Delegate governance by country or subsidiary

Each Virtual Environment has its own permissions, appearance, dashboards and reports, custom roles and teams go down to single actions, and central IT keeps the full view.

Who it is for: central IT that shares one tenant across units, and the local admins of each unit.

Virtual Environments come with Tenant segmentation (virtual tenants), which is included in the Enterprise Plan and is not sold as a separate add-on. See Add-ons.

Steps

1. Add a Virtual Environment for the unit, with filters such as all users based in one country. See also Virtual Environment.
2. Decide what the local admins may do. Start from the default roles and permissions, or create a custom role and a custom team.
3. Invite the local admins to the environment and assign them a role and team.
4. Give the unit its own policies, reports and dashboards when you set up the Virtual Environment.

Policy templates

Any policy template can be used inside a Virtual Environment. Start with the templates of the services the unit uses, for example Teams policies, SharePoint policies and Microsoft 365 policies.

Limits

• Automations are not available in a Virtual Environment.
• Reviews and provisioning are not available in a Virtual Environment either. Run them from the root environment.
• In a Virtual Environment, search covers inventory, reports and policies only.
• Read permissions cannot be removed from a custom role.
• Every Virtual Environment adds time to the end of each Microsoft 365 scan.