RBAC - Which Role type would give admins to create email alias in "Microsoft 365" group?

Question

Which Role type would give admins to create email alias in "Microsoft 365" group? I have tried exchange admin and group admin but still no luck for Microsoft 365 groups?

Answer 1

Hi @Muhammad Rahman ,

I have found the solution

Great to know that you've already thought of a solution and really appreciate it for your sharing!

By the way, since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others.". and according to the scenario introduced here: Answering your own questions on Microsoft Q&A, I would make a brief summary of this thread:

【RBAC - Which Role type would give admins to create email alias in "Microsoft 365" group?】

Issue Symptom:

Which Role type would give admins to create email alias in "Microsoft 365" group? 

I have tried exchange admin and group admin but still no luck for Microsoft 365 groups?

The Solution:

when assigning roles to admins they will need to be directly added to the PIM role for Exchange Admin. I currently had the admins in a security group (already been enabled for Azure AD Roles) but for the Exchange Admin role if they are in that security group it gives them all access to Exchange Admin except the ability to create email alias only for "Microsoft 365" group but for anything else in Exchange they get full access.

 

---

You could click the "Accept Answer" button for this summary to close this thread, and this can make it easier for other community member's to see the useful information when reading this thread. Thanks!

Answer 2

@Muhammad Rahman Thank you for reaching out to us, As I understand you want to create alias for Microsoft 365 group which you created in Azure AD.

As per this article - https://support.microsoft.com/en-us/office/learn-about-microsoft-365-groups-b565caa1-5c40-40ef-9915-60fdb2d97fa2#ID0EBBF=Manage:~:text=Additionally%2C%20if%20you%20have you can use Exchange online PowerShell to manage the settings of Microsoft 365 group.

Example of a similar ask/issue has been discussed here - https://answers.microsoft.com/en-us/msoffice/forum/all/adding-an-email-alias-to-an-office-365-group/4117f66c-7884-44db-8f72-0efcfb882d88 which can be achieved using Set-unifiedGroup cmdlet.

If my understanding of the issue is incorrect, feel free to post back.

Let me know if you have any further questions.

Answer 3

I have found the solution and when assigning roles to admins they will need to be directly added to the PIM role for Exchange Admin. I currently had the admins in a security group (already been enabled for Azure AD Roles) but for the Exchange Admin role if they are in that security group it gives them all access to Exchange Admin except the ability to create email alias only for "Microsoft 365" group but for anything else in Exchange they get full access.

This seems to resolve the question I had asked, and thank you all for helping me which is greatly appreciated.