4. Database scoping
To create a database scope, define a new management scope
based on a database list or a database filter. A database list contains
the names of specific databases separated by commas and is an
appropriate scope when you need to assign management responsibility to
a fixed set of databases that you don’t think will change often. For
example, this command creates a database scope that is limited to two
named databases:
New-ManagementScope –Name 'CEO Databases' –DatabaseList 'CEO-Database1, CEO-StaffDatabase'
A
database filter establishes a condition that Exchange can use to
identify a set of databases. This is the most appropriate choice when
you want a scope that is flexible enough to accommodate a changing set
of databases, assuming that you can create a filter that identifies the
databases. This example creates a filter that selects databases with a
name that matches a prefix of DUB-:
New-ManagementScope –Name 'Dublin Databases' –DatabaseRestrictionFilter {Name –Like 'DUB-*'}When
you create a database scope, you permit access to the cmdlets that
manipulate databases, such as Set-MailboxDatabaseCopy. However, you
have to be careful not to overlap server scopes because some operations
are permitted by either a database or a server scope, and some depend
on a specific scope. For example, a database scope controls the ability
to create a new mailbox with the New-Mailbox cmdlet or to move a
mailbox with New-MoveRequest if the target database falls under its
scope. This is logical because a server scope cannot apply in this
case—databases are not tied to servers.
The list of roles included in the Organization Management role
group includes the following five special roles that have to be
delegated before they can be used:
Application Impersonation. This
is a special-purpose role intended primarily for use by Service
Accounts that need to take on the persona of a user to accomplish a
task. Because the impersonate role allows access to the data held
inside user mailboxes, its use has to be carefully controlled.
Mailbox Import Export. This
role allows a user to import data into or export data from a mailbox.
This is another role whose allocation needs to be controlled on an
as-needed basis.
Mailbox Search. This
role allows a user to search mailbox contents. The role is assigned to
the Discovery Management role group, but the role group has no default
members and needs to be populated before searches can be performed.
Support Diagnostics. This
role allows access to diagnostics cmdlets such as
Test-ReplicationHealth that are intended for use by Microsoft or other
support personnel to retrieve diagnostic information from an Exchange
server or organization. The role is not assigned to any user by default.
Unscoped Role Management. This
role permits unscoped roles to be created and managed. Unscoped roles
authorize access to custom scripts and cmdlets. The role is not
assigned to any user by default, but it can be delegated to users by
holders of the Organization Management role.
These
are called delegated role assignments. The members of the Organization
Management role group have the right to delegate the roles to users,
but they do not have the right to use the role themselves unless they
delegate the role to themselves.
The inclusion of the Mailbox
Import Export role in this list might be surprising, but it is entirely
justified if you consider that you probably want to control the ability
to import or export mailbox data on an as-needed basis. No one wants to
run the risk that a user might be inadvertently given the ability to
export mailbox data belonging to another user. When this access is
required, you can assign it to a user who needs the role as follows:
New-ManagementRoleAssignment –Role 'Mailbox Import Export' –User '[email protected]'
It
might be more convenient to assign the role to a distribution group
because it is often easier to maintain membership of a group than to
perform individual role assignments. The group has to be a USG rather
than a universal distribution group or a dynamic distribution group.
New-ManagementRoleAssignment –Role 'Mailbox Import Export' –SecurityGroup 'Mailbox Import-Export Team'
After
the role is assigned, assignees can use the Export and Import mailbox
options in EAC and the underlying New-MailboxImportRequest and
New-MailboxExportRequest cmdlets in EMS. Users must restart EAC/EMS
after they have been assigned the role to force a refresh of the RBAC
data and allow the new assignment to become effective.
