Using Groups to Assign Exchange Admin Roles to Accounts Without Mailboxes

Question

Exchange Online.  Cloud-only environment.  I'm trying to figure out the best way to assign Exchange admin roles to various IT staff in our organization.  All of our IT staff have dedicated admin accounts for admin tasks, and these accounts do not have mailboxes.  Ideally, I'm trying to make things so that when I add an IT tech's admin account to a group, they get the necessary Exchange roles.

I have an Exchange admin role.  But I see that when it comes to groups, only mail-enabled security groups can be assigned to these roles (I'm trying to avoid direct user assignment).  No problem.  So I try to create a mail-enabled security group and add these admin accounts (no mailbox) as members of the mail-enabled security group.  I can't because the accounts don't have mailboxes.

Is there a better way to do this?  Any recommendations? I'm trying to make this as simple as possible, using groups to assign roles.

Answer 1

Dear Mike Chavez2,

Thanks for your reply! Sorry for my misunderstanding!

And based on tests on my end, I'm getting the same results as yours:

1. When trying to add a 'group' to one Exchange admin role group, only mail-enabled security groups and shared mailboxes can be found.
2. You can't add a user without mailbox to a shared mailbox/mail-enabled security group.

So, as per your need to configure Exchange Admin Roles using groups for accounts without mailboxes, it seems the only option is to add them individually. Like shown in below screenshot, these users are of a different type to the users with a mailbox.

Thank you in advance for your understanding! Your patience and cooperation will be greatly appreciated. I hope all the best!

Answer 2

Thank you for confirming, Connery!

Answer 3

Hi Connery,

I appreciate you taking the time not only to respond but to also include screenshots. Unfortunately I'm still having problems.

In your second screenshot, you illustrate assigning the "Exchange Administrator" role, which provides "Full Access". In my case, I need to provide limited Exchange administrative rights as I am delegating permissions out to our lower-level service desk staff. They shouldn't have full access.

Because I need more granular control of delegated permissions, I'm going to https://admin.exchange.microsoft.com/ > Roles > Admin Roles. From there I have more granular control over the permissions delegated.

Per your instructions, I proceeded to create a Microsoft 365 group and configured Allow Admin Roles to be Assigned to This Group. I go into EAC > Roles > Admin Roles > Then select a role and try to add the assignment. The GUI is not letting me add the newly created Microsoft 365 group--it seems to only accept Mail-Enabled security groups. Mail-enabled security groups only seem to work with users who have mailboxes...

If you have any ideas on how to configure Exchange Admin Roles using groups for accounts without mailboxes, please let me know.

Thank you,

Answer 4

Dear Mike Chavez2,

Greetings!
Thanks for reaching out to this community.

Based on your description, I understand your query about using Groups to assign Exchange Admin roles to accounts without mailboxes.

According to Use Microsoft Entra groups to manage role assignments - Microsoft Entra ID | Microsoft Learn, only groups that have the isAssignableToRole property set to true at creation time can be assigned a role. This property is immutable. And once a group is created with this property set, it can't be changed. You can't set the property on an existing group.

So would you please kindly try below steps as a (Global) admin and check the results?

1. Go to Microsoft Admin center > Teams & groups > Active teams & groups > Teams & Microsoft 365 groups > Add a Microsoft 365 group.
2. After you configured Basics and membership, in Settings page, set the Privacy to Private and select Allow admin roles to be assigned to this group.
3. Then go to Roles > Role assignments, scroll down the list to find Exchange Administrator > Assigned > Add groups.

You may also try to create a role-assignable group in Microsoft Entra ID and then go to Groups > All groups > select that group > Assigned roles > Add assignments.

Appreciate your patience and understanding and thank you for your time and cooperation!