protected objects. Microsoft documents supported member types as users, devices, and security groups. Microsoft 365 groups, mail-enabled security groups, and distribution groups are not listed as supported restricted members. The boundary covers direct modification of Microsoft Entra properties. It does not automatically block actions in related Microsoft 365 services: the source gives examples such as Exchange mailbox changes, Intune device policy, SharePoint ownership, and license assignment that can remain allowed. Microsoft explicitly cautions that placing objects in the unit can cause existing workflows to break. ## What the source does not establish This feature is not a general data-access boundary, a complete executive-protection program, or a substitute for Conditional Access and privileged-access controls. It does not isolate every Microsoft 365 action involving the protected person or device. It also does not prove that third-party automation, helpdesk tooling, emergency procedures, or application service principals will continue to work. ## Applicability questions - Which exact Entra objects need protection, and are their object types supported? - Which administrators, automation identities, Graph applications, HR feeds, and helpdesk tools modify those objects today? - Which required actions occur in Entra versus Exchange, Intune, SharePoint, or another service? - Who can assign a role at the restricted scope during an emergency, and how is that event reviewed? - What licensing, role eligibility, and portal or API behavior applies to the tenant at deployment time? ## DSE recommendation: controlled next steps The following steps are DSE recommendations based on the cited source. - Build a dependency map from each proposed protected object to password reset, device recovery, group management, provisioning, licensing, mailbox, and incident-response procedures. - Create a pilot unit with nonproduction identities that reproduce executive or sensitive-object workflows. Test authorized and unauthorized changes through every portal, script, and service principal. - Assign scoped roles to named groups with separate membership control. Avoid treating a broad tenant role as an emergency bypass because Microsoft documents that explicit restricted-scope assignment is required. - Write and exercise a recovery procedure for a missing administrator, failed automation, or urgent account action. - Expand membership only after support owners accept the changed boundary and denied-operation monitoring is in place. ## Verification and evidence - Capture the unit configuration, membership, scoped role assignments, and approvers. - Preserve successful tests by authorized scoped administrators and denied tests by tenant-scoped administrators. - Test dependent automation and Microsoft 365 service operations separately; do not infer one result from another. - Review audit records for membership changes, scoped role assignments, and emergency actions. ## Official references - [Restricted management administrative units in Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/admin-units-restricted-management) — Microsoft ## Primary reference - Name: Restricted management administrative units in Microsoft Entra ID - Authority: Microsoft Learn - URL: https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/admin-units-restricted-management - Source publication date: Not stated by the source ## Citation and use Preferred citation: “Use restricted management administrative units only after workflow testing,” DSE Security, https://update.dsesecurity.com/updates/entra-restricted-administrative-units-workflow-testing/ Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/ Usage and citation policy: https://update.dsesecurity.com/usage/ Copyright © 2026 Detection Systems & Engineering. All rights reserved.