Question

A multinational company uses Microsoft Entra ID with a single tenant. The security team wants regional IT helpdesk staff to be able to reset passwords and manage users only for accounts belonging to their own region, without granting them tenant-wide directory roles. Group-based license assignment and Conditional Access must remain centrally managed by the global identity team. What should you recommend to delegate this scoped administration?

Accepted Answer

Create administrative units for each region, add the regional users, and assign scoped role assignments (Password Administrator / User Administrator) to the regional helpdesk staff over each unit.

Answer

Create separate Entra ID tenants for each region and configure B2B collaboration between them.

Answer

Assign the Helpdesk Administrator role to regional staff and use Conditional Access to restrict which users they can manage.

Answer

Create a custom RBAC role in each subscription that grants password reset permissions and assign it to regional helpdesk groups.