RO Exchange blogging @ EHL(R)O

RO Exchange engineers share news or just interesting solutions with you

More on RBAC and customizing new roles for specific needs

More on RBAC and customizing new roles for specific needs

  • Comments 1
  • Likes

RBAC roles are used by the new version of Exchange and some customers highly use them for achieving different tasks.

However, when coming to the implementation or defining different management roles and entries, management groups, things are not every time that clear.

By default, each user has the “Default Role Assignment Policy”, which grants the users permissions to set their Outlook Web App options and perform self-administrative tasks.

The policy above includes the MyDistributionGroups role assigned - this role enable individual users to create, modify and view distribution groups and modify, view, remove and add members to the distribution groups they own.

Let’s say we want individual users to be able to perform specific actions on distribution groups they own, even if the groups are hidden from the Global Address List. Therefore, we have to create a custom management role, based on the Distribution Groups management role, which enable administrators to create and manage groups and distribution group’s members in the organization. Moreover, we have to compare the actions available to the MyDistributionGroups role, remove the extra permissions, and make an adjustment to make sure it will comply with our needs.

To implement a solution based on an existing RBAC management role group, we can follow the steps below.

 

1.       First, we create a new custom management role, which basically is a collection of actions (commands) we can perform having the role assigned, based on built-in role Distribution Groups using the following command:

New-ManagementRole -Name "Distribution Groups ManagedBy" -Parent "Distribution Groups"

 

2.       We compare then the management role entries (cmdlets) provided by the new custom role and the MyDistributionGroups default role.

We need this information to remove cmdlets and cmdlet parameters we don’t want to make available via the custom management role.

First, we determine the cmdlets of the custom role using the command:

 

Get-ManagementRoleEntry "Distribution Groups ManagedBy\*" | Format-Table name

Name

----

Add-DistributionGroupMember

Disable-DistributionGroup

Enable-DistributionGroup

Get-ADServerSettings

Get-AcceptedDomain

Get-DistributionGroup

Get-DistributionGroupMember

Get-DomainController

Get-DynamicDistributionGroup

Get-Group

Get-MailUser

Get-Mailbox

Get-OrganizationalUnit

Get-Recipient

Get-ResourceConfig

Get-User

New-DistributionGroup

New-DynamicDistributionGroup

Remove-DistributionGroup

Remove-DistributionGroupMember

Remove-DynamicDistributionGroup

Set-ADServerSettings

Set-DistributionGroup

Set-DynamicDistributionGroup

Set-Group

Set-OrganizationConfig

Update-DistributionGroupMember

Write-AdminAuditLog

 

Now run the following command to list the cmdlets for the MyDistributionGroups role:

Get-ManagementRoleEntry "MyDistributionGroups\*" | Format-Table name

Name

----

Update-DistributionGroupMember

Set-Group

Set-DynamicDistributionGroup

Set-DistributionGroup

Remove-DistributionGroupMember

Remove-DistributionGroup

New-DistributionGroup

Get-Recipient

Get-Group

Get-DistributionGroupMember

Get-DistributionGroup

Add-DistributionGroupMember

 

By comparing the two lists, we can determine the cmdlets that are not provided by the MyDistributionGroups role. If we want a new RBAC group based on the default distribution group, we have to remove the additional role entries inherited from the Distribution Groups parent entries.

 

3.       Using the Remove-ManagementRoleEntry command, we remove the cmdlets that are not required from the custom role.

The example below removes the Disable-DistributionGroup cmdlet:

[PS] C:\>Remove-ManagementRoleEntry "Distribution Groups ManagedBy\Disable-DistributionGroup"

Confirm

Are you sure you want to perform this action?

Removing the "(Microsoft.Exchange.Management.PowerShell.E2010) Disable-DistributionGroup -Confirm -Debug

-DomainController -ErrorAction -ErrorVariable -Identity -IgnoreDefaultScope -OutBuffer -OutVariable -Verbose

-WarningAction -WarningVariable -WhatIf" management role entry on the "Distribution Groups ManagedBy" management role.

[Y] Yes [A] Yes to All [N] No [L] No to All [?] Help (default is "Y"): y

 

We repeat the command above until we to remove all the cmdlets we don't need. Additionally we also remove the New-DistributionGroup cmdlet, to remove the ability to create new distribution groups.

 

4.       We can also determine and remove cmdlet parameters not required on the remaining cmdlets.

As before, we can compare the parameters of each cmdlet for MyDistributionGroups with the ones not included in the cmdlets of the custom role.

Use the following command to display the list of parameters for each cmdlet. In the example bellow, the parameter for the Add-DistributionGroupMember are listed:

(Get-ManagementRoleEntry "MyDistributionGroups\Add-DistributionGroupMember").parameters

Confirm

ErrorAction

ErrorVariable

Identity

Member

OutBuffer

OutVariable

WarningAction

WarningVariable

WhatIf

 

Repeat this for the same cmdlet from the custom created Distribution Groups ManagedBy role:

[PS] C:\>(Get-ManagementRoleEntry "Distribution Groups ManagedBy\Add-DistributionGroupMember").parameters

Confirm

Debug

DomainController

ErrorAction

ErrorVariable

Identity

Member

OutBuffer

OutVariable

Verbose

WarningAction

WarningVariable

WhatIf

 

5.       Remove the parameters from the custom role entries. Once you have the list of the parameters to be removed, use the Set-ManagementRoleEntry command to remove them. In the example bellow, the Debug, DomainController and Verbose parameters are removed from the Add-DistributionGroupMember cmdlet:

Set-ManagementRoleEntry "Distribution Groups ManagedBy\Add-DistributionGroupMember" -Parameters Debug, DomainController, Verbose –RemoveParameter

Repeat these steps for all the cmdlets that have parameters that are not part of the entries used in default role.

 

6.       Once we have the desired cmdlets and parameters customized for our management role, we can assign it to an user or a role group. Rather than assigning a management role directly to a user, we can assign it to a role group, where we can add the user who need to perform specific actions.

 

The following command creates a new role group, called ManageBy Group and assigns the custom management role we have created and customized:

New-RoleGroup -Name "ManagedBy Group" -Roles "Distribution Groups ManagedBy"

 

This command results in the creation of the role group, and also of a role assignment called Distribution Groups ManagedBy-ManagedBy Group. This assignment uses the implicit scope of the custom management role for the recipient write scope, which is inherited from the parent default scope. We can see the scope by using the following command:

Get-ManagementRoleAssignment -Role "Distribution Groups ManagedBy" | Format-List Name, *RecipientWriteScope

Name : Distribution Groups ManagedBy-ManagedBy Group

CustomRecipientWriteScope :

RecipientWriteScope : Organization

 

Notice the RecipientWriteScope is set to Organization which is too broad for an assignment. The scope must be changed so that it allows a user to manage only the distribution groups they own. The following command sets the recipient relative write scope to MyDistributionGroups.

Set-ManagementRoleAssignment "Distribution Groups ManagedBy-Distribution Group ManagedBy" -RecipientRelativeWriteScope MyDistributionGroups

7.     We make a functionality test for the role assignment. Added an user to the role groups created in step 6 and opened the ECP.

The user has a broader read scope that allows him to see the hidden objects, when managing distribution groups owned.

 

Following the steps above we can create different RBAC roles, groups and assignments to suits our Exchange organization goals.

I hope you find the information useful,

        Gabriel MUNTEAN

Comments
  • Great piece of information.

Your comment has been posted.   Close
Thank you, your comment requires moderation so it may take a while to appear.   Close
Leave a Comment