O365 - Staff resetting passwords

[Jawloms]

'afternoon,

 

In O365, someone with the role of "User Administrator" can obviously reset passwords. Anyone know if it's possible to restrict this to only be able to reset students' (student's?) passwords?

 

Thank you

 

Stuart

[psydii]

Try this

 

" If we assign the Helpdesk Administrator role to an IT administrator in the UK team, they would still be able to reset the password of a user in Canada, which violates the organization’s principle of least privilege. We can resolve this issue by using Entra ID Administrative Units. By creating separate administrative units for UK and Canada users, we can ensure that Helpdesk Administrators are restricted to managing only the users within their designated units."

 

https://www.rebeladmin.com/restricted-management-administrative-units/

 

 

Sub out UK/Canada for Students/Staff.

 

I think if you're provisioning through SDS these AUs might already exist but I could be confusing this with something else.

[georgeescott]

Might be possible doing it through M365 MyStaff https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/my-staff-configure