Microsoft Azure Administrator Associate AZ-104 Practice Question

Administrative Units in Microsoft Entra ID let you place users and groups into logical containers and then assign directory roles scoped to those containers. An administrator who receives a role assignment scoped to an Administrative Unit can manage only the members of that unit, providing exactly the required department-level separation.

Privileged Identity Management focuses on just-in-time and approval-based elevation of roles but does not itself create a departmental scope. Management Groups and Azure role-based access control (RBAC) apply to Azure resource hierarchy and do not limit permissions within Microsoft Entra ID user or group management.