Introduction Role Based Access Control (RBAC) is the new permissions model in Microsoft Exchange Server 2010. With RBAC, you don't need to modify and manage access control lists (ACLs), which was...
Published Nov 17, 2009
Version 1.0
Blog Post
Joe and Bday,
I understand you fear ... and I share it to a degree that you are going to end up with this spray of role assignments. But I am afraid we are going to have to keep them.
The Assignments are nessicary since they allow you to link the role to the scope to the group ... it is the piece that puts everything together.
Now maybe we could have done this with just being directly on the group and not being a seperate object ... but the advantage of the assingment is the you can mix and match all three of these things for maximum flexability.
You could have a single group that had only the ability to change a few attributes for users in OU=Executives ... but then had the ability to change more attributes in OU=Users. This is only possible when we have the granularity that Role Assignments offer.
-Matt
I understand you fear ... and I share it to a degree that you are going to end up with this spray of role assignments. But I am afraid we are going to have to keep them.
The Assignments are nessicary since they allow you to link the role to the scope to the group ... it is the piece that puts everything together.
Now maybe we could have done this with just being directly on the group and not being a seperate object ... but the advantage of the assingment is the you can mix and match all three of these things for maximum flexability.
You could have a single group that had only the ability to change a few attributes for users in OU=Executives ... but then had the ability to change more attributes in OU=Users. This is only possible when we have the granularity that Role Assignments offer.
-Matt