Microsoft 365 FundamentalsDescribe core Microsoft 365 services and conceptsHard
A Microsoft 365 administrator is configuring a new tenant and needs to assign administrative roles to several users to delegate management tasks. They want to grant a user the ability to manage all aspects of Exchange Online, including mailboxes, distribution groups, and mail flow rules, but no other services. Which built-in administrative role should be assigned?
- AUser Administrator
- BService Administrator
- CExchange Administrator
- DGlobal Administrator
Show answer & explanationAnswer & explanation
Correct answer: C. Exchange Administrator
The Exchange Administrator role is specifically designed to manage all aspects of Exchange Online, aligning precisely with the requirement to manage mailboxes, distribution groups, and mail flow rules without granting access to other Microsoft 365 services. This adheres to the principle of least privilege.
Why the other options are wrong
- A. User Administrator can manage users and groups but not Exchange-specific configurations like mail flow rules or distribution groups.
- B. There is no 'Service Administrator' built-in role with this specific scope; typically, admin roles are service-specific or broader like Global/User Admin.
- D. Global Administrator has unrestricted access to all administrative features in Microsoft 365 and Azure AD, which violates the principle of least privilege for this specific task.
Exchange Administrator Role
A built-in Microsoft 365 administrative role with permissions to manage all aspects of Exchange Online.
- Manages mailboxes, distribution groups, mail flow, anti-spam, and anti-malware policies
- Does not grant permissions to other Microsoft 365 services (e.g., SharePoint, Teams)
- Adheres to the principle of least privilege for Exchange-specific tasks
- Can be assigned via the Microsoft 365 admin center or Azure AD admin center
Memory trick: To admin 'Exchange', assign the 'Exchange Admin' role, nothing more.