Permissions

Because there are so many different functions that can be performed within Exchange, Exchange uses the concept of admin roles and admin role groups to ensure that administrators have only the specific permissions they need.

Admin roles

An admin role is a permission set, usually specific to a feature, granting rights to administer that feature only:

Admin roles

For example, the admin role Address Lists, as shown in the screenshot, grants the administrator within that role the right to manage address lists, including global and offline address lists. The role Data Loss Prevention lets the admin manage DLP settings.

An admin role group is a collection of admin roles. Administrators are assigned to admin role groups, rather than having specific admin roles assigned to them:

Admin role groups

For example, the admin role group Discovery Management contains the admin roles Legal Hold, which allows an administrator to configure data retention policies in the context of the Legal Hold feature...