Microsoft SC-300

A Microsoft 365 group is primarily for collaboration and access to Microsoft 365 resources (Teams, SharePoint, Planner) and can also be used for app access assignments. However, it does not provide a boundary to scope Entra directory administrative roles so that an admin can manage only the users in that group. It’s not the correct first step for delegated user administration by department.

An administrative unit is designed to delegate administration in Microsoft Entra ID by scoping role assignments to a subset of directory objects. Creating an AU for the marketing department is the correct first step; you then add marketing users to the AU and assign User1 an appropriate role scoped to that AU. This enforces least privilege by preventing User1 from managing finance users.

A management group is an Azure governance construct used to organize subscriptions and apply Azure Policy/RBAC at scale across subscriptions. It does not apply to Microsoft Entra user objects or delegated directory administration. Even though it sounds like “management,” it’s for Azure resource hierarchy, not for scoping permissions to manage specific Entra users.

A resource group is an Azure container for resources like VMs, storage accounts, and VNets, used for lifecycle management and Azure RBAC on resources. It has no role in scoping permissions to manage Microsoft Entra users. It’s a common distractor because it relates to access control, but it’s only for Azure resources, not directory objects.