Security Policy Errors

How to Create Limited Administrative Roles in Exchange Online

Aamir Naveed Akram Oct 26, 2026 870 views

Question details

The user needs to configure custom administrative roles in Exchange Online to allow IT staff to manage users, contacts, and distribution groups without granting access to mail flow features.

How to Create Limited Administrative Roles in Exchange Online

Product: Exchange Online
Device & OS: not provided
Scenario: Setting up granular administrator permissions for IT staff to manage recipients while restricting access to transport rules and global server settings.
Observed behavior: Default admin roles often grant too much access, exposing mail flow and transport rules when only basic contact and group management permissions are required.

Before you start

Ensure you are logged in to the Microsoft 365 tenant with Global Administrator or Exchange Administrator privileges, as these are required to create and assign custom role groups.

Solution 1Recommended

Create a Custom Role Group in the Exchange Admin Center

Build a specialized role group that grants specific recipient management capabilities while explicitly excluding mail flow and transport rule permissions.

By utilizing custom role groups in Exchange Online, you can enforce the principle of least privilege. This ensures that helpdesk or lower-tier IT administrators only have access to the exact features they need to manage contacts and distribution lists, without jeopardizing global mail routing settings.

Access the Exchange Admin Center

Log in to the Microsoft 365 admin center, expand the left navigation menu, and click on 'Exchange' to open the Exchange Admin Center (EAC).

Navigate to Admin Roles

In the left-hand navigation pane of the Exchange Admin Center, go to 'Roles' and then select 'Admin roles'.

Add a New Role Group

Click the 'Add role group' button. Provide a descriptive name for the group, such as 'Limited Recipient Admin', and enter a brief description of its purpose.

Assign Specific Permissions

On the permissions selection screen, choose only the granular roles needed, such as 'Mail Recipient Creation', 'Mail Recipients', and 'Distribution Groups'. Ensure that 'Transport Rules' and 'Mail Flow' remain unchecked.

Assign Members and Save

Proceed to the 'Members' section, add the IT staff users who require these specific permissions, review your configuration, and click 'Save' to apply the new role.

Create a Custom Role Group in the Exchange Admin Center

Manage Passwords Separately: Exchange Online custom roles do not handle basic Microsoft 365 user password resets or license assignment. Those specific rights should be assigned separately via the 'User Administrator' role in the main Microsoft 365 admin portal.

Free Microsoft Office alternative

Looking for a Lightweight, Highly Compatible Office Alternative?

While Microsoft 365 and Exchange Online power enterprise backend services, managing everyday documents doesn't have to rely on heavy or expensive software. WPS Office is a highly compatible, free alternative that perfectly handles Word, Excel, and PowerPoint files without the premium price tag.

1. Download the Installer: Visit the official WPS Office website and click 'Download' to get the free installation package.
2. Install the Software: Run the setup file and follow the straightforward on-screen instructions to install WPS Office on your device.
3. Edit with Full Compatibility: Open your existing Microsoft Word, Excel, or PowerPoint documents natively and start editing seamlessly.

Fully compatible with Microsoft Office formats, including .docx, .xlsx, and .pptx.Familiar, intuitive user interface for a zero-learning-curve transition.Lightweight installation that runs incredibly fast on both new and older desktop setups.Free built-in PDF editing, conversion tools, and comprehensive cloud support.

Frequently Asked Questions

Why can limited IT admins still see the Exchange admin center interface?

Even with limited permissions, users assigned an Exchange admin role will have basic read access to the Exchange Admin Center portal. However, they will only be able to view and modify the specific features (like Contacts and Groups) granted by their role group. Restricted areas, like Mail Flow, will be grayed out, hidden, or display an 'access denied' prompt.

Can I prevent IT admins from viewing transport rules entirely?

Yes. By intentionally omitting the 'Transport Rules' and 'Mail Flow' permission components when you construct your custom role group, the assigned administrators will not have the rights to view, create, or alter any mail transport rules.

Does the Microsoft 365 User Administrator role include Exchange management?

No. The User Administrator role in Microsoft 365 lets a user manage profiles, passwords, and groups in the Entra ID (formerly Azure AD) portal, but it does not grant direct management rights over Exchange-specific features like mail flow or granular mailbox settings. Custom Exchange Admin Center roles are required for those tasks.

How do I verify the limited administrative role is working correctly?

After assigning a user to your newly created custom role group, ask them to log in to the Exchange Admin Center using an incognito or private browsing window. Have them verify that they can successfully edit a distribution group, but cannot access or modify mail flow features or transport rules.

Microsoft Office Security Issues