Why the smallest role matters
A new support starter is often handed a big admin role "so they can get on with it". It works, until someone with Exchange Administrator deletes a mail flow rule by mistake, or a phished help desk account turns out to have organisation-wide powers. Least privilege doesn't slow you down. It limits the damage when something goes wrong.
Think of it as a building's key system. Recipient Management is a master key for one floor. Organization Management is the key to the whole building. Most first-line jobs only need the key to one cupboard.
The pieces you'll meet (checked against Microsoft Learn on 2 November 2026; names and contents can change, so check again before you rely on them):
- Role: a set of cmdlets and parameters, such as Mail Recipients or View-Only Recipients. Each button in the Exchange admin centre (EAC) runs cmdlets in the background, so the role controls both the console and PowerShell.
- Role group: a bundle of roles you add people to, such as Help Desk or Recipient Management.
- Microsoft Entra roles: tenant-wide roles that also map to Exchange role groups. Quarantine permissions live separately, in the Microsoft Defender portal.
The job-to-role map
| Support job | Smallest built-in option | Why not bigger? |
|---|---|---|
| Look up a mailbox's settings | View-Only Organization Management (Entra: Global Reader), or Help Desk | Read-only work needs no write rights |
| Run a message trace | Help Desk role group. Its View-Only Recipients role is described as "view recipient properties and run message trace" | Organization Management and Compliance Management can also trace, but they carry far more |
| Grant Full Access, Send As or calendar permissions on someone else's mailbox | Recipient Management (Entra: Exchange Recipient Administrator). The role inside it that edits existing mailboxes is Mail Recipients | Exchange Administrator maps to Organization Management, which covers the whole organisation |
| Release quarantined mail for any user | Quarantine Administrator role group in Defender's Email & collaboration roles | Security Administrator and Organization Management can also release, but both are broader |
| Preview quarantined mail without releasing it | Security Reader, Security Operator or Global Reader | These are read-only for quarantine |
If your tenant uses Microsoft Defender XDR Unified RBAC, quarantine actions use a permission named along the lines of Email & collaboration quarantine (manage), not the role groups above. Ask your security admin which model your tenant uses.
Gotcha: the Entra Helpdesk Administrator role. It maps to the Exchange Help Desk role group, but it also lets the holder reset passwords for non-admin users across the tenant. If you only need message trace, ask to be added to the Exchange Help Desk role group directly. Exchange role group membership gives Exchange rights without touching other Microsoft 365 services.
Why Recipient Management is more than most tickets need
Granting Send As on a shared mailbox is a common ticket, so Recipient Management sounds like the obvious choice. Look at what comes with it by default:
Recipient Management role group, default roles
Distribution Groups create and manage every distribution group
Mail Recipient Creation create and remove mail users and contacts
Mail Recipients modify existing recipients (the bit you wanted)
Message Tracking
Migration move mailboxes into or out of the organisation
Move Mailboxes
Recipient Policies OWA, mobile device and authentication policies
Reset Password set room mailbox passwords
It applies to every recipient in the organisation, from the CEO to the board-pack shared mailbox. For a first-line analyst who only changes permissions, most of that is unused risk.
Walkthrough: check what you hold, without changing anything
1. Microsoft Entra admin centre. Sign in at https://entra.microsoft.com, go to Entra ID > Roles & admins, and select Your Role. You'll see your Entra roles, such as Helpdesk Administrator or Global Reader.
2. Exchange admin centre. Open https://admin.exchange.microsoft.com/#/adminRoles (Roles > Admin roles). Open a role group such as Help Desk and look at the Assigned tab to see if you're listed. Don't touch Permission. That tab edits the group.
3. PowerShell (read-only). Lesson 4 covers connecting properly. For now, the queries are:
# Sign in interactively with your own admin account
Connect-ExchangeOnline -UserPrincipalName sam.support@contoso.com
# Which roles do I hold, and through which role group?
Get-ManagementRoleAssignment -RoleAssignee sam.support@contoso.com -Delegating $false |
Format-Table -Auto Role,RoleAssigneeName,RoleAssigneeType
# Who is in the Help Desk role group?
Get-RoleGroupMember "Help Desk"
# Which role contains the cmdlet a task uses, and who holds it?
$Perms = Get-ManagementRole -Cmdlet Add-RecipientPermission # Send As
$Perms | foreach { Get-ManagementRoleAssignment -Role $_.Name -Delegating $false |
Format-Table -Auto Role,RoleAssigneeType,RoleAssigneeName }
Sample output for a first-line account:
Role RoleAssigneeName RoleAssigneeType
---- ---------------- ----------------
View-Only Recipients Help Desk RoleGroup
User Options Help Desk RoleGroup
Reset Password Help Desk RoleGroup
Gotcha: Microsoft's documentation says some of these lookups need more than first-line rights. One page names the Role Management role; another lists role groups such as View-Only Organization Management. If you get a "not recognised" or access error, that tells you something about your own access. Use the Entra Your Role view, or ask your Exchange admin to run the query for you.
Tip: After a role change, sign out and back in. The console may not show new rights until you do.
When to ask for a custom role group
Ask for one when a built-in group is clearly too big for a job you do every week. For example, the team grants mailbox and calendar permissions daily but should never create recipients or run migrations. Only members with the Role Management role can create role groups, and by default that means Organization Management. Your job is to write a clear request. Don't build it yourself.
A good request names the job, the smallest roles, the scope and the evidence:
To: Exchange / M365 platform owner
Subject: Request - custom role group "L1 Mailbox Permissions"
Job: First line grants Full Access, Send As and calendar permissions
(about 40 tickets a month) and runs message traces.
Roles requested: Mail Recipients, View-Only Recipients, Message Tracking
(please check against Get-ManagementRole -Cmdlet for
Add-MailboxPermission and Add-RecipientPermission)
Not needed: Mail Recipient Creation, Migration, Move Mailboxes,
Distribution Groups, Recipient Policies
Scope: whole organisation, or a write scope limited to UK staff if you prefer
Members: sam.support, priya.support
Today: we escalate these to second line, adding about a day per ticket
The trade-off: custom groups need an owner and an occasional review. One group for each real job is enough. Don't create one for every person.
Key takeaways
- Match the job to the smallest role: Help Desk for message trace, Recipient Management (or a custom group with Mail Recipients) for mailbox permissions, Quarantine Administrator for releasing quarantined mail.
- Exchange Administrator maps to Organization Management, and Global Reader maps to View-Only Organization Management. Know what a role maps to before you accept it.
- Recipient Management covers creation, migration, policies and groups across the whole organisation. Most first-line tickets need only a small part of it.
- Check your own access read-only: Entra Your Role, the EAC Admin roles page, or
Get-ManagementRoleAssignment. - Ask for a custom role group when a built-in group is too broad for a recurring job. Organization Management (Role Management) creates it; you write the request.