Forum Discussion
Limiting access based on domain
I have 1 tenant with 12 domains. I would like to give 1 email account on each domain access to change users under their domain, but only to their domain. Possible?
Depends on which tasks exactly you are looking to limit (or provide access to). What Microsoft offers in this are is the Administrative units feature, however it's still fairly limited and does not support all workloads or admin roles: https://docs.microsoft.com/en-us/azure/active-directory/roles/administrative-units
If you are only looking to do this for Exchange related tasks, the Exchange RBAC model has sufficient controls available to configure this (via the so-called management scopes). If you want a more robust solution across all of M365, your best best is third-party tools, at least for the time being.
If you are only looking to do this for Exchange related tasks, the Exchange RBAC model has sufficient controls available to configure this (via the so-called management scopes). If you want a more robust solution across all of M365, your best best is third-party tools, at least for the time being.