Implement and Manage User Identities · Topic 1 of 4
Entra Tenant, Roles and Administrative Units
SC-300 tenant setup: custom domains, tenant properties, built in and custom Entra roles, administrative units, role assignable groups and effective permissions.
- 6 min
- A tenant has a Tenant ID. Custom domains are verified with a TXT or MX record.
- Choose the least privileged role. User Administrator covers passwords and licences. Helpdesk Administrator resets passwords only. License Administrator assigns licences only.
- Custom roles need Entra ID P1. Role assignable groups are set at creation and cannot be dynamic.
What it is
A Microsoft Entra tenant is your organisation's dedicated instance of Microsoft Entra ID. It holds the users, groups, devices and applications, and it has settings that apply to all of them. Running a tenant well means configuring its properties, proving ownership of your domain names, and giving administrators only the permissions they need.
Delegation is a large part of the topic. Entra has built in roles, custom roles for special cases, and administrative units that limit a role to part of the directory.
How it works
Tenant configuration
| Setting | What it controls |
|---|---|
| Tenant ID | The GUID that identifies the tenant, shown on the Overview page |
| Technical contact and privacy statement URL | Where Microsoft sends technical notices, and the link users see when asked to consent |
| Company branding | The logo, background and text on the sign in page, so users recognise it |
| User settings | Whether users can register applications, create tenants and so on |
| Group settings | Who can create groups and whether naming rules or expiration apply |
| Device settings | Who may join or register devices and how many devices each user can have |
A tenant starts with a default .onmicrosoft.com domain. To use your own name for sign in, add a custom domain, then prove you own it by adding a TXT record (or an MX record) at your DNS registrar, and verify it. The domain can then be used in user names. You can make one domain the primary domain.
A tenant can be deleted only when all app registrations are removed and no subscription or other paid resource is still associated with it.
Built in roles
Roles are bundles of permissions. Choose the narrowest one that does the job, which is the principle of least privilege.
| Task | Least privileged role |
|---|---|
| Reset passwords for non administrators | Helpdesk Administrator |
| Assign licences only | License Administrator |
| Create users, reset passwords and assign licences | User Administrator |
| Manage groups | Groups Administrator |
| Read almost every setting, with no changes | Global Reader |
| Manage enterprise applications and app registrations | Application Administrator or Cloud Application Administrator |
| Manage authentication methods for administrators | Privileged Authentication Administrator |
| Assign roles to others | Privileged Role Administrator |
| Manage Conditional Access policies | Conditional Access Administrator |
| Invite guest users | Guest Inviter |
| Everything | Global Administrator, which should be given to very few people |
Custom roles
When no built in role fits, a custom role lets you pick exactly the permissions you want, for example the right to update only certain application properties. A custom role needs Microsoft Entra ID P1. You can build one from a list of allowed actions, and assign it at the tenant, to an administrative unit, or to a single object.
Role assignable groups
Normally a group cannot hold a directory role. A role assignable group can be assigned roles, so you give a role to the group and manage who has it through membership. The setting must be chosen when the group is created, and such a group cannot use dynamic membership. Only Privileged Role Administrators and Global Administrators can change its membership, which protects it from takeover.
Administrative units
An administrative unit is a container of users, groups or devices. You assign a role over just that unit, so a helpdesk team can manage only its own region or department.
- Assign a role such as User Administrator with the administrative unit as the scope.
- Members can be added by hand, or by a dynamic rule, for example department equals Sales.
- A restricted management administrative unit goes further. Only administrators assigned within that unit can modify its objects, even Global Administrators cannot change the objects without being assigned, which protects sensitive accounts.
- Using administrative units needs Microsoft Entra ID P1 licences for the administrators who use them, and dynamic membership rules for a unit need P1 for its members.
| Scope of the role assignment | What the person can manage |
|---|---|
| The whole tenant | Every object of that type |
| An administrative unit | Only the objects in that unit |
| A single object | Only that object, for some roles |
Evaluating effective permissions
A person's effective permissions are the combination of all their role assignments, at every scope. To check them, look at the roles assigned to the user and to the groups they belong to, and at the scope of each assignment. A user who is User Administrator for a Sales administrative unit and Helpdesk Administrator for the tenant can reset passwords everywhere, and manage full user properties only in Sales. The portal's Assigned roles and role assignment lists, and the audit log, show this.
A worked scenario
A company with offices in three countries wants local helpdesk teams to reset passwords only for their own office. An administrator creates an administrative unit for each office, fills each one with a dynamic rule on the office attribute, and assigns Helpdesk Administrator to each team over its own unit. The CEO's account goes in a restricted management administrative unit, so only a named administrator can change it. For the finance team, a custom role is created that allows editing only specific application properties, and it is assigned to a role assignable group. A custom domain, contoso.com, is added and verified with a TXT record, and company branding shows the company logo on sign in.
What to remember for the exam
- A tenant has a Tenant ID. Custom domains are verified with a TXT or MX record.
- Choose the least privileged role. User Administrator covers passwords and licences. Helpdesk Administrator resets passwords only. License Administrator assigns licences only.
- Custom roles need Entra ID P1. Role assignable groups are set at creation and cannot be dynamic.
- Administrative units scope a role to part of the directory. Restricted management units protect sensitive objects.
- Effective permissions are the sum of assignments at all scopes.
When a question says "following least privilege" and names two tasks, pick the lowest role that covers both, not the most powerful one.
How the exam asks about this
- "Which type of DNS record verifies a custom domain?" A TXT record.
- "Helpdesk staff must reset passwords and assign licences with least privilege." User Administrator.
- "Let a regional team manage only its own users." An administrative unit with a scoped role.
- "A group that can hold a directory role." A role assignable group.
Common mistakes
Choosing Global Administrator for convenience. It breaks least privilege.
Forgetting that a role assignable group must be created that way. You cannot convert an ordinary group later.
Expecting a tenant to be deletable with apps still registered. Remove them and any subscriptions first.
Assuming an administrative unit contains roles. It contains objects, and roles are assigned over it.
Check yourself
How do you prove ownership of a custom domain?
Add a TXT record, or an MX record, at the DNS registrar and verify the domain.
What does an administrative unit do?
It limits a role assignment to the users, groups or devices inside the unit.
Why use a role assignable group?
To give a directory role to a group and manage who has it through protected membership.
Topic 1 of 4 in Implement and Manage User Identities
Test yourself on Implement and Manage User Identities
The full Microsoft SC-300 question bank has 650 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.