Microsoft Exchange Server 2013 : Role-based access control - Working with RBAC (part 3) - Maintaining role group membership

Maintaining role group membership

Users not included when the role group is created can be added afterward by editing the role group’s properties by using EAC. Any mailbox or distribution group can be added to a role group’s membership, but you cannot add a dynamic distribution group. Figure 5 shows how role group membership is edited through EAC.

Figure 5. Editing role group membership

Another way to maintain role group membership is by running the Add-RoleGroupMember command to add new members and the Remove-RoleGroupMember command to remove group members. For example, these commands add my account to the selected role group and then remove my account from the membership:

Add-RoleGroupMember –Identity 'Help Desk Level 2' –Member 'Tony Redmond'
Remove-RoleGroupMember –Identity 'Help Desk Level 2' –Member 'Tony Redmond'

Adding individual members to a role group can be boring, but Exchange provides the Update-RoleGroupMember command to update the complete membership of a role group with a single command. For example, this command sets the membership of the role group to the three specified users:

Update-RoleGroupMember –Identity "Help Desk Level 2" –Members '[email protected]', '[email protected]', '[email protected]'

You can always pipe a set of objects fetched using Get-Mailbox to add many members to a role group by using one command. For example, you can use Get-Mailbox to fetch details of every mailbox that is marked as belonging to an Exchange administrator by having ExAdmin in custom attribute 14 and piping the set of mailboxes to the Add-RoleGroupMember command:

Get-Mailbox –Filter {CustomAttribute14 –eq 'ExAdmin'} | Add-RoleGroupMember –Identity 'Help Desk Level 2'