A Microsoft 365 administrator needs to delegate the ability to manage user mailboxes, including setting mailbox permissions and managing distribution lists, to a junior administrator named Sarah. Sarah should NOT be able to manage other aspects of the tenant, such as security settings or global configurations. Which built-in role in Exchange Online should the administrator assign to Sarah?
- AUser Administrator
- BExchange Administrator
- CHelpdesk Administrator
- DGlobal Administrator
Show answer & explanationAnswer & explanation
Correct answer: B. Exchange Administrator
The 'Exchange Administrator' role in Microsoft 365 is specifically designed to manage all aspects of Exchange Online, including recipient properties (mailboxes, groups, contacts), mail flow, and compliance. This role provides the necessary permissions for mailbox management without granting broader administrative control over the entire tenant.
Why the other options are wrong
- A. User Administrator can manage users' properties and passwords but does not have full control over mailbox-specific settings like permissions or distribution lists.
- C. Helpdesk Administrator has limited permissions, primarily for password resets and basic user property management, not full mailbox control.
- D. Global Administrator has full control over all aspects of the tenant, which violates the principle of least privilege.
Exchange Administrator Role
The Exchange Administrator role in Microsoft 365 grants permissions to manage Exchange Online features, including mailboxes, distribution lists, mail flow rules, and compliance settings. It is a specialized administrative role that adheres to the principle of least privilege for email-related management.
- Manages recipients (mailboxes, groups, contacts).
- Manages mail flow and transport rules.
- Can configure Exchange Online settings.
- Does not have permissions outside of Exchange Online services.
Memory trick: Mailbox tasks? Exchange Admin is your expert, no more, no less.