Limit litigation hold permissions to specific users

[rdoleman]

Hi All,

ive been asked to find out how we can remove litigation hold permissions from most of the users in the "Organization Management" role. This role has wide ranging powers that are used operationally, but we would like to limit the members in that role to only a few that can administer litigation holds. Can you remove an assigned "sub" role from an admin role and assign it to another role? any ideas would be great...

[#2]

@rdoleman You cannot edit the default organization management role group. Why not just create a custom group with all the permissions you need? You could simply mimic the organization management role group and leave out the "hold" role from it. Remove users from Org management and add to custom group if you don't want them to perform holds.

Tip: If you click on the Org management role group, you can even copy it and just remove the "hold" feature to create your custom role.

[#3]

@rdoleman You cannot edit or change permissions subsets for a builtin Role in Exchange like Organization Management.

Better is to create a Custom Role Group with defined permissions, example for Service Desk you wont want to give all Recipient Management permissions and similary for Exchange admin ( there would be different Skill set or levels like L1/L2/L3 ).

Read about what the Role Groups subset functions and what purpose they fulfill and then based on that create your Custom Role Groups for different IT Teams in your organization.

Must Read -  Get-RoleGroup & Get-RoleassignmentPolicy for exchange specific . also note RoleGroup is different from MSOLRoles (Get-msolrole )

Cheers !

Ankit Shukla