// compare · entra roles

Exchange Administrator vs Exchange Recipient Administrator

Two Microsoft Entra built-in roles that are often confused, compared permission by permission.

In short: Exchange Administrator has 25 permissions. Exchange Recipient Administrator has 2 permissions. Assign the one with less access that still covers the job.

	Exchange Administrator	Exchange Recipient Administrator
What Microsoft says	Can manage all aspects of the Exchange product.	Can create or update Exchange Online recipients within the Exchange Online organization.
Size	25 permissions	2 permissions

Permissions only Exchange Administrator lists (25)

microsoft.azure.serviceHealth/allEntities/allTasks
microsoft.azure.supportTickets/allEntities/allTasks
microsoft.backup/exchangeProtectionPolicies/allProperties/allTasks
microsoft.backup/exchangeRestoreSessions/allProperties/allTasks
microsoft.backup/restorePoints/userMailboxes/allProperties/allTasks
microsoft.backup/userMailboxProtectionUnits/allProperties/allTasks
microsoft.backup/userMailboxRestoreArtifacts/allProperties/allTasks
microsoft.directory/contacts/allProperties/read
microsoft.directory/contacts/memberOf/read
microsoft.directory/contacts/standard/read
microsoft.directory/groups.unified/assignedLabels/update
microsoft.directory/groups.unified/basic/update
microsoft.directory/groups.unified/create
microsoft.directory/groups.unified/delete
microsoft.directory/groups.unified/members/update
microsoft.directory/groups.unified/owners/update
microsoft.directory/groups.unified/restore
microsoft.directory/groups/hiddenMembers/read
microsoft.directory/onPremisesSynchronization/standard/read
microsoft.office365.exchange/allEntities/basic/allTasks
microsoft.office365.network/performance/allProperties/read
microsoft.office365.serviceHealth/allEntities/allTasks
microsoft.office365.supportTickets/allEntities/allTasks
microsoft.office365.usageReports/allEntities/allProperties/read
microsoft.office365.webPortal/allEntities/standard/read

Permissions only Exchange Recipient Administrator lists (2)

microsoft.office365.exchange/migration/allProperties/allTasks
microsoft.office365.exchange/recipients/allProperties/allTasks

Permissions are listed as Microsoft writes them. A broad one, such as one ending in allTasks, can cover several narrower ones listed for the other role.

Exchange Administrator explained Exchange Recipient Administrator explained

Sources

Microsoft Learn: Microsoft Entra built-in roles