// roles/entra

Exchange AdministratorMicrosoft Entra built-in role

Can manage all aspects of the Exchange product.

Role ID	`29232cdf-9323-42fd-ade2-1d097af3e4de`
Privileged	No
Permissions	25

What it can do

Permission	What it allows
`microsoft.azure.serviceHealth/allEntities/allTasks`	Read and configure Azure Service Health
`microsoft.azure.supportTickets/allEntities/allTasks`	Create and manage Azure support tickets
`microsoft.backup/exchangeProtectionPolicies/allProperties/allTasks`	Create and manage Exchange Online protection policy in Microsoft 365 Backup
`microsoft.backup/exchangeRestoreSessions/allProperties/allTasks`	Read and configure restore session for Exchange Online in Microsoft 365 Backup
`microsoft.backup/restorePoints/userMailboxes/allProperties/allTasks`	Manage all restore points associated with selected Exchange Online mailboxes in M365 Backup
`microsoft.backup/userMailboxProtectionUnits/allProperties/allTasks`	Manage mailboxes added to Exchange Online protection policy in Microsoft 365 Backup
`microsoft.backup/userMailboxRestoreArtifacts/allProperties/allTasks`	Manage mailboxes added to restore session for Exchange Online in Microsoft 365 Backup
`microsoft.directory/contacts/allProperties/read`	Read all properties for contacts
`microsoft.directory/contacts/memberOf/read`	Read the group membership for all contacts in Microsoft Entra ID
`microsoft.directory/contacts/standard/read`	Read basic properties on contacts in Microsoft Entra ID
`microsoft.directory/groups.unified/assignedLabels/update`	Update the assigned labels property on Microsoft 365 groups of assigned membership type, excluding role-assignable groups
`microsoft.directory/groups.unified/basic/update`	Update basic properties on Microsoft 365 groups, excluding role-assignable groups
`microsoft.directory/groups.unified/create`	Create Microsoft 365 groups, excluding role-assignable groups
`microsoft.directory/groups.unified/delete`	Delete Microsoft 365 groups, excluding role-assignable groups
`microsoft.directory/groups.unified/members/update`	Update members of Microsoft 365 groups, excluding role-assignable groups
`microsoft.directory/groups.unified/owners/update`	Update owners of Microsoft 365 groups, excluding role-assignable groups
`microsoft.directory/groups.unified/restore`	Restore Microsoft 365 groups from soft-deleted container, excluding role-assignable groups
`microsoft.directory/groups/hiddenMembers/read`	Read hidden members of Security groups and Microsoft 365 groups, including role-assignable groups
`microsoft.directory/onPremisesSynchronization/standard/read`	Read standard on-premises directory synchronization information
`microsoft.office365.exchange/allEntities/basic/allTasks`	Manage all aspects of Exchange Online
`microsoft.office365.network/performance/allProperties/read`	Read all network performance properties in the Microsoft 365 admin center
`microsoft.office365.serviceHealth/allEntities/allTasks`	Read and configure Service Health in the Microsoft 365 admin center
`microsoft.office365.supportTickets/allEntities/allTasks`	Create and manage Microsoft 365 service requests
`microsoft.office365.usageReports/allEntities/allProperties/read`	Read Office 365 usage reports
`microsoft.office365.webPortal/allEntities/standard/read`	Read basic properties on all resources in the Microsoft 365 admin center

Assign it

The role ID is the same in every tenant, so these work as they are. Make it eligible through PIM:

powershell13 lines

1
2
3
4
5
6
7
8
9
10
11
12
13Connect-MgGraph -Scopes "RoleEligibilitySchedule.ReadWrite.Directory"
$user = Get-MgUser -UserId "jane.doe@contoso.com"
New-MgRoleManagementDirectoryRoleEligibilityScheduleRequest -BodyParameter @{
    Action           = "AdminAssign"
    Justification    = "Needs Exchange Administrator for <reason>"
    RoleDefinitionId = "29232cdf-9323-42fd-ade2-1d097af3e4de"
    DirectoryScopeId = "/"
    PrincipalId      = $user.Id
    ScheduleInfo     = @{
        StartDateTime = (Get-Date).ToUniversalTime().ToString("o")
        Expiration    = @{ Type = "afterDuration"; Duration = "P180D" }
    }
}

Who already has it?

powershell3 lines

1
2
3Connect-MgGraph -Scopes "RoleManagement.Read.Directory"
Get-MgRoleManagementDirectoryRoleAssignment -Filter "roleDefinitionId eq '29232cdf-9323-42fd-ade2-1d097af3e4de'" -ExpandProperty Principal |
    ForEach-Object { $_.Principal.AdditionalProperties.displayName }

Related roles

Groups Administrator · 26 permissions
SharePoint Administrator · 27 permissions
SharePoint Advanced Management Administrator · 28 permissions
Windows 365 Administrator · 28 permissions
Global Secure Access Administrator · 20 permissions
Authentication Policy Administrator · 19 permissions
Guest Inviter · 17 permissions
SharePoint Backup Administrator · 17 permissions

Find the smallest role for a task →

Sources

Microsoft Learn: Microsoft Entra built-in roles