Contoso Legal LLP
Every administrative unit. A unit with nobody in it, or with no admin scoped to it, usually isn't doing anything; a dynamic unit whose rule is paused is no longer kept up to date. A restricted management unit also keeps tenant-wide admins (other than Global Administrators) from changing its members.
| Unit | Membership | Users | Groups | Devices | Scoped admins | Admins |
|---|---|---|---|---|---|---|
| Branch offices medium | Dynamic (paused) | 1 | 0 | 1 | 1 | Bobby Marsh |
| Service desk low | Assigned | 0 | 0 | 0 | 0 |
Every admin role scoped to a unit rather than the whole tenant. An account whose sign-in is blocked has usually left: remove the role. A guest or an app with a scoped role deserves a look.
| Account | Name | Role | Unit | Assignment | Sign‑in | Type |
|---|---|---|---|---|---|---|
| bobby.marsh@contoso.example medium | Bobby Marsh | Groups Administrator | Branch offices | Active | Blocked | Member |
| annabel.fraser@ | Annabel Fraser | Groups Administrator | Sales | Active | Allowed | Member |
The users and groups in each unit. Devices are counted above but not listed.
| Unit | Member | Name | Type | Sign‑in |
|---|---|---|---|---|
| Branch offices | bobby.marsh@contoso.example | Bobby Marsh | User | Blocked |
| Sales | annabel.fraser@ | Annabel Fraser | User | Allowed |
| Sales | g#EXT#@contoso.example | Sam Carter (guest) | Guest | Allowed |
| Sales | sales@contoso.example | Sales | Group |
An administrative unit scopes an admin role to the users, groups and devices in it. Scoped admins come from the role assignments Admin roles reads; roles assigned through PIM show as eligible.
Data from Administrative units (), Admin roles (), Users (), Groups and Teams ().