SOLVED

Office 365 Groups

%3CLINGO-SUB%20id%3D%22lingo-sub-176691%22%20slang%3D%22en-US%22%3EOffice%20365%20Groups%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-176691%22%20slang%3D%22en-US%22%3E%3CP%3EHey%20Guys%2C%20Simple%20question%2C%20is%20there%20a%20way%20to%20make%20it%20so%20a%20user%20who%20has%20Service%20Administrator%20permissions%20in%20Office%20365%20and%20(Recipients%20Role%2C%20Distribution%20Groups%20Role)%20in%20Exchange%20Online%20RBAC%20can%20modify%20group%20membership%20for%20Office%20365%20Groups%3F%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EHere%20is%20the%20error%20the%20user%20is%20getting%20when%20trying%20to%20modify%20an%20Office%20365%20Group%3A%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EIs%20there%20anyway%20to%20allow%20a%20user%20to%20modify%20group%20membership%20for%20Office%20365%20groups%20without%20granting%20user%20management%20role%3F%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThanks%2C%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ERobert%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-176691%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EOffice%20365%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EOffice%20365%20Groups%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-177024%22%20slang%3D%22en-US%22%3ERe%3A%20Office%20365%20Groups%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-177024%22%20slang%3D%22en-US%22%3EThanks%20for%20the%20clarification%20Vasil.%20That's%20what%20I%20was%20looking%20for.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-177023%22%20slang%3D%22en-US%22%3ERe%3A%20Office%20365%20Groups%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-177023%22%20slang%3D%22en-US%22%3EThanks%20for%20the%20clarification%20Tony.%20That's%20what%20I%20was%20looking%20for.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-176837%22%20slang%3D%22en-US%22%3ERe%3A%20Office%20365%20Groups%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-176837%22%20slang%3D%22en-US%22%3E%3CP%3Eanother%20issue%20is%20that%20the%20Groups%20cmdlets%20do%20not%20support%20RBAC...%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EStill%20another%20is%20that%20the%20Groups%20membership%20model%20only%20differentiates%20between%20owners%20(who%20can%20add%20new%20members)%20and%20members%20(who%20cannot).%20Tenant%20admins%20override%20this%20restriction%2C%20but%20that%20doesn't%20help.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-176794%22%20slang%3D%22en-US%22%3ERe%3A%20Office%20365%20Groups%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-176794%22%20slang%3D%22en-US%22%3E%3CP%3EThe%20problem%20is%20Groups%20are%20not%20Exchange%20objects%2C%20they%20are%20AAD%20objects.%20While%20you%20can%20certainly%20govern%20some%20settings%20via%20the%20ExO%20cmdlets%2C%20AAD%20remains%20the%20source%20of%20authority%2C%20thus%20the%20portal%20requires%20you%20to%20have%20the%20necessary%20permissions%20to%20run%20the%20corresponding%20AAD%20cmdlets%2FAPI%20calls.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThat%20said%2C%20if%20you%20are%20OK%20with%20using%20the%20EAC%20or%20PowerShell%2C%20you%20can%20certainly%20use%20an%20Exchange%20admin%20(or%20non-admin%20with%20the%20relevant%20permissions)%20to%20manage%20them.%20All%20you%20need%20is%20to%20have%20the%20Mail%20Recipients%20role%20assigned.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-176699%22%20slang%3D%22en-US%22%3ERe%3A%20Office%20365%20Groups%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-176699%22%20slang%3D%22en-US%22%3ERight.%20If%20i%20add%20the%20user%20administrator%20role%20it%20works%20as%20expected.%20I%20just%20need%20to%20know%20if%20there%20is%20a%20way%20to%20make%20it%20so%20a%20non-admin%20(who%20has%20all%20the%20exchange%20role%20group%20permissions)%20can%20edit%20Office%20365%20Group%20membership.%20%3CBR%20%2F%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-176697%22%20slang%3D%22en-US%22%3ERe%3A%20Office%20365%20Groups%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-176697%22%20slang%3D%22en-US%22%3EWell%2C%20according%20to%20the%20error%20you%20are%20getting%2C%20you%20need%20to%20be%20at%20least%20EXO%20Administrator%20%2B%20User%20Administrator%20so%20I%20guess%20that%20User%20Role%20is%20not%20enough%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1118291%22%20slang%3D%22en-US%22%3ERe%3A%20Office%20365%20Groups%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1118291%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F64%22%20target%3D%22_blank%22%3E%40Tony%20Redmond%3C%2FA%3E%26nbsp%3Bnearly%202%20years%20on%2C%20is%20that%20right%20O365%20groups%20CMDlets%20still%20don't%20support%20RBAC%3F%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20have%20a%20Management%20Scope%20for%20allowing%20local%20site%20admins%20to%20update%20group%20membership%20for%20groups%20they%20are%20not%20owners%20of.%20Works%20like%20a%20dream%20for%20everything%20other%20than%20the%20O365%20Groups.%20Sure%20is%20irritating...%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
Frequent Contributor

Hey Guys, Simple question, is there a way to make it so a user who has Service Administrator permissions in Office 365 and (Recipients Role, Distribution Groups Role) in Exchange Online RBAC can modify group membership for Office 365 Groups? 

 

Here is the error the user is getting when trying to modify an Office 365 Group: 

 

 

 

Is there anyway to allow a user to modify group membership for Office 365 groups without granting user management role? 

 

Thanks, 

 

Robert

14 Replies
Highlighted
Well, according to the error you are getting, you need to be at least EXO Administrator + User Administrator so I guess that User Role is not enough
Highlighted
Right. If i add the user administrator role it works as expected. I just need to know if there is a way to make it so a non-admin (who has all the exchange role group permissions) can edit Office 365 Group membership.
Highlighted
Best Response confirmed by Robert Bollinger (Frequent Contributor)
Solution

The problem is Groups are not Exchange objects, they are AAD objects. While you can certainly govern some settings via the ExO cmdlets, AAD remains the source of authority, thus the portal requires you to have the necessary permissions to run the corresponding AAD cmdlets/API calls.

 

That said, if you are OK with using the EAC or PowerShell, you can certainly use an Exchange admin (or non-admin with the relevant permissions) to manage them. All you need is to have the Mail Recipients role assigned.

Highlighted

another issue is that the Groups cmdlets do not support RBAC...

 

Still another is that the Groups membership model only differentiates between owners (who can add new members) and members (who cannot). Tenant admins override this restriction, but that doesn't help.

Highlighted
Thanks for the clarification Tony. That's what I was looking for.
Highlighted
Thanks for the clarification Vasil. That's what I was looking for.
Highlighted

@Tony Redmond nearly 2 years on, is that right O365 groups CMDlets still don't support RBAC? 

 

I have a Management Scope for allowing local site admins to update group membership for groups they are not owners of. Works like a dream for everything other than the O365 Groups. Sure is irritating... 

Highlighted

@Joshua Bines Yep. The Groups cmdlets seem to work well for tenant admins and the other admin roles that support groups, like the new Groups admin role. But they don't do scoping.

Highlighted
Highlighted
Highlighted

@Joshua Bines I played with this a little but it didn't work as I expected.

 

1. Created AU

2. Added several accounts to AU

3. Created new Microsoft 365 group with those accounts as members and added it to AU.

4. Assigned one of the users as a Groups administrator for the AU.

5. Logged onto Azure AD portal for that user. They could update some group properties like the description and sensitivity label assignment, but they couldn't update group membership, which is what I think you're after.

 

Maybe this is a timing thing and I should wait to see if the permissions sort themselves out...  but I note that the documentation https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/directory-administrative-... mentions membership management, so it should work.

User management

USER MANAGEMENT
Permissions MS Graph/PowerShell Azure AD portal Microsoft 365 admin center
administrative unit-scoped management of user properties, passwords, licenses Supported Supported Supported
administrative unit-scoped blocking and unblocking of user sign-ins Supported Supported Supported
administrative unit-scoped management of user MFA credentials Supported Supported Not supported

Group management

GROUP MANAGEMENT
Permissions MS Graph/PowerShell Azure AD portal Microsoft 365 admin center
administrative unit-scoped management of group properties and members Supported Supported Not supported
administrative unit-scoped management of group licensing Supported Supported Not supported
Highlighted

To bring everyone up to speed, I reported the problem I experienced to the Azure AD team and they found an issue that's now resolved. Group management via delegated admins works as expected. I'll document this and publish an article on Petri.com to report what I found.

Highlighted
Thank you Tony for the update and the investigation! I was wondering why this wasn't working in my tenant.
Highlighted