Microsoft Entra restricted management administrative unit unexpectedly created
Description
AlphaSOC detected the creation of a restricted management administrative unit
(AU) in Microsoft Entra ID via the Add administrative unit audit action, with
IsMemberManagementRestricted set to true. Restricted AUs limit management of
their members to administrators with appropriate roles scoped to the AU.
Attackers may create one to shield compromised accounts from containment actions
by administrators who lack those scoped permissions.
Impact
If compromised accounts are added to the new AU, responders without appropriate scoped roles may be unable to reset their passwords or disable them. This can delay containment and allow an attacker to retain access during incident response. Creating a restricted AU alone does not place accounts under this protection.
Severity
| Severity | Condition |
|---|---|
Low | Restricted management administrative unit created |
Medium | Restricted AU created with an unexpected action, source ASN, or user agent |
Investigation and Remediation
Review Entra audit logs for the Add administrative unit event and confirm the
restricted management setting. Identify the creating identity and review
subsequent membership changes and roles scoped to the AU. Verify whether the
creation was authorized and whether any members show signs of compromise.
If unauthorized, use an appropriately privileged account to remove affected accounts from the restricted AU and revoke malicious scoped role assignments. Contain compromised accounts, remove the unneeded AU, and investigate other actions performed by the creating identity.