Limiting access based on domain

[Mike_Feihle]

I have 1 tenant with 12 domains.  I would like to give 1 email account on each domain access to change users under their domain,  but only to their domain.

Possible?

[#2]

Depends on which tasks exactly you are looking to limit (or provide access to). What Microsoft offers in this are is the Administrative units feature, however it's still fairly limited and does not support all workloads or admin roles: https://docs.microsoft.com/en-us/azure/active-directory/roles/administrative-units
If you are only looking to do this for Exchange related tasks, the Exchange RBAC model has sufficient controls available to configure this (via the so-called management scopes). If you want a more robust solution across all of M365, your best best is third-party tools, at least for the time being.

[#3]

Thanks for the link.  I need to purchase a license for that, and I won't do that unless I can see how it works.  The documentation is vague.  I see I can create an AU in Azure AD, and assign users to the roles, but, how does that get attached to one of the domains, so when they log into M365 to add/remove/change users and passwords, they only can see the users under that specific domain?

[#4]

There are plenty of articles detailing how it works out there, I even did some webinars on AUs back in the day. And you can always play with it with a free trial (demo) tenant, as getting your hands dirty is the best way to learn stuff.

If add/remove/change users and password is all you need here, there is already support for that within the M365 Admin center via AUs already. Still, don't get your hopes too high, as AUs have some limitations. Here's an (outdated) article on how it worked back in the old admin center: https://blog.quadrotech-it.com/blog/working-with-administrative-units-in-the-office-365-admin-center...

[#5]

I am more than happy to play with a user account on our live tenant, but I am seriously new to this, and I find the documentation on anything related to this is missing or outdated.

[#6]

Well, I tried creating an AU, added a group of members specific to the domain of users I want to manage, and it still shows every user.
Without detailed instructions, and decent documents, I find working with Azure or Exchange to be all trial and error. You would think the people that designed these systems would at least document how it works.

[#7]

Keep in mind that if you already have an admin role assigned, you will not be subject to the AU restrictions, so best test with a fresh account. Look at the top right corner of the screen, when on the Users > Active users page in the M365 admin center. If the user is assigned to one or more "scoped" roles, you will see the "Select administrative unit" ("No unit selected") dropdown there. With the default selection, you will see all the objects. Switch to the AU-based scope you've created to see the limited list of users/objects.

[#8]

Thanks, I see that.  But at what step do I add it to a specific domain.  I want THIS user to only administer the emails of their own domain.  We will have 12 domains added to the 1 tenant.

[#9]

You cannot designate domains per se, instead you enumerate all users "associated" with specific domain and add them as members of the given AU. Rinse and repeat for all other domains.

[#10]

Well, I have tried as much as my knowledge and research will carry me. I added the trial version of AZURE AD PREMIUM P2. I created a new user. Created an AU that has only 2 users in it as members. I gave that AU the User Administrator role.
I added that new AU to the new user. When I log in as that user there is no link to admin. I don't know what admin rights I need to give it to allow that user to access the admin area to modify the users I added as members to the AU.

[#11]

Much obliged for the connection. I want to buy a permit for that, and I will not do that except if I can perceive how it functions. The documentation is ambiguous. I see I can make an AU in Azure AD, and appoint clients to the jobs, yet, how does that get joined to one of the areas, so when they sign into M365 to add/eliminate/change clients and passwords, they just can see the clients under that particular space?

[#12]

@revix17241 @Mike_Feihle  @VasilMichev 

Did anyone find solution for this problem?

We have tha same situation in our company..

[#13]

@Maticahacic 

No solution that is simple.