exchange service administrator and company adminstrator in ExO

crib bar 846 Reputation points
2024-01-17T10:52:57.8+00:00

We are doing a review of admin role and assignments in AAD/Entra and the major 365 apps such as Exchange Online (ExO). Under the 'organization management' role in ExO – there are x2 groups listed: 'exchange service administrator' and 'company administrator'. However, we are struggling to find where these groups are actually established to determine membership, as there are no obvious groups in either AAD/Entra or ExO that match the names. So I am wondering if they are some sort of security principle in Entra/ExO/365 whereby other roles and members naturally become members of these ‘groups’ in ExO and therefore get Organization Management in ExO, or if this is some sort of default configuration when a new tenant is created/ExO is initially setup? I basically need to know who is a ‘member’ of these groups and where this could be viewed & evidenced?

Exchange Online
Exchange Online
A Microsoft email and calendaring hosted service.
6,202 questions
Exchange | Exchange Server | Other
Exchange | Exchange Server | Management
0 comments No comments
{count} votes

Accepted answer
  1. Andy David - MVP 158K Reputation points MVP Volunteer Moderator
    2024-01-17T12:04:25.6+00:00

    Those are groups synced and managed by 365. You can see the breakout here: https://learn.microsoft.com/en-us/exchange/permissions-exo/permissions-exo User's image

    User's image

    0 comments No comments

2 additional answers

Sort by: Most helpful
  1. Andy David - MVP 158K Reputation points MVP Volunteer Moderator
    2024-01-18T12:09:58.0666667+00:00
    1 person found this answer helpful.
    0 comments No comments

  2. crib bar 846 Reputation points
    2024-01-18T09:45:49.2266667+00:00

    Thanks Andy, I understand the 2nd section around who gets organisation management permissions via exchange service admins/exchange admin. Re company administrator role & membership- there isn't actually a visible admin role in Entra called company administrator, so presumably all we need to check is global admins for that side of the equation.

    0 comments No comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.