Customized Roles with Split Permissions

Question

We are running an Exchange 2013 environment using Outlook 2013. We did the install using split permissions because the Exchange Administration and AD Administration are going to be done in two different places.  We have had lot's of permission
issues with the split permission install.  We now need to figure out a way to created a customized role in Exchange that will allow users to only create/enable/move mailboxes AND add/remove people from Distribution Groups.  To this point I have made
a copy of the Mail Recipient Creation role and have been removing role entries from the copy.  I'm just not really sure which roles I should be removing.  Any guidance on what roles would be needed?

Answer 1

Hi ,
Thank you for your question.
We could refer to the following steps to achieve your requirement:
1. Customized role
Create mailbox:
New-Managementrole –Name “Create Mailbox” –parent “Mail recipient Creation”
Get-ManagementRoleEntry “Create Mailbox\*” | where {$_.name –ne “New-maillbox”} | Remove-ManagementRoleEntry
Then we could type “A”.
Enable mailbox:
New-Managementrole –Name “Enable Mailbox” –parent “mail recipients”
Get-ManagementRoleEntry “Enable Mailbox\*” | where {$_.name –ne “Enable-Mailbox”} | Remove-ManagementRoleEntry
Then we could type “A”.
Move mailbox:
New-Managementrole –Name “Move Mailbox” –parent “move mailboxes”
Get-ManagementRoleEntry “Move Mailbox\*” | where {$_.name –ne “New-MoveRequest”} | Remove-ManagementRoleEntry
Then we could type “A”.
Add user to Distribution Group:
New-Managementrole –Name “Add user to DL” –parent “Distribution Groups”
Get-ManagementRoleEntry “Add user to DL\*” | where {$_.name –ne “Add-DistributionGroupMember”} | Remove-ManagementRoleEntry
Then we could type “A”.
Remove user from Distribution Group:
New-Managementrole –Name “Remove user to DL” –parent “Distribution Groups”
Get-ManagementRoleEntry “Remove user from DL\*” | where {$_.name –ne “Remove-DistributionGroupMember”} | Remove-ManagementRoleEntry
Then we could type “A”.
2. Customized role group and Role was add  role group:
New-RoleGroup –Name “Manage Recipients for Helpdesk” –Roles
“Create Mailbox”, “Enable Mailbox”, “Move Mailbox”, “Add user to DL”, “Remove user to DL” –RecipientOrganizationalUnitScope “contoso.com/Users”
3. Add the user you want to grant this connect-mailbox permission to this role group through EAC;
4. Test.
If there are any questions regarding this issue, please be free to let me know. 
Best Regard,
Jim