After its initial introduction in Exchange 2010, RBAC was
quickly tagged as being overly complex, perhaps because RBAC had to be
managed through EMS. In fact, RBAC is more powerful and easier to use
than messing around with ACLs on objects, but it is difficult for a
component to lose a reputation after it’s been acquired. Exchange 2013
doesn’t use the RBAC phrase. Instead, EAC contains a Permissions
section, which is a much better and more user-friendly term. The
section is broken down into admin roles, user roles, and Outlook Web
App policies. Admin roles refer
to the management role groups discussed so far, whereas user roles
refer to the role assignment policies that govern what users are
allowed to do with Exchange. Out-of-the-box Exchange 2013 comes with
just the default role assignment policy.
Figure 1
shows how EAC shows admin roles (or management role groups). On the
right side of the screen, you see a description of the selected role
group and the management roles that are assigned to the role group—the
set of management roles that represent the permissions a user can use
after he is added to the management role group (or admin role—it is
confusing when terminology changes between versions).
If
you click Edit for the selected management role group, EAC reveals some
more information about the role group, including the users who are
members of the group. Figure 2
shows the properties of the Organization Management role group, the
most capable in terms of the number of roles that are included in the
group and therefore the most powerful in terms of the number of cmdlets
the members of the group are allowed to execute. On the left side of
the screen, you see some descriptive information about the group and
the information that the scope for the group is Default, meaning the
entire organization. A list box then contains all the roles that are
assigned to the group, starting with Active Directory Permissions and
ending with Workload Management (not shown here). An equivalent EMS
command to fetch this information is:
Get-RoleGroup –Identity 'Organization Management'
On
the bottom of the rightmost screen, you can see the users who are
members of the Organization Management role group. Essentially, these
are the enterprise administrators because the roles assigned through
membership of this group enable them to work with almost anything in an
Exchange organization. To retrieve the membership of the Organization
Management role group through EMS, use the command:
Get-RoleGroupMember –Identity 'Organization Management'
