We have several helpdesk staff who need to update a few standard distribution lists. They currently have the broad Exchange Administrator role, which grants far more access than they need. Exchange Online includes a Distribution Groups role that appears designed for this exact task, but after assigning it, the Microsoft 365 admin center still doesn't recognize their permissions. As a workaround, we could make each employee an owner of the relevant distribution lists, but that feels inconsistent and difficult to manage. Has anyone encountered this limitation with Exchange-specific RBAC roles, and what's the cleanest way to let helpdesk staff manage distribution groups with least-privilege access?
2 Answers
Which Exchange Online RBAC role was assigned? The exact role matters because a general Exchange Administrator assignment and a narrower distribution-group role provide very different permissions. If the built-in role still doesn’t cover the required operations, define a custom RBAC role with only the distribution-group cmdlets and scopes they need.
Have the staff perform this work through the Exchange admin center instead. The Microsoft 365 admin center may not surface or honor every Exchange Online RBAC role, while the Exchange-specific portal is designed to evaluate those permissions. Depending on the exact actions required, they may also need an additional recipient-management role.
A custom RBAC role has already been created, but the Microsoft 365 admin center still doesn’t appear to recognize it. That makes using the Exchange admin center seem like the more appropriate workaround.