Blog Post

Microsoft Entra Blog
2 MIN READ

Azure AD RBAC: Dynamic administrative units now in public preview for users & devices

Alex_Simons's avatar
Alex_Simons
Icon for Microsoft rankMicrosoft
Apr 12, 2022
Howdy folks,   As part of our series of announcements for Azure Active Directory (Azure AD) role-based access control (RBAC), I’m excited to share the public preview of dynamic administrative uni...
Updated Apr 11, 2022
Version 1.0
identity and access management
Alex_Simons's avatar
Icon for Microsoft rankMicrosoft
Joined May 01, 2017
View Profile
Microsoft Entra Blog
Stay informed on how to secure access for employees, customers, and non-human identities, from anywhere, to multicloud and on-premises resources, with comprehensive identity and network access solutions powered by AI.
giladkeidar's avatar
giladkeidar
Brass Contributor
Apr 13, 2022

dloder you so correct. 
seems like they just apply dynamic group functionality on AU. 


I think the only real way to dynamically scope devices to AUs is by taking the device owner value as an attribute (and to apply that logic in dynamic group too). 


at the moment we are using different Autopit profiles (per site/country etc) and using the profile name as an attribute for dynamic group (but surly this way has many requirements). 

dloder  btw: when creating AU it automatically assigns common AAD roles, one of them is SharePoint admin, is that means user will have admin rights only on SharePoint settings that belongs to their AU (didn’t test it I wasn’t sure how that’s possible)