Exchange Online RBAC

[neilhiorns]

We are in the process of migrating to Exchange Online (from Exchange 2016) and what to know the best way to apply RBAC. In the On Premise configuration we limited the local admins to only be able to edit mailboxes within their Organizational Unit, basically by the Write Scope.

Obviously AAD does not have OUs so wondering what the the best way to restrict access? I have tried Set-ManagementScope and the "RecipientFilter", does anyone have the best way to use the use the "RecipientFilter" - namely use Company Name, Location etc.

Also, should we use this in conjunction with the "Exchange recipient administrators" role?

[#2 · Accepted solution]

That's totally up to you - whatever attribute makes sense. Some more convoluted scenarios, such as restricting permissions for eDiscovery, only support "member of group" type of scopes, but for the generic roles attributes such as Department, Company, Office and so on work just fine.