How to Manage Roles in Exchange: Useful Commands and Instructions

Sometimes, it’s necessary to modify roles in Exchange—for instance, to add or remove the ability to execute certain cmdlets for specific user groups. This article provides examples of commonly used commands that can serve as a handy reference, saving you the trouble of navigating through various sections of Microsoft’s documentation.

Retrieving All Management Roles with Permission for a Cmdlet

To find out which roles are allowed to execute a specific cmdlet, use the following command:

Get-ManagementRole -Cmdlet "clear-mailbox"

Removing a Cmdlet from a Role’s Permissions

If you need to remove a particular cmdlet from a role’s permissions, run this command:

Remove-ManagementRoleEntry "Role Name\Clear-MobileDevice"

Viewing Allowed Cmdlets for a Role

To see the list of all cmdlets permitted for a specific role, use the following:

Get-ManagementRoleEntry "Role Name\Clear-*"

Displaying All Roles Associated with a Management Role

To identify which roles are linked to a specific Management Role, execute:

Get-ManagementRoleAssignment -Role "Role Name" | Select-Object RoleAssigneeName

Copying a Management Role

To create a copy of an existing role, use this command:

New-ManagementRole -Name "Mail Recipients Copy" -Parent "Mail Recipients"

Example: Granting Cmdlet Execution Permissions to a User Group

Suppose you need to allow the execution of the Get-ServerComponentState cmdlet for the “region support” group. Here’s a step-by-step example:

Create a new role inherited from an existing one:

New-ManagementRole -Name "ServerComponentState Support" -Parent "Send Connectors"

Remove all commands from the new role except Get-ServerComponentState:

Get-ManagementRoleEntry "ServerComponentState Support\*" | Where-Object {$_.Name -notlike "*Get-ServerComponentState*"} | Remove-ManagementRoleEntry

Assign this role to the security group:

New-ManagementRoleAssignment -Role "ServerComponentState Support" -SecurityGroup "region support"

Conclusion

Managing roles in Exchange provides flexible ways to configure cmdlet access for different user groups. Use these commands for effective role management and permissions configuration. If you have additional questions or need further information, refer to Microsoft’s official documentation.