Admin Unit scoping of entitlements in Azure AD

[DanJ]

Hi all

Our Azure AD Directory Roles are scoped by admin unit, so for example someone can be in role User Administrator, but only have this access in the Sales Administrative Unit. The AzureAD connector doesn't understand AUs, so we aren't able to assign access or do attestation against these entitlements, as simply assigning the User Administrator entitlement will assign this across the whole tenant.

Has anyone else dealt with this problem? Could we add Administrative Units as an entitlement type and somehow use that to manage this?

[Darshanjain]

Hi @DanJ 

have you checked in postman to see how the Api response are coming when we are calling these entitlement values, it looks like a granular level entitlement where Azure Api's has to be supported then only we can internally check to see if its possible or not

Thanks

Darshan

[DanJ]

@Darshanjain I will take a look at the API to see what is going on

[Darshanjain]

Hi @DanJ 

i did found out something on the Api's to pull Admin units. here is the below link

https://learn.microsoft.com/en-us/graph/api/resources/administrativeunit?view=graph-rest-1.0

Also this is not supported in Azure Ad OOTB, But you can use Rest connector to pull Admin Units in saviynt manage the access.

Thanks

Darshan