Hi, I have created an custom role and used Mail Recipients as the parent role. I have assigned a write scope for this role to "domain.internal/office1/Users", everything works fine, people assigned this role can manage users and set Manage Full Access Permissions. The problem is that the same admin group that have been assigned the custom Mail Recipients role can also modify Manage Full Access Permissions outside the scope for example users under "domain.internal/office2/Users" or "domain.internal/office3/Users". Thats not my intention and thats why I assigned a specific write scope for the custom Mail Recipients role. Anyone who can help why my write scope dont apply? Does this have something to do with transition from Exchange 2007? We are using one Exchange 2010 SP1 (Transitioned from Exchange 2007) in single domain environment. Regicide