Screwed up Organization Management assigned roles

Aaron Christenson 41 Reputation points
2020-12-15T16:08:09.17+00:00

2019 Exchange on prem, this issue started because the exchange admins could not create any security / distribution groups or shared mailboxes. Turned out to be an active directory permission missing. The list of assigned roles assigned to the Organization Management got messed up and now I am unable to remove an assigned role. The Admin role Organization Management has the message "Roles were assigned to this role group using multiple write scopes or exclusive write scopes. Therefore, you can't view the write scope or manage the assigned roles here. " Using Exchange shell set-managementroleassignment -ReciepientRelativeWriteScope Organization is not helping me remove the roles that do not belong such as MailboxSearchRole.

Exchange Server Management
Exchange Server Management
Exchange Server: A family of Microsoft client/server messaging and collaboration software.Management: The act or process of organizing, handling, directing or controlling something.
7,340 questions
0 comments
Accepted answer
  1. Lydia Zhou - MSFT 2,371 Reputation points Microsoft Employee
    2020-12-16T02:30:48.69+00:00

    @Aaron Christenson

    After trying to reset the write scope setting back, please wait or force the AD synchronization. You can use the following command to check the CustomRecipientWriteScope again:

    Get-ManagementRoleAssignment -RoleAssignee "Organization Management" | export-csv c:\location\Get-MgmtRA-OrgMgmt.csv

    For your reference: Restore Organization Management Role Back to Default Settings.
    Please Note: Since the web site is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.

    What errors do you get when remove a role from the role group?
    What about removing the unwanted role with EMS? Try this command, if you still cannot manage roles for Organization Management role group, you can post the screenshot here and don't forget to cover your personal information: 

    get-ManagementRoleAssignment "Mailbox Search-Organization Management"  
get-ManagementRoleAssignment "Mailbox Search-Organization Management"|Remove-ManagementRoleAssignment

    If the response is helpful, please click "Accept Answer" and upvote it.
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    1 person found this answer helpful.
    0 comments

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Aaron Christenson 1 Reputation point
    2020-12-16T04:01:50.69+00:00

    Thank you for this response,

    I had found that Catapult Systems website earlier this afternoon. The piece that I was missing was the code you provided. I was not sure I should just do the get-ManagementRoleAssigment and pipe that into a Remove-ManagementRoleAssignment.

    What I found after exporting the Role Assignments was that some of the roles that are not assigned directly such as ApplicationImpersonation Role was assigned directly along with the delegation.

    Following the list on this docs page https://learn.microsoft.com/en-us/previous-versions/office/exchange-server-2010/dd335087(v=exchg.141)?redirectedfrom=MSDN#management-roles-assigned-to-this-role-group-1 I was able to remove the roles that did not belong and all is working again.