Thanks in advance.

i have given the service desk "recipient management" rbac permissions. however when they add mailbox permissions, they are adding ti the GUI way, and are leaving Automapp on. Which we do not want. I want them to use the script i have created that they can run from any powershell, or they can us the EMS (exchange management shell) , and run the ps command.

anyways, is there a way of blocking access to the EMC, and just giving them access to the EMS??

cheers y'all

Use red only administrator rights to open EMS for them. It will not harm your environment.

Unfortunately no, they can open EMC if they have permission... Either you need to educate the service desk about the automapping can cause problem in your environment or setup a cmdlet extension agent to do that for you automatically at the backend when someone runs Add-MailboxPermission cmdlet...

Understanding Cmdlet Extension Agents - https://technet.microsoft.com/en-us/library/dd335067(v=exchg.141).as

Hi Riley,

Thank you for your question.

What is about are leaving Automapp on?

First of all, we could not block EMC and just use EMS.

By my understanding, if you want to service desk just create mailbox, we could customize the role to just create mailbox, then they will do not have permission to modify other options.

If there are any questions regarding this issue, please be free to let me know.

Best Regard,

Jim

cheers all. was worth a go.  No matter how many times ya show them, it still happens ha