MS-203 - Microsoft 365 Messaging Role-Based Access Control Questions and Answers

Question 1

A junior administrator needs the ability to create and manage mailboxes, distribution groups, and mail contacts.
However, according to the principle of least privilege, they should not be able to configure transport rules or other organization-wide settings.
Which built-in management role group in Exchange Online is most appropriate for this administrator?

Accepted Answer

Recipient Management

Answer

Organization Management

Answer

View-Only Organization Management

Answer

Help Desk

Question 2

What is the primary purpose of a Management Role Assignment Policy in Exchange Online?

Accepted Answer

To grant end-users permissions to configure settings on their own mailboxes and owned distribution groups.

Answer

To assign administrative permissions for managing the entire Exchange organization.

Answer

To define the scope of influence for a management role group (e.g., a specific OU).

Answer

To link management roles to specific cmdlets in PowerShell.

Question 3

An organization has two administrative teams, one for North America and one for Europe. The European IT team must only be able to manage mailboxes of users located in the 'Europe' Organizational Unit (OU). Which RBAC feature must be created and applied to the European IT team's role group to enforce this restriction?

Accepted Answer

A custom Management Scope based on a recipient filter or OU

Answer

A new parent Management Role

Answer

A new Management Role Assignment Policy

Answer

A 'Deny' role assignment

Question 4

An administrator needs to create a new, highly-privileged role group. The new group should have all the permissions of the built-in 'Organization Management' role group except for the ability to perform eDiscovery searches, which is handled by a separate compliance team. What is the most efficient and recommended method to achieve this?

Accepted Answer

Copy the 'Organization Management' role group, and then remove the 'Mailbox Search' and 'Legal Hold' roles from the newly copied group.

Answer

Create a new role group, then manually add all individual roles from 'Organization Management' except for 'Mailbox Search' and 'Legal Hold'.

Answer

Add the administrators to the 'Discovery Management' role group with a 'Deny' assignment.

Answer

Add the administrators to 'Organization Management' and create a DLP policy to block them from eDiscovery.

Question 5

Which of the following RBAC components is the fundamental building block that defines a logical grouping of specific cmdlets and their parameters that can be run?

Accepted Answer

Management Role

Answer

Management Role Group

Answer

Management Role Scope

Answer

Management Role Assignment

Question 6

You need to create a new custom role group named 'Transport Rule Admins' for a team that will only manage mail flow rules. You intend to assign the built-in 'Transport Rules' management role to this new group. Which PowerShell cmdlet correctly creates the new role group and assigns the specified role?

Accepted Answer

New-RoleGroup -Name 'Transport Rule Admins' -Roles 'Transport Rules'

Answer

New-ManagementRoleAssignment -Name 'TransportAdmins_Assignment' -Role 'Transport Rules' -SecurityGroup 'Transport Rule Admins'

Answer

Update-RoleGroupMember -Identity 'Transport Rule Admins' -Roles 'Transport Rules'

Answer

Set-ManagementRole -Identity 'Transport Rules' -AssignToGroup 'Transport Rule Admins'