This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(86.4, 99%, 18%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EIE%3C/text%3E%3C/svg%3E)
Hello,
Looking for Exchange PS command to add "Reset Password Role" to "Organization Management role group". on Exchange 2019 Server
Thanks
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(246.4, 22%, 33%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EKY%3C/text%3E%3C/svg%3E)
Hi @IT Engineer
Just checking in to see if above information was helpful.
Please let us know if you would like further assistance.
If the question has been answered, please accept the helpful reply as the answer to the question to help other community members. Thanks for your understanding.
Try the following cmdlet:
New-ManagementRoleAssignment -Role "Reset Password" -SecurityGroup "Organization Management"
Hello,
Once Run the command facing this error, Even though my user is already Memeber of Organization Management Role group.
[PS] C:\>New-ManagementRoleAssignment -Role "Reset Password" -SecurityGroup "Organization Management" You don't have access to create, change, or remove the "Reset Password-Organization Management-1" management role assignment. You must be assigned a delegating role assignment to the management role or its parent in the hierarchy without a scope restriction. + CategoryInfo : InvalidOperation: (Reset Password-Organization Management-1:ADObjectId) [New-ManagementRoleAssignment], InvalidOperationException + FullyQualifiedErrorId : [Server=EXCH-02,RequestId=5bd34a48-3c9f-4f69-981d-f9ff92aea9,TimeStamp=1/2/2024 8:19:52 AM] [FailureCategory=Cmdlet-InvalidOperationExc eption] D136B18A,Microsoft.Exchange.Management.RbacTasks.NewManagementRoleAssignment + PSComputerName : Exch-02.local
As the error message says, you need to have permissions to create "delegating" assignments, which you currently do not. Login with an Enterprise admin user, or any other user that's allowed to create such assignments. To see which users should have such permissions, you can run:
Get-ManagementRoleAssignment -RoleAssignee 'Organization Management' -Role "Role management" -Delegating:$true -GetEffectiveUsers
Another possibility is that (exclusive) management scopes are in play, so double-check on that:
Get-ManagementRoleAssignment -RoleAssignee 'Organization Management' -Role "Role management" | fl
If you want all members of Organization Management to be able to create such assignments, make sure the "Role management" role is added to the role group as unscoped assignment.
If the above doesn't work, you might have to recreate the default RBAC controls, as detailed for example here: https://thoughtsofanidlemind.com/2010/10/22/replacing-missing-rbac-roles/
Only use that as last resort though, as it will remove any custom RBAC controls you've configured.
Hi @IT Engineer
Please run the following cmdlets in Exchange Management Shell and retry:
Add-pssnapin microsoft*
Install-CannedRbacRoles
Install-CannedRbacRoleAssignments
If you still get the same error, please close the current Exchange Management Shell and open a new one.
Hi @IT Engineer,
Just checking in to see if above information was helpful. Please let us know if you would like further assistance.
If the question has been answered, please accept the helpful reply as the answer to the question to help other community members. Thanks for your understanding.