MS-203 - Microsoft 365 Messaging Role-Based Access Control Questions and Answers

Question 1

A junior administrator needs the ability to create and manage mailboxes, distribution groups, and mail contacts. However, according to the principle of least privilege, they should not be able to configure transport rules or other organization-wide settings. Which built-in management role group in Exchange Online is most appropriate for this administrator?

Accepted Answer

Recipient Management

Answer

The 'Recipient Management' role group contains roles that grant permissions to create and manage Exchange recipient objects like mailboxes, distribution groups, and contacts. The 'Organization Management' group has far too many permissions, 'View-Only' doesn't allow changes, and 'Help Desk' is more limited, typically for tasks like resetting user passwords.

Question 2

What is the primary purpose of a Management Role Assignment Policy in Exchange Online?

Accepted Answer

To grant end-users permissions to configure settings on their own mailboxes and owned distribution groups.

Answer

Management Role Assignment Policies are used to control what settings end-users can modify on their own mailboxes, such as editing their profile information or managing distribution groups they own. They are distinct from the management role groups that assign permissions to administrators.

Question 3

An organization has two administrative teams, one for North America and one for Europe. The European IT team must only be able to manage mailboxes of users located in the 'Europe' Organizational Unit (OU). Which RBAC feature must be created and applied to the European IT team's role group to enforce this restriction?

Accepted Answer

A custom Management Scope based on a recipient filter or OU

Answer

A custom Management Scope allows administrators to define the specific set of objects (such as users within a specific OU) that a role group can manage. By creating a scope for the 'Europe' OU and applying it to the European IT team's role assignment, their permissions will be restricted to only those recipients.

Question 4

An administrator needs to create a new, highly-privileged role group. The new group should have all the permissions of the built-in 'Organization Management' role group except for the ability to perform eDiscovery searches, which is handled by a separate compliance team. What is the most efficient and recommended method to achieve this?

Accepted Answer

Copy the 'Organization Management' role group, and then remove the 'Mailbox Search' and 'Legal Hold' roles from the newly copied group.

Answer

Copying an existing role group is the most efficient method because it duplicates all the necessary roles. From there, the administrator only needs to remove the few specific roles that are not required ('Mailbox Search' and 'Legal Hold' are key for eDiscovery). This is less error-prone than adding dozens of roles manually.

Question 5

Which of the following RBAC components is the fundamental building block that defines a logical grouping of specific cmdlets and their parameters that can be run?

Accepted Answer

Management Role

Answer

A Management Role is a collection of management role entries. Each entry consists of a specific cmdlet (e.g., New-Mailbox) and the parameters that can be used with it. Role Groups are collections of these roles, and Scopes define where they can be applied.

Microsoft 365 Messaging (MS-203) Practice Test

Microsoft 365 Messaging (MS-203) Practice Test

MS-203 - Microsoft 365 Messaging Role-Based Access Control Questions and Answers