You can add members to this role group by adding users to the Azure AD Exchange admin role in the Microsoft 365 admin center. However, it's a member of the Organization Management role group (as Exchange Service Administrator) and inherits the permissions provided by that role group. This role group doesn't have any roles assigned to it. You can't manage this role group in Exchange Online. Membership in this role group is synchronized across services and is managed centrally. Members can perform searches of mailboxes in the Exchange Online organization for data that meets specific criteria and can also configure legal holds on mailboxes. Members can configure and manage compliance settings within Exchange in accordance with their policies. The following table lists each role group with a description of its use. Some role groups may overlap with other role groups. The following figure shows the relationship between users, role groups, and roles.Įxchange Online includes several built-in role groups, each one providing permissions to manage specific areas in Exchange Online. We recommend that you use role groups to manage permissions.
However, that method of role assignment is an advanced procedure and isn't covered in this topic. It's possible to assign a role directly to a user without using a role group. Role group members can be Exchange Online users and other role groups. They're used only with administrative roles, and not end-user roles.
Role groups typically encompass broader management areas, such as recipient management. This enables you to assign many roles to many role group members at once. When a role is assigned to a role group, the permissions granted by the role are granted to all the members of the role group. To make it easier to assign multiple roles to an administrator, Exchange Online includes role groups. Administrators might have more than one role because they may perform job functions that span multiple areas in Exchange Online. Role groupsĮvery administrator who manages Exchange Online must be assigned at least one or more roles. The following sections provide more information about role groups and role assignment policies. Role assignment policies: Role assignment policies enable you to grant permissions to end users to change settings on their own mailbox or distribution groups that they own. Role groups: Role groups enable you to grant permissions to administrators and specialist users. Exchange Online provides you with the following to help you make assignments: Management roles grant permissions to perform tasks in Exchange Online, but you need an easy way to assign them to administrators and users. Some management roles many be available only to on-premises Exchange Server installations and won't be available in Exchange Online. For more information, see the next section. Because the Exchange admin center (EAC) and Exchange Online PowerShell use cmdlets to manage Exchange Online, granting access to a cmdlet gives the administrator or user permission to perform the task in each of the Exchange Online management interfaces.Įxchange Online includes role groups that you can use to grant permissions.
Management roles give permissions to perform tasks to administrators and users by making cmdlets available to those who are assigned the roles. Following is a brief description of each type:Īdministrative roles: These roles contain permissions that can be assigned to administrators or specialist users using role groups that manage a part of the Exchange Online organization, such as recipients or compliance management.Įnd-user roles: These roles, which are assigned using role assignment policies, enable users to manage aspects of their own mailbox and distribution groups that they own. When a management role is assigned to an administrator or user, that person is granted the permissions provided by the management role.Īdministrative roles and end-user roles are the two types of management roles.
For example, a management role called Mail Recipients defines the tasks that someone can perform on a set of mailboxes, contacts, and distribution groups. A management role defines the set of tasks that an administrator or user can perform. In Exchange Online, the permissions that you grant to administrators and users are based on management roles. If the functionality discussed in this topic doesn't meet your needs, and you want to further customize your permissions model, see Understanding Role Based Access Control. Several RBAC features and concepts aren't discussed in this topic because they're advanced features.
0 kommentar(er)
