Mailbox Managment

Question

Is there a way to manage a subset of exchange mailboxes and only allow certain admins to manage these mailboxes? We cannot put these users in a group or do a custom attribute because help desk will be able to modify it.

Answer 1

You can create management scope in order to restrict what given admin (or your help desk) can do: https://learn.microsoft.com/en-us/exchange/understanding-management-role-scopes-exchange-2013-help
You can also create "exclusive" scopes, which will allow only specific admins to manage the given subset - everyone else will be denied access. https://learn.microsoft.com/en-us/exchange/understanding-exclusive-scopes-exchange-2013-help
Keep in mind that this only covers Exchange, in Office 365 you need to also think about Azure AD/Microsoft 365 Admin center. The analog of management scopes therein is AU-scoped role assignments: https://learn.microsoft.com/en-us/azure/active-directory/roles/admin-units-assign-roles

Answer 2

@Michael Hailemariam

As michev said, you could use RBAC Management Scope to limit which mailboxes they could manage. Such as:

New-ManagementScope -Name "Mailboxes" -RecipientRestrictionFilter "PrimarySmtpAddress -eq 'user@domain.com'"  

Then apply this Management Scope to RBAC group for admin:

Please note: Management Scope only works for Exchange admin which assigned permission by Exchange RBAC, It doesn't works for Exchange admin which assigned permission by Office 365 admin center.

For more detailed information, you could have a look about those two articles:

New-ManagementScope
Filterable properties for the RecipientFilter parameter on Exchange cmdlets

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

---