We are running an Exchange 2013 environment using Outlook 2013. We did the install using split permissions because the Exchange Administration and AD Administration are going to be done in two different places.  We have had lot's of permission issues with the split permission install.  We now need to figure out a way to created a customized role in Exchange that will allow users to only create/enable/move mailboxes AND add/remove people from Distribution Groups.  To this point I have made a copy of the Mail Recipient Creation role and have been removing role entries from the copy.  I'm just not really sure which roles I should be removing.  Any guidance on what roles would be needed?

Hi ,

Thank you for your question.

We could refer to the following steps to achieve your requirement:

1. Customized role

Create mailbox:

New-Managementrole Name Create Mailbox parent Mail recipient Creation

Get-ManagementRoleEntry Create Mailbox\* | where {$_.name ne New-maillbox} | Remove-ManagementRoleEntry

Then we could type A.

Enable mailbox:

New-Managementrole Name Enable Mailbox parent mail recipients

Get-ManagementRoleEntry Enable Mailbox\* | where {$_.name ne Enable-Mailbox} | Remove-ManagementRoleEntry

Then we could type A.

Move mailbox:

New-Managementrole Name Move Mailbox parent move mailboxes

Get-ManagementRoleEntry Move Mailbox\* | where {$_.name ne New-MoveRequest} | Remove-ManagementRoleEntry

Then we could type A.

Add user to Distribution Group:

New-Managementrole Name Add user to DL parent Distribution Groups

Get-ManagementRoleEntry Add user to DL\* | where {$_.name ne Add-DistributionGroupMember} | Remove-ManagementRoleEntry

Then we could type A.

Remove user from Distribution Group:

New-Managementrole Name Remove user to DL parent Distribution Groups

Get-ManagementRoleEntry Remove user from DL\* | where {$_.name ne Remove-DistributionGroupMember} | Remove-ManagementRoleEntry

Then we could type A.

2. Customized role group and Role was add  role group:

New-RoleGroup Name Manage Recipients for Helpdesk Roles Create Mailbox, Enable Mailbox, Move Mailbox, Add user to DL, Remove user to DL RecipientOrganizationalUnitScope contoso.com/Users

3. Add the user you want to grant this connect-mailbox permission to this role group through EAC;

4. Test.

If there are any questions regarding this issue, please be free to let me know. 

Best Regard,

Jim

• Edited by jim-xu 6 hours 11 minutes ago

Hi ,

Thank you for your question.

We could refer to the following steps to achieve your requirement:

1. Customized role

Create mailbox:

New-Managementrole Name Create Mailbox parent Mail recipient Creation

Get-ManagementRoleEntry Create Mailbox\* | where {$_.name ne New-maillbox} | Remove-ManagementRoleEntry

Then we could type A.

Enable mailbox:

New-Managementrole Name Enable Mailbox parent mail recipients

Get-ManagementRoleEntry Enable Mailbox\* | where {$_.name ne Enable-Mailbox} | Remove-ManagementRoleEntry

Then we could type A.

Move mailbox:

New-Managementrole Name Move Mailbox parent move mailboxes

Get-ManagementRoleEntry Move Mailbox\* | where {$_.name ne New-MoveRequest} | Remove-ManagementRoleEntry

Then we could type A.

Add user to Distribution Group:

New-Managementrole Name Add user to DL parent Distribution Groups

Get-ManagementRoleEntry Add user to DL\* | where {$_.name ne Add-DistributionGroupMember} | Remove-ManagementRoleEntry

Then we could type A.

Remove user from Distribution Group:

New-Managementrole Name Remove user to DL parent Distribution Groups

Get-ManagementRoleEntry Remove user from DL\* | where {$_.name ne Remove-DistributionGroupMember} | Remove-ManagementRoleEntry

Then we could type A.

2. Customized role group and Role was add  role group:

New-RoleGroup Name Manage Recipients for Helpdesk Roles Create Mailbox, Enable Mailbox, Move Mailbox, Add user to DL, Remove user to DL RecipientOrganizationalUnitScope contoso.com/Users

3. Add the user you want to grant this connect-mailbox permission to this role group through EAC;

4. Test.

If there are any questions regarding this issue, please be free to let me know. 

Best Regard,

Jim

• Edited by jim-xu Wednesday, February 04, 2015 5:38 AM
• Marked as answer by mshpexchange 16 hours 1 minutes ago

This might help: http://www.msexchangecollab.com/role-based-access-control/rbac-prototype-lab-scenario-for-defining-permission-model-for-child-domain-admins-2/