-1

Is there possible to block administrators from managing one group in Azure AD tenant?

Description, what i expect: I have a one group called "test.group" and for organisation purposes, only two administrators can managed that group (with global admin role). The rest of admins (without global admin role) cannot managed membership or even edit that group. Is it possible? (powershell or GUI?)

I tried Administrative Units but it's pointless to do it only for one group. Unless, there is possible to remove directory roles only for AU scope.

MeLebix
  • 1
  • 1
  • Blocking administrators from managing groups may not be possible. Please check this [repro](https://github.com/sarithamandadi/Mynewrepo/blob/main/Manage%20or%20Block%20Groups%203.docx) . – kavyaS Sep 23 '22 at 07:16

1 Answers1

0

Azure AD roles with permissions microsoft.directory/groups/* will apply to all groups: Global Administrators or Group Administrators will be able to manage any group. You cannot remove, disable or deny such permissions on a per user or per group basis.

Users without microsoft.directory/groups/* permissions won't be able to manage any groups unless they are made owners of the groups. This is achievable out of the box for any member (non guest) user that creates a group. They will be added as the first owner.

Martijn Pieters
  • 1,048,767
  • 296
  • 4,058
  • 3,343
AlfredoRevilla-MSFT
  • 3,171
  • 1
  • 12
  • 18