Understanding Exchange Role Based Access Control (RBAC)

Role Based Access Control (RBAC) is one of the most useful feature on Exchange 2016 or Exchange Online. Although RBAC has been there since Exchange 2007, It has been more enhanced and flexible on Exchange 2016. In Exchange 2007, the server permissions model applied only to the administrators who managed the Exchange 2007 infrastructure. In Exchange 2016, RBAC now controls both the administrative tasks that can be performed and the extent to which users can now administer their own mailbox and distribution groups.

RBAC assigns permission to users in to primary ways depending on whether the user is an administrator or specialist user, or an end-user.

1. Management Role Groups.
2. Management Role Assignment Policies.

Below are the details of the permission we have by default available on Exchange server.

Assign RBAC to Normal user

To assign RBAC to follow the process below:

1. Login to the Exchange Control Panel (ECP) with exchange administrative rights.
2. Select ‘Permissions’ on left panel and select ‘admin roles’ tab on central panel.
3. Choose which role needed to be assign to the user, and click on edit icon.

1. A new window will get open, scroll down to the Members section and Add new members. Once the members are added click on Save.

Create a new Role Group Policy

To Create a new Role Group Policy, follow the below steps:

1. Login to the Exchange Control Panel (ECP) with exchange administrative rights.
2. Select ‘Permissions’ on left panel and select ‘admin roles’ tab on central panel.
3. Choose which role needed to be assign to the user, and click on ‘+’ icon.

1. A new window of ‘Role Group’ will get open. Assign the name of the of Role and select the that need to be assigned to this group from list.

1. After assigning the list of roles to the Role Group, assign the users to whom these roles are to be associated.

1. Once the task is completed, click on Save to close the window.

1. After the completion of task, you can see a new policy as of others on ‘admin roles’ TAB.

Create a new Role Assignment Policy

As of the RBAC, Exchange server do have also feature on what permission can be provided to users to get edit using their own personal ECP or going to the setting of their OWA.

As of RBAC, New Role Assignment Policy can be created as below:

1. Login to the Exchange Control Panel (ECP) with exchange administrative rights.
2. Select ‘Permissions’ on left panel and select ‘user roles’ tab on central panel.
3. Choose which role needed to be assign to the user, and click on ‘+’ icon.

A new window will get open with below options, on which we can just check mark to enable the permission to the users.

PowerShell Command for Role Assignment Policies:

Create new Role Assignment policy:

New-RoleAssignmentPolicy <assignment policy name> -Roles <roles to assign>

Assign/change a Role Assignment policy to the user:

Set-Mailbox <mailbox alias or name> -RoleAssignmentPolicy <assignment policy>

Remove Role Assignment Policy:

Remove-RoleAssignmentPolicy <role assignment policy>

Hope this will help you to manage delegated admin on the Exchange server more efficiently. J