Managing Administrative Units Using Graph PowerShell

Administrative Units (AUs) in Microsoft Entra ID (formerly Azure AD) allow organizations to logically segment users and assign scoped admin roles. With the help of Microsoft Graph PowerShell, managing these AUs becomes more efficient—especially when performing bulk operations or automating repetitive tasks.

This guide walks you through what AUs are, why managing them via PowerShell is useful, and links to detailed Graph PowerShell scripts you can use to manage them effectively.

What are Entra ID Administrative Units?

Administrative Units are containers in Entra ID that help you delegate permissions or apply settings to a subset of users, groups, or devices. For example, you might create one AU for each department or geographic location and assign local IT admins scoped access to only that unit.

Why Manage Entra ID Administrative Units Using PowerShell?

While AUs can be managed via the Microsoft Entra portal, PowerShell allows for automation, bulk actions, and integration into larger admin workflows. This is especially useful for organizations with dynamic user bases or multiple departments where manual configuration would be inefficient.

How to Manage Entra ID Administrative Units Using PowerShell?

Here are key tasks you can perform using Microsoft Graph PowerShell with detailed scripts provided on M365Corner:

• Creating Administrative Units

Use the New-MgDirectoryAdministrativeUnit cmdlet to create a new AU with a name and optional description. Also learn how to bulk create administrative units by reading data from CSV files.

📘 Create AUs Using PowerShell

• Updating Administrative Units

The Update-MgDirectoryAdministrativeUnit cmdlet allows you to update properties like the AU’s name or description.

📘 Update AUs Using PowerShell

• Removing Administrative Units

You can delete an AU using the Remove-MgDirectoryAdministrativeUnit cmdlet once it's no longer required or has been migrated. Also learn how to bulk delete or remove administrative units by reading data from CSV files.

📘 Remove AUs Using PowerShell

• Adding Members to Administrative Units

With New-MgDirectoryAdministrativeUnitMemberByRef, you can assign users to specific Aus individually and in bulk using CSV files. Learn both ways and align users with their respective scopes.

📘Add Members to AUs Using PowerShell

• Removing Members from Administrative Units

To remove a user from an AU individually or in bulk using CSV files, use Remove-MgDirectoryAdministrativeUnitMemberByRef. This keeps your units clean and up to date.

📘Remove Members from AUs Using PowerShell

Conclusion

Administrative Units play a vital role in delegated administration within Microsoft Entra ID. By using Graph PowerShell, you gain efficiency, consistency, and the power to automate complex administrative tasks.

Whether you’re adding or removing AUs, managing members, or updating properties, the scripts above from M365Corner give you a solid starting point. You can also modify them to suit your organization’s specific structure and needs.