Create custom RBAC roles in Exchange and Office 365

• Author
• Recent Posts

Jeff Brown

Jeff is a systems administrator and cloud engineer with over a decade of experience in server and application administration. He has managed a wide range of technologies in his career, including Windows Server, Microsoft 365. and Azure. Jeff has also created video-based training for Cybrary and PluralSight. You can follow Jeff on his blog at jeffbrown.tech, or feel free to contact him on Twitter at @jeffwbrown.

Latest posts by Jeff Brown (see all)

• Manage Azure Policy using Terraform - Tue, Aug 2 2022
• Getting started with Terraform in Azure - Tue, Jul 12 2022
• Azure Bicep: Getting started guide - Fri, Nov 19 2021

RBAC allows applying granular permissions based on someone's job role, such as user management, e-discovery, or read-only access. You can customize RBAC with the PowerShell commands explained in this article.

For the examples in this post, I will be using Exchange Online in Office 365; however, these commands should apply to on-premises Exchange Server, but your mileage may vary. In the Exchange admin center, under Permissions and Admin Roles, there are several pre-built groups with assigned roles.

Exchange default roles

For instance, the Help Desk group has the Reset Password, User Options, and View-Only Recipients roles assigned to it. These roles allow the administrators in the Help Desk group to run certain Exchange PowerShell commands. To see the commands and parameters attached to a role, run Get-ManagementRoleEntry with the name of the role and an asterisk for all commands associated with the role:

Get-ManagementRoleEntry "Reset Password\*"

Reset password available commands

The Set-User command combined with the ResetPasswordOnNextLogon parameter allows administrators to reset user passwords. Let's say a certain role meets your needs but has some commands in it you don't want administrators to have the ability to run. You can create a custom role based off an existing role and remove PowerShell commands or parameters to limit those permissions.

Let's say I want to create a group that allows administrators to create mailboxes but not remove mailboxes. I need to find an existing role that contains the New-Mailbox command. We'll use the Get-ManagementRole command with -Cmdlet to filter for New-Mailbox:

Get-ManagementRole -Cmdlet New-Mailbox

Management roles with New Mailbox

The Mail Recipient Creation role looks perfect for our needs. Let's create a copy of it and give it a unique name using the New-ManagementRoleEntry command and specifying Mail Recipient Creation as our parent role:

New-ManagementRole -Name "My Custom Mailbox Recipient Creation" -Description "Allows creating mailbox but not deletion." -Parent "Mail Recipient Creation"

Creating a custom management role

After creating the group, I want to delete the Remove commands available in the role. In this case, these are Remove-MailContact, Remove-MailUser, Remove-Mailbox, and Remove-CalendarEvents:

Get-ManagementRoleEntry "My Custom Mailbox Recipient Creation/Remove-*"

Commands to remove

Unfortunately, Remove-ManagementRoleEntry does not like sending objects to it from the pipeline, so we must run the remove command each time, like this:

Deleting commands

Next, let's remove the Room and Equipment parameters from the New-Mailbox command so the role only allows creating user and shared mailboxes. We can accomplish this by changing the properties of the current entry using the Set-ManagementRoleEntry command and specifying the parameters to remove along with the -RemoveParameter option:

Set-ManagementRoleEntry -Identity "My Custom Mailbox Recipient Creation\New-Mailbox" ‑Parameters Room,Equipment -RemoveParameter

Let's say I also want to add a new command to the group, such as the ability to create databases. I can do this by using the Add-ManagementRoleEntry command:

Add-ManagementRoleEntry -Identity "Shared Mailbox Recipient Creation\New-MailboxDatabase"

Add management role error

The error states it didn't find the New-MailboxDatabase management role entry on the Mail Recipient Creation management role. Unfortunately, you can only add role entries that are in the parent role. Since we created our custom role from the Mail Recipient Creation role, we cannot add any commands not a part of that role. We would need to find an existing management role that contains New-MailboxDatabase to work with.

If we go back to the Exchange admin center, we can modify an existing group or create a new group to add the new management role:

Adding management role

Management roles are not restricted to Exchange administrators. You can also create roles you can apply to users to prevent them from changing some of their own options, such as creating inbox rules, changing their photos, or altering voice mail settings.

In addition to custom roles, custom scopes can also apply to the management groups. This allows restricting the types of objects we can manage. For example, we can create a management scope that applies only to shared mailboxes by using the New-ManagementScope command:

New-ManagementScope -Name "Shared Mailbox Management" -RecipientRestrictionFilter {RecipientTypeDetails -eq "SharedMailbox"}

When applied to a management group, the users in the group and the commands from the assigned roles will only apply to mailboxes whose RecipientTypeDetails is SharedMailbox. We can expand this idea to databases, servers, organizational units, and sites.