> ## Content Index
> Fetch the complete content index at: https://marshsecurity.org/llms.txt
> Use this file to discover other available public pages before exploring further.

# Leveraging RMAUs to protect your sensitive resources
- URL: https://marshsecurity.org/leveraging-rmaus-to-protect-your-sensitive-resources/
- Published: 2026-01-23T11:50:21.000Z
- Updated: 2026-05-24T17:09:41.000Z
- Author: Philip Marsh
- Tags: Identity, Microsoft Security, Guides

When it comes to identity security, least privilege isn’t just a recommendation, it's a requirement. In many environments, helpdesk or delegated administrators need access to manage users and groups, but not *every* user or group. That’s where **Restricted Management Administrative Units (RMAU)** in Microsoft Entra come in. 

RMAUs can be used to protect sensitive resources from tampering and to refine permissions to required zones - Similar to how an OU would work on a traditional AD infrastructure. This blog post explains how we can leverage these to improve our security posture. 

---

## But first... What **IS** an Admin Unit?

An **Administrative Unit** in Microsoft Entra is a logical container that lets you delegate administrative rights to a subset of users, groups, or devices within your tenant. I like to compare this to a traditional **Organizational Unit** (OU) from Active Directory. 

For example, you might give your Manchester IT support team permission to reset passwords, but only for users in the Manchester Administrative Unit. Meanwhile the London support team can only reset passwords for those users in the **London** Administrative Unit. 

### What makes restricted management different?

In standard mode, admins assigned to an AU can still perform some actions outside of their scope, such as seeing limited attributes of other users by inheriting permissions from the directory. **Restricted Management Administrative Units (RMAU)** tighten this further.

When enabled, RMAU ensures:

- Delegated admins **cannot** view or modify objects outside of their assigned AU.
- Even global roles like **User Administrator** are scoped strictly within the AU.
- APIs and Graph Explorer are restricted to the defined AU objects.

This means your high-value accounts like executives, privileged users, and service principals can stay protected even if a delegated admin account is compromised.

#### **How to Enable a Restricted Management Administrative Unit**

1. In the **Microsoft Entra admin centre**, go to **Identity > Administrative Units**.
2. Select **\+ New administrative unit** and give it a meaningful name such as *Tier 1 Users - Restricted*.
3. Under **Administrative Unit Settings**, enable **Restricted Mode**.
4. Add members; users, groups, or devices, that the AU should manage.
5. Assign roles scoped to this AU (for example, **User Administrator** or **Groups Administrator**).

### **Best Practices**

- **Use RMAUs for privileged or sensitive identities** such as IT staff, executives, and service accounts.
- **Combine RMAUs with Privileged Identity Management (PIM)** for time-bound access to delegated roles.
- **Document your AU structure** to ensure clarity across the admin team.
- **Audit role assignments** regularly to confirm only the right admins have access.

RMAUs are particularly valuable in large organisations or hybrid environments where helpdesk roles are delegated regionally or functionally. They reduce the blast radius of admin mistakes and make it easier to maintain compliance with internal governance policies.

### **Call to Action**

Take some time this week to review your admin delegation model. Identify where RMAUs could reduce risk or protect sensitive users, and pilot one in your environment. 

Have you started using Restricted Management Administrative Units yet? I’d love to hear how you’ve implemented them and what challenges or benefits you’ve seen.