Azure vs exchange roles groups

Question

Trying to administer Exchange online in Azure, what is the relationship between those roles:

exchange online management role: Organization Management

vs

Azure AD built-in role: Exchange Administrator

Do you need both or either of them?

Thanks

Answer 1

Hi @Martin P ，

Based on the official description on these 2 roles, since users with Azure AD built-in role Exchange Administrator have global permissions within Microsoft Exchange Online, when the service is present. Also has the ability to create and manage all Microsoft 365 groups, manage support tickets, and monitor service health. the Azure AD built-in role Exchange Administrator seem more permission than Organization Management role.

Here are some comparisons between the two sides:
Exchange online management role: Organization Management:

Detailed information: Organization Management

Azure AD built-in role: Exchange Administrator:

Detailed information: Exchange Administrator

Then you could choose one that based on your need.

---

If an Answer is helpful, please click "Accept Answer" and upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

The Azure role is the same as the Exch org mgmt.
The benefit of the Azure role is that you can enable it for PIM, so I would use that one instead of assigning the Exch Org Mgmt one
It also provides additional Azure roles such as accessing the Health DashBoard and opening service tickets - so I recommend using that one and not Exchange org mgmt :)

https://portal.azure.com/#view/Microsoft_Azure_PIMCommon/UserRolesViewModelMenuBlade/~/description/menuId/members/roleName/Exchange%20Administrator/roleObjectId/29232cdf-9323-42fd-ade2-1d097af3e4de/isRoleCustom~/false/roleTemplateId/29232cdf-9323-42fd-ade2-1d097af3e4de/resourceId/b1c14d5c-3625-45b3-a430-9552373a0c2f/isInternalCall~/true

https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-configure