Service account permission

Question

Hello,
We need to create a service account which should have the below permission for the tasks.,
Get-ExchangeServer
Get-Recipient
Set-ActivesyncMailboxPolicy
New-ActivesyncMailboxPolicy
Remove-ActivesyncMailboxPolicy
Clear-Activesync Device
Remove-ActivesyncDevice
Get-CASMailbox
Set-CASMailbox
Set-ActivesyncMailboxPolicy
Get-ActivesyncDeviceStatistics
What permissions are required to be assigned via RBAC
Regards, Ajit

Answer 1

We followed the below mentioned cmdlet
A)
Management Role Name EAS
New-ManagementRole -Name “EAS” -Parent “Organization Client Access”
Add-ManagementRoleEntry “EAS\Get-ActiveSyncDeviceAccessRule”
Add-ManagementRoleEntry “EAS\Get-ActiveSyncDeviceClass”
Add-ManagementRoleEntry “EAS\Get-ActiveSyncOrganizationSettings”
Add-ManagementRoleEntry “EAS\Get-AuthRedirect”
Add-ManagementRoleEntry “EAS\Get-CASMailbox”
Add-ManagementRoleEntry “EAS\Get-ClientAccessArray”
Add-ManagementRoleEntry “EAS\Get-OutlookProvider”
Add-ManagementRoleEntry “EAS\Get-RpcClientAccess”
Add-ManagementRoleEntry “EAS\Remove-ActiveSyncDeviceAccessRule”
Add-ManagementRoleEntry “EAS\Set-ActiveSyncDeviceAccessRule”
Add-ManagementRoleEntry “EAS\Set-CASMailbox”
Add-ManagementRoleEntry “EAS\Write-AdminAuditLog”
Add-ManagementRoleEntry “EAS\Get-Exchange Server”
Add-ManagementRoleEntry “EAS”\Get-Recipient”
Now we need to create a new Role group. So that we can add required sa_***** to this role group.
 B)
New-RoleGroup “ActiveSync Enable Wipe” -Roles “EAS”
New-ManagementRole -Name “MailboxManagement” -Parent “Mail Recipients”
The below cmdlet will only keep Set-CasMailbox  for mailboxmanagement role.
Get-ManagementRoleEntry “MailboxManagement\*” | where {$_.name -ne “Set-CASMailbox”} | Remove-ManagementRoleEntry
Only the required roles will be added for mailbox management
Add-ManagementRoleEntry “MailboxManagement\Get-User”
Add-ManagementRoleEntry “MailboxManagement\Get-Mailbox”
Add-ManagementRoleEntry “MailboxManagement\Get-CASMailbox”
Add-ManagementRoleEntry “MailboxManagement\Get-Recipient”
Add-ManagementRoleEntry “MailboxManagement\Set-Mailbox”
Add-ManagementRoleEntry “MailboxManagement\Get-ActiveSyncDeviceStatistics”
Add-ManagementRoleEntry “MailboxManagement\Clear-ActiveSyncDevice”
Add-ManagementRoleEntry “MailboxManagement\Remove-ActiveSyncDevice”
Add-ManagementRoleEntry “MailboxManagement\Remove-ActiveSyncDeviceMailboxPolicy”
Add-ManagementRoleEntry “MailboxManagement\New-ActiveSyncDeviceMailboxPolicy”
Add-ManagementRoleEntry “MailboxManagement\Set-ActiveSyncDeviceMailboxPolicy”
Then we will  add the new management role MailboxManagement to “ActiveSync Enable Wipe” Role Group.
New-ManagementRoleAssignment –Role “MailboxManagement” –SecurityGroup “ActiveSync Enable Wipe”
However for the last 3 cmdlets above error message is observed. as the cmdlets will only work with server role permissions.
How should we proceed further
Should we execute the cmdlet
New-ManagementRole -Name “MailboxManagement” -Parent “Server Role” and then proceed below in STep B
Regards, Ajit