Distribution groups Exchange online customize MyDistributiongroups role

Question

Hi

Has anybody a good solution for this:
We are currently migrating from Active Directory on-prem our Distribution groups to Exchange Online.

We noticed that those Cloud only distribution groups in Exchange Online have too much permission such as they can remove, modify any settings etc.
When we tested it out, we noticed that there is too much permission on default such as you can modify any proxy address setting, Membership approval, delivery management, message approval and email option and additionally on that they were able to create new Distribution groups that we do not want our end users to do as this will cause big problems in the future.
I was able to find this User Role but it was really strict that what we can modify as a default under MyDistributionGroups (User roles) User roles allow users to manage end-user permissions, and create role assignment policies. Role assignment policies define the level of access that users have to manage their own Exchange mailboxes and distribution groups that they own.

In my understanding that these settings are related to the MyDistributiongroups in User roles in Admin Exchange portal.

MyDistributiongroups
This role enables individual users to create, modify and view distribution groups and modify, view, remove, and add members to distribution groups they own

By default, the settings are that like you can on or off for several settings and no customization is possible…

This is all related to the following change that happened lately:

Microsoft saying that: Beginning in August 2023, managing distribution groups will no longer be possible from Outlook on the web. Administrators should manage their organization’s distribution groups in the Exchange admin center

Page: https://support.microsoft.com/en-us/office/distribution-groups-e8ba58a8-fab2-4aaf-8aa1-2a304052d2de

End user portal: https://admin.exchange.microsoft.com/?page=groups#/

I was able to find this that was close but I want to restrict more: https://blog.expta.com/2013/06/how-to-configure-granular-permissions.html

Our Goal: We want our end users to only able to add and remove owners and memberships on distribution groups they own. All other settings they should not be able to do.

Answer 1

Thank you for your reply, sorry for the late reply i have been busy.

i was unable to find this sections:

Create a Custom Role Assignment Policy

• **Create Role Assignment Policy:**Go back to the Permissions section in the EAC and select User roles andCreate a new policy by clicking on the "+" button.
• **Define Allowed Actions:**Add and remove owners OR Add and remove members and Ensure you uncheck options that allow other settings modifications.
• **Assign Policy to Users:**Assign this custom role assignment policy to the users who will manage their own distribution groups.

Answer 2

Dear Nerdioman,

Good day to you and I hope you are doing well.

Sorry to disturb you. As we did not get a response, may I know if the above reply could clarify your issue, or could you please help confirm if we may help you with anything else? Please let us know if the provided information meets your requirements or resolves your issue, thanks.

Your understanding and patience will be appreciated.

Answer 3

Dear Nerdioman,

Good day! Thank you for posting in the Microsoft Community. We'll be happy to help!

Based on your description, "Distribution groups Exchange online customize MyDistributiongroups role".To achieve a more granular control over permissions for distribution groups in Exchange Online, you'll need to customize the role assignments and policies carefully.please follow the below steps:

1. Create a Custom Role Group

• **Access Exchange Admin Center (EAC):**Go to the EAC at https://admin.exchange.microsoft.com.
• **Navigate to Role Groups:**In the left pane, select Permissions and then Admin roles.
• Create a New Role Group:Click on the "+" button to create a new role group and Name it

2. Add Role Assignments:

• Distribution Groups: This role allows management of distribution groups Optionally, you can remove or avoid adding roles that allow modifications of settings like proxy addresses, membership approval, etc.
• Restricting Settings: users in the Distribution Groups role can manage all aspects of the groups they own. You'll want to restrict this through a custom policy instead.

3. Create a Custom Role Assignment Policy

• **Create Role Assignment Policy:**Go back to the Permissions section in the EAC and select User roles andCreate a new policy by clicking on the "+" button.
• **Define Allowed Actions:**Add and remove owners OR Add and remove members and Ensure you uncheck options that allow other settings modifications.
• **Assign Policy to Users:**Assign this custom role assignment policy to the users who will manage their own distribution groups.

4. Testing the Configuration

• Have a user who is assigned to the new role group test their access.
• Ensure they can only add/remove members and owners without access to other settings.
• Based on testing feedback, you might need to adjust permissions or policies.

Please understand that our initial response may not necessarily resolve the issue immediately. However, with your explanation and more detailed information, we can work together to find a solution.

Thank you for taking the time to be understanding.