📧 Exchange Online Course · Module 5 of 7
Roles (RBAC) & Organisation Settings
MS-203 Exam Alignment
MS-203
Manage organisational settings and role-based permissions: assign and audit Exchange Online RBAC role groups, create custom role groups with scoped permissions, configure sharing policies, organisation relationships, address book policies, and MailTips.
- Know the built-in Exchange Online role groups and the permissions each grants — especially the difference between Organization Management, Recipient Management, and Help Desk
- Create a custom role group with specific roles and a defined management scope
- Configure an organisation relationship for free/busy calendar sharing with a partner tenant
- Understand Address Book Policies (ABPs) — what they segment and when you need them
- Know the three sharing policy levels: None, Free/Busy time only, Free/Busy time plus subject and location
Exam Tip: MS-203 tests RBAC in scenario format — "A support engineer needs to reset mailbox quotas but must not be able to change transport rules." Know which built-in role grants each permission. When no built-in role fits exactly, the answer is usually a custom role group.
The EAC Roles section and Organization section cover two distinct but equally important areas of Exchange Online governance. Roles controls who can administer Exchange Online and what they can do. Organization controls how your tenant shares calendar information and addresses with other organisations and how users discover each other internally.
🔑 Exchange Online RBAC — How It Works
Exchange Online uses Role-Based Access Control (RBAC) to define what administrators and users can do. RBAC is managed through role groups in EAC → Roles → Admin roles. A role group is a collection of management roles assigned to a set of users. When a user is a member of a role group, they inherit all permissions defined by that group's roles.
💡 Three Layers of Exchange RBAC
- Management Roles — Define the specific cmdlets and parameters a user can run (e.g. the "Mail Recipients" role allows Get-Mailbox, New-Mailbox, Set-Mailbox etc.)
- Role Groups — Collections of management roles assigned to admin users (e.g. "Recipient Management" bundles Mail Recipients, Distribution Groups, Mail Enabled Public Folders)
- Management Scopes — Optional limits on which objects a role group can act on (e.g. only mailboxes in a specific OU or database)
🏷️ Built-in Exchange Online Role Groups
| Role Group | What Members Can Do | Typical Assignee |
|---|---|---|
| Organization Management | Full control of all Exchange Online configuration — mailboxes, transport, connectors, compliance, roles | Senior Exchange/Messaging Engineers |
| Recipient Management | Create and manage mailboxes, groups, contacts, and resources. Cannot change transport rules or connectors | Help Desk Tier 2, HR-adjacent IT staff |
| Help Desk | View and modify a limited set of user properties (display name, phone). Cannot see mailbox content | Tier 1 Support |
| View-Only Organization Management | Read-only access to all Exchange Online objects and configuration — no changes permitted | Auditors, Compliance Officers (read-only) |
| Compliance Management | Manage compliance features — eDiscovery searches, litigation holds, retention policies, audit logging | Legal/Compliance Officers |
| Records Management | Create and manage MRM retention tags and policies | Records Managers |
| Discovery Management | Perform mailbox searches and place In-Place Holds | eDiscovery Officers, Legal Counsel |
| Mail Flow Administrator (Hygiene Management) | Manage transport rules, connectors, accepted domains, anti-spam settings | Messaging Engineers, Security Engineers |
| Security Administrator | Manage EOP anti-spam, anti-malware, Safe Links, Safe Attachments policies | Security Engineers |
| Public Folder Management | Create, manage, and delete public folders and public folder mailboxes | Collaboration Admins |
➕ Creating a Custom Role Group
EAC › Roles › Admin roles › + Add role group
🏠 Home
👤 Recipients
📧 Mail flow
🔑 Roles
Admin roles
🔄 Migration
Admin roles
+ Add role group
PowerShell — Create & Manage Custom Role Groups
Connect-ExchangeOnline # Create a custom role group — recipient and message tracking tasks only New-RoleGroup -Name "HelpDesk-Recipients" -Roles "Mail Recipients","Distribution Groups","Mail Enabled Public Folders","Message Tracking","User Options" -Description "Tier 2 Help Desk — recipient management only" # Add a member Add-RoleGroupMember -Identity "HelpDesk-Recipients" -Member "helpdesk@techcareers.in" # View current members Get-RoleGroupMember -Identity "HelpDesk-Recipients" | Select-Object Name,PrimarySmtpAddress # View all roles assigned to the group Get-RoleGroup -Identity "HelpDesk-Recipients" | Select-Object -ExpandProperty Roles # Remove a member Remove-RoleGroupMember -Identity "HelpDesk-Recipients" -Member "helpdesk@techcareers.in" -Confirm:$false
PowerShell — Audit All Role Group Assignments
Connect-ExchangeOnline # List all role groups with members and role counts Get-RoleGroup | ForEach-Object { $group = $_ $members = Get-RoleGroupMember -Identity $group.Name -ErrorAction SilentlyContinue [PSCustomObject]@{ RoleGroup = $group.Name Members = ($members.Name -join ", ") RoleCount = $group.Roles.Count } } | Format-Table -AutoSize # Find which role groups a specific user belongs to $user = "admin@techcareers.in" Get-RoleGroup | Where-Object { (Get-RoleGroupMember $_.Name -ErrorAction SilentlyContinue).PrimarySmtpAddress -contains $user } | Select-Object Name
🔍 Management Scopes — Limiting What a Role Group Can Touch
A management scope restricts which recipients a role group can manage. Without a scope, Organisation Management can modify any object in the organisation. Scopes let you create an admin who can only manage mailboxes in a specific country, department, or OU.
PowerShell — Create a Scoped Role Group
Connect-ExchangeOnline # Custom scope — only mailboxes where Department = Sales New-ManagementScope -Name "Sales-Only-Scope" -RecipientRestrictionFilter { Department -eq "Sales" } # Role group using that scope New-RoleGroup -Name "Sales-Mailbox-Admins" -Roles "Mail Recipients","Distribution Groups" -CustomRecipientWriteScope "Sales-Only-Scope" # Verify scope filter Get-ManagementScope -Identity "Sales-Only-Scope" | Select-Object Name,RecipientFilter
🏢 Organisation Settings
The EAC Organization section controls how your Exchange Online tenant interacts with other organisations and how internal users find and share information. It contains three key areas: Sharing, Organization relationships, and Address book policies.
Sharing Policies
Sharing policies control whether users can share calendar free/busy information with people outside your organisation — including specific partner domains and the internet at large. Each policy defines what level of calendar detail can be shared.
| Sharing Level | What the External Person Sees | Use Case |
|---|---|---|
| None | Nothing — the request is blocked | Default for internet-facing sharing when privacy is critical |
| Free/busy time only | Busy or free status per time slot — no subject, no location | Allowing external customers to check availability without seeing meeting details |
| Free/busy time, subject and location | Busy/free + meeting title and location | Partner organisations that need enough detail to schedule effectively |
| All calendar appointment information (Full details) | All calendar details including private appointment content | Federated partner orgs with a formal trust relationship — use with caution |
PowerShell — Sharing Policies
Connect-ExchangeOnline # View all sharing policies Get-SharingPolicy | Select-Object Name,Enabled,Domains # View the default sharing policy Get-SharingPolicy -Identity "Default Sharing Policy" | Format-List # Create a sharing policy for a partner domain — free/busy + subject + location New-SharingPolicy -Name "Partner-Sharing-Contoso" -Domains "contoso.com:CalendarSharingFreeBusyDetail" -Enabled $true # Assign to specific mailboxes Set-Mailbox -Identity user@techcareers.in -SharingPolicy "Partner-Sharing-Contoso"
Organisation Relationships (Federated Sharing)
An organisation relationship establishes a direct federated trust between your Microsoft 365 tenant and another Microsoft 365 or Exchange organisation. Unlike sharing policies (which work with any external user), organisation relationships require the partner to also be a Microsoft messaging platform.
💡 Sharing Policy vs Organisation Relationship
- Sharing Policy — Works with any external user (any email domain, any platform). Users individually share their calendar via an invitation. No server-to-server trust required.
- Organisation Relationship — Works only with other Microsoft 365 / Exchange orgs. Establishes a server-level trust. Free/busy is available automatically to all users of both orgs without individual invitations.
PowerShell — Organisation Relationships
Connect-ExchangeOnline # Create org relationship — limited free/busy details for partner New-OrganizationRelationship -Name "Contoso-Partner" -DomainNames "contoso.com" -FreeBusyAccessEnabled $true -FreeBusyAccessLevel LimitedDetails -MailTipsAccessEnabled $true -DeliveryReportEnabled $true # List all organisation relationships Get-OrganizationRelationship | Select-Object Name,DomainNames,FreeBusyAccessEnabled,FreeBusyAccessLevel # Change to availability-only (no subject/location) Set-OrganizationRelationship -Identity "Contoso-Partner" -FreeBusyAccessLevel AvailabilityOnly # Remove a relationship Remove-OrganizationRelationship -Identity "Contoso-Partner" -Confirm:$false
Address Book Policies (ABP)
Address Book Policies segment the Global Address List so that different groups of users see different subsets of recipients. They are the primary tool for multi-tenant organisations (multiple subsidiaries sharing one Exchange Online tenant) that need to keep user populations separate.
| ABP Component | What It Does |
|---|---|
| Global Address List (GAL) | The master address list the ABP presents to assigned users — only users/resources matching the GAL filter are visible |
| Address Lists | Subsets within the GAL (e.g. All Users, All Groups, All Rooms) visible to users in the policy |
| Offline Address Book (OAB) | Downloaded copy of the address list for Outlook in cached mode — must match the ABP's GAL |
| Room List | The list of room mailboxes visible to users when booking — limits room visibility to relevant locations |
PowerShell — Create & Assign an Address Book Policy
Connect-ExchangeOnline # View existing ABPs Get-AddressBookPolicy | Select-Object Name,GlobalAddressList,AddressLists # Create an ABP for a subsidiary New-AddressBookPolicy -Name "Subsidiary-A-ABP" -GlobalAddressList "\Subsidiary A GAL" -AddressLists "\Subsidiary A Users","\Subsidiary A Groups" -OfflineAddressBook "\Subsidiary A OAB" -RoomList "\Subsidiary A Rooms" # Assign to all mailboxes in subsidiary A (using custom attribute) Get-Mailbox -Filter { CustomAttribute1 -eq "SubsidiaryA" } | Set-Mailbox -AddressBookPolicy "Subsidiary-A-ABP" # Verify a user's assignment Get-Mailbox -Identity user@techcareers.in | Select-Object DisplayName,AddressBookPolicy
MailTips
MailTips are informational banners that appear in Outlook and Outlook on the Web when a user is composing an email, warning them about potential issues before they send. They are configured organisation-wide via Organization → MailTips in the EAC.
| MailTip Type | When It Appears |
|---|---|
| Large Audience | When the recipient count exceeds a configured threshold (default: 25). Warns before accidental Reply All storms |
| Restricted Recipient | When the recipient requires sender authentication (e.g. a restricted distribution group) |
| External Recipients | When any recipient is outside the organisation — warns before potentially sending sensitive data externally |
| Oversize Message | When the message exceeds the configured maximum send size |
| Mailbox Full | When the recipient's mailbox is at or near its prohibit send/receive quota |
| Automatic Replies | When the recipient has an out-of-office reply configured |
PowerShell — Configure MailTips Organisation-Wide
Connect-ExchangeOnline # View current MailTip settings Get-OrganizationConfig | Select-Object MailTipsAllTipsEnabled,MailTipsExternalRecipientsTipsEnabled,MailTipsGroupMetricsEnabled,MailTipsLargeAudienceThreshold # Enable all MailTips, set large audience threshold to 20 recipients Set-OrganizationConfig -MailTipsAllTipsEnabled $true -MailTipsExternalRecipientsTipsEnabled $true -MailTipsGroupMetricsEnabled $true -MailTipsLargeAudienceThreshold 20 -MailTipsMailboxSourcedTipsEnabled $true
💡 Best Practices
- Never assign Organization Management to a service account or shared account — use individual named accounts so audit logs capture the actual person making changes
- Use custom role groups with management scopes when one team administers only a subset of the org (e.g. regional admins for a specific country)
- Audit role group membership quarterly — former employees and contractors often retain Exchange admin access after leaving
- For calendar sharing with partners, prefer Organisation Relationships (federated) when both sides are on Microsoft 365 — it is seamless and requires no user action
- Deploy ABPs before users are onboarded in a multi-subsidiary tenant — applying ABPs to an existing populated GAL requires Outlook cache refreshes and can cause temporary confusion
- Enable the External Recipients MailTip in all organisations — it is the simplest control for reducing accidental data leakage via email
🎓 Interview Q&A
Q: What is the difference between Organization Management and Recipient Management in Exchange RBAC?
Organization Management grants full control of all Exchange Online — mailboxes, transport rules, connectors, accepted domains, compliance features, and RBAC itself. It is equivalent to Exchange Administrator for the messaging infrastructure. Recipient Management is scoped to recipient objects only (mailboxes, groups, contacts, resources) and cannot change mail flow, connectors, or roles. Recipient Management is the correct role for help desk staff who create and manage mailboxes.
Q: When would you use an Address Book Policy and what does it require to work?
Address Book Policies are used when multiple distinct organisations (subsidiaries, business units, or clients) share a single Exchange Online tenant but need their users to see only the recipients in their own group — not the entire combined GAL. An ABP requires four pre-existing objects: a Global Address List filtered to the group, one or more Address Lists, an Offline Address Book, and a Room List. The ABP is then assigned to mailboxes; Outlook applies the policy and shows only the segmented view.
Q: What is the difference between a Sharing Policy and an Organisation Relationship?
A Sharing Policy allows individual users to share their calendar with any external email address regardless of platform — the user sends an invitation and the external recipient views the shared calendar in their own mail client. An Organisation Relationship establishes a server-level federated trust between two Microsoft 365 or Exchange organisations — free/busy information flows automatically between all users of both orgs with no individual invitations required. Organisation relationships are more seamless but only work between Microsoft messaging platforms.
Q: A support engineer must only be able to manage mailboxes for users in the Sales department, not any other department. How do you configure this?
Create a custom management scope with a RecipientRestrictionFilter targeting Department = "Sales" (New-ManagementScope), then create a custom role group with the "Mail Recipients" role and assign the scope via the CustomRecipientWriteScope parameter. When the engineer is added to that role group, they can only run recipient cmdlets against Sales mailboxes — any attempt to act on a mailbox outside Sales returns an access-denied error.
Q: What are MailTips and what does the Large Audience MailTip prevent?
MailTips are informational warnings that appear in Outlook when composing an email — before the message is sent. The Large Audience MailTip fires when the total recipient count (including all members of expanded distribution groups) exceeds the configured threshold (default 25). It warns the sender they are about to email a large group, helping prevent accidental Reply All storms to organisation-wide distribution lists. It is configured via Set-OrganizationConfig -MailTipsLargeAudienceThreshold.
🎯 MS-203 Mock Test
Module 5 — Exchange Online: Roles (RBAC) & Organisation Settings
Question 1 of 5
A support engineer needs to create shared mailboxes and manage distribution groups, but must not be able to create transport rules or edit connectors. Which built-in Exchange Online role group should be assigned?
✅ Correct answer: B. Recipient Management grants access to mailboxes, groups, contacts, and resources — exactly what's needed. It cannot access Mail Flow (transport rules, connectors) or Roles sections of the EAC. Organization Management (A) would give too much access including transport rules. Mail Flow Administrator (D) covers transport rules and connectors but not recipient objects.
Question 2 of 5
No built-in Exchange role group matches the permissions needed: staff must manage mailboxes for European users only, with no access to US or APAC mailboxes. What should you create?
✅ Correct answer: C. Management scopes enforce which objects a role group can act on technically — not by policy or trust. Create a scope using New-ManagementScope with a filter like Country -eq "EU", then create a custom role group with Mail Recipients roles and assign that scope. RBAC enforces it at the cmdlet level — actions on non-EU mailboxes return access denied regardless of intent.
Question 3 of 5
Your organisation needs to share free/busy calendar information with users at partner.com, which is also on Microsoft 365. Users should be able to see each other's availability without individual calendar invitations. What should you configure?
✅ Correct answer: B. An organisation relationship establishes a federated server-level trust between two Microsoft 365 tenants — free/busy flows automatically for all users with no individual invitations needed. A sharing policy (A) requires each user to send an individual sharing invitation and the external person to accept it — not automatic. Remote domain entries (D) control message formatting and automatic reply behaviour, not calendar sharing.
Question 4 of 5
A company acquires a subsidiary. Both organisations will share one Exchange Online tenant, but employees of each must only see recipients within their own company in Outlook's address book. What feature solves this?
✅ Correct answer: A. Address Book Policies segment the GAL within a single tenant — each company's users are assigned an ABP that points to a filtered GAL containing only their own recipients. This is exactly the multi-subsidiary scenario ABPs were designed for. Option D is wrong — ABP-based GAL segmentation is fully supported in a shared tenant and is the Microsoft-recommended approach.
Question 5 of 5
Users are accidentally sending emails to the entire All Staff distribution group (2,000 members) when they meant to reply to a small team. Which MailTip should be enabled and configured to address this?
✅ Correct answer: D. The Large Audience MailTip fires when Outlook detects the message will reach more than the configured recipient threshold (Set-OrganizationConfig -MailTipsLargeAudienceThreshold). Setting this to, say, 50 means any email that would reach 2,000 members through All Staff triggers a warning — giving the sender a chance to reconsider before sending. External Recipients MailTip (A) only fires when recipients are outside the org.
🔒
This module is lockedComplete Module 4 and pass its mock test to unlock this module.