Northwind Traders
Every administrative unit. A unit with nobody in it, or with no admin scoped to it, usually isn't doing anything; a dynamic unit whose rule is paused is no longer kept up to date. A restricted management unit also keeps tenant-wide admins (other than Global Administrators) from changing its members.
| Unit | Membership | Restricted | Users | Groups | Devices | Scoped admins | Admins |
|---|---|---|---|---|---|---|---|
| Branch offices medium | Dynamic (paused) | Yes | 1 | 0 | 1 | 1 | Robert Hughes |
| Sales | Assigned | No | 2 | 1 | 0 | 1 | Ann Patel |
| Service desk low | Assigned | No | 0 | 0 | 0 | 0 |
Every admin role scoped to a unit rather than the whole tenant. An account whose sign-in is blocked has usually left: remove the role. A guest or an app with a scoped role deserves a look.
| Account | Name | Role | Unit | Assignment | Sign-in | Type |
|---|---|---|---|---|---|---|
| ann.patel@northwindtraders.example | Ann Patel | Groups Administrator | Sales | Active | Allowed | Member |
The users and groups in each unit. Devices are counted above but not listed.
| Unit | Member | Name | Type | Sign-in |
|---|---|---|---|---|
| Branch offices | robert.hughes@northwindtraders.example | Robert Hughes | User | Blocked |
| Sales | ann.patel@northwindtraders.example | Ann Patel | User | Allowed |
| Sales | g#EXT#@northwindtraders.example | Sam Carter (guest) | Guest | Allowed |
| Sales | sales@northwindtraders.example | Sales | Group |
An administrative unit scopes an admin role to the users, groups and devices in it. Scoped admins come from the role assignments Admin roles reads; roles assigned through PIM show as eligible.
Data from Administrative units (), Admin roles (), Users (), Groups and Teams ().