Your company has a Microsoft Entra tenant that contains a user named User 1.

The Microsoft SC-300 Exam Ref and Microsoft Learn module: “Manage administrative units” specify that administrative units (AUs) are used to delegate administrative permissions over subsets of users or groups within an Entra tenant.

In this scenario, the goal is to allow User1 to manage only the users in the marketing department. The correct approach is to create an administrative unit (AU) for the marketing department and then assign User1 an appropriate role (for example, User Administrator) scoped to that AU.

Microsoft 365 groups, management groups, and resource groups serve different purposes:

Microsoft 365 groups are for collaboration.

Management groups organize Azure subscriptions.

Resource groups group Azure resources.

Only administrative units in Entra ID provide delegated role-based administration for user subsets.