This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(140.8, 68%, 23%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAV%3C/text%3E%3C/svg%3E)
We have a lot of mail enabled security groups that are used to manage access to Sharepoints sites and are used for mailings. The problem is that our user admins cannot add new users to these groups without needing full Exchange admin rights. I have made a new Exchange Admin Role with only this option checked: 'Security Group Creation and Membership'. I would think that this, with the User Administrator role would be enough to be able to add users to mail enabled security groups. With full exchange admin rights you can add users to the mail enabled security groups from the Microsoft 365 admincenter, however with only the custom rule I made you cannot. Am I overlooking something? It seems to be overkill and not good for privacy nor security to give all my User Admins full Exchange rights aswell... Thanks and sorry for any errors in my writing...
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(240, 41%, 33%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EWD%3C/text%3E%3C/svg%3E)
As Vasil Michev said, the described roles provided seem to be sufficient, and using the "-BypassSecurityGroupManagerCheck" parameter can bypass the security group manager check, allowing users who are not members of the security group to modify the group membership Identity, it is recommended that you try checking to see if it solves the problem.
Said role should be sufficient, however I wouldn't expect it to work outside of the Exchange tools (i.e. the Exchange admin center or Exchange PowerShell). If using the latter, make sure to specify the -BypassSecurityGroupManagerCheck parameter.
The problem here is that my User Admins don't and can't work in PowerShell, so they can't use the -BypassSecurityGroupManagerCheck parameter. Is there a way to permanently enable this option for them? So they can use the GUI?
Have him try the Exchange admin center instead of the M365 one.
It does work within the Exchange admin center. With the previous full Exchange rights they could add users to the mail-enabled security groups from within the M365. Is there a way we could alter the custom Exchange admin role so that they could still do that from within M365? Or is this only possible with the full Exchange admin role?
Afaik no. You cannot expect the Microsoft 365 admin center to support all workload-specific functionalities, such as custom RBAC roles for Exchange. I believe you can use the built-in Exchange Recipient Administrator role, but that's the "lowest" you can go.
Thank you very much for the clarification, I was afraid this would be the case. I'll have my User Admins utilise both admin portals then. My organisation's mail-security thanks you!