Northwind Traders
Every administrative unit. A unit with nobody in it, or with no admin scoped to it, usually isn't doing anything; a dynamic unit whose rule is paused is no longer kept up to date. A restricted management unit also keeps tenant-wide admins (other than Global Administrators) from changing its members.
| Unit | Membership | Restricted | Users | Groups | Devices | Scoped admins | Admins |
|---|---|---|---|---|---|---|---|
| Branch offices medium | Dynamic (paused) | Yes | 1 | 0 | 1 | 1 | Robert Hughes |
| Sales | Assigned | No | 2 | 1 | 0 | 1 | Ann Patel |
| Service desk low | Assigned | No | 0 | 0 | 0 | 0 |
Every admin role scoped to a unit rather than the whole tenant. An account whose sign-in is blocked has usually left: remove the role. A guest or an app with a scoped role deserves a look.
| Account | Name | Role | Unit | Assignment | Sign-in | Type |
|---|---|---|---|---|---|---|
| robert.hughes@northwindtraders.example medium | Robert Hughes | Groups Administrator | Branch offices | Active | Blocked | Member |
| ann.patel@northwindtraders.example | Ann Patel | Groups Administrator | Sales | Active | Allowed | Member |
The users and groups in each unit. Devices are counted above but not listed.
An administrative unit scopes an admin role to the users, groups and devices in it. Scoped admins come from the role assignments Admin roles reads; roles assigned through PIM show as eligible.
Data from Administrative units (), Admin roles (), Users (), Groups and Teams ().