Role-Based Access Control Flashcards

A junior administrator needs the ability to create and manage mailboxes, distribution groups, and mail contacts. However, according to the principle of least privilege, they should not be able to configure transport rules or other organization-wide settings. Which built-in management role group in Exchange Online is most appropriate for this administrator?

Answer: Recipient Management

The 'Recipient Management' role group contains roles that grant permissions to create and manage Exchange recipient objects like mailboxes, distribution groups, and contacts. The 'Organization Management' group has far too many permissions, 'View-Only' doesn't allow changes, and 'Help Desk' is more limited, typically for tasks like resetting user passwords.

What is the primary purpose of a Management Role Assignment Policy in Exchange Online?

Answer: To grant end-users permissions to configure settings on their own mailboxes and owned distribution groups.

Management Role Assignment Policies are used to control what settings end-users can modify on their own mailboxes, such as editing their profile information or managing distribution groups they own. They are distinct from the management role groups that assign permissions to administrators.

An organization has two administrative teams, one for North America and one for Europe. The European IT team must only be able to manage mailboxes of users located in the 'Europe' Organizational Unit (OU). Which RBAC feature must be created and applied to the European IT team's role group to enforce this restriction?

Answer: A custom Management Scope based on a recipient filter or OU

A custom Management Scope allows administrators to define the specific set of objects (such as users within a specific OU) that a role group can manage. By creating a scope for the 'Europe' OU and applying it to the European IT team's role assignment, their permissions will be restricted to only those recipients.

An administrator needs to create a new, highly-privileged role group. The new group should have all the permissions of the built-in 'Organization Management' role group except for the ability to perform eDiscovery searches, which is handled by a separate compliance team. What is the most efficient and recommended method to achieve this?

Answer: Copy the 'Organization Management' role group, and then remove the 'Mailbox Search' and 'Legal Hold' roles from the newly copied group.

Copying an existing role group is the most efficient method because it duplicates all the necessary roles. From there, the administrator only needs to remove the few specific roles that are not required ('Mailbox Search' and 'Legal Hold' are key for eDiscovery). This is less error-prone than adding dozens of roles manually.

Which of the following RBAC components is the fundamental building block that defines a logical grouping of specific cmdlets and their parameters that can be run?

Answer: Management Role

A Management Role is a collection of management role entries. Each entry consists of a specific cmdlet (e.g., New-Mailbox) and the parameters that can be used with it. Role Groups are collections of these roles, and Scopes define where they can be applied.

You need to create a new custom role group named 'Transport Rule Admins' for a team that will only manage mail flow rules. You intend to assign the built-in 'Transport Rules' management role to this new group. Which PowerShell cmdlet correctly creates the new role group and assigns the specified role?

Answer: New-RoleGroup -Name 'Transport Rule Admins' -Roles 'Transport Rules'

The `New-RoleGroup` cmdlet is used to create a new management role group. The `-Roles` parameter allows you to assign one or more existing management roles to the group at the time of creation, making this the most direct and correct method.