#OrganizationalUnits (OU) are a way to assign permissions to only certain parts of the organization in onprem #ActiveDirectory. Very often it is unwanted for admins to have permissions over the entire organization. But how to achieve this in Azure AD?

For a long time, this was not possible, and companies wanted some equivalent of OUs. That's why in Azure AD we have #AdministrativeUnits (AU), which is the equivalent of organizational units from Active Directory.

Unlike onprem AD, administrative units are not containers that house the objects themselves. They are objects to which we can assign other objects. So, we can create an AU called Czech Republic and put users from the Czech Republic in it and delegate an administrator who will have defined roles (for example, Password Administrator) only over these users.

However, keep in mind that the number of roles usable in AU is very limited compared to all roles in Azure AD. And AU membership must be statically defined at this time - dynamic membership is still in preview.