Export (0) Print
Expand All
This topic has not yet been rated - Rate this topic

New-RoleAssignmentPolicy

 

Applies to: Exchange Server 2013, Exchange Online

Topic Last Modified: 2012-09-10

Use the New-RoleAssignmentPolicy cmdlet to create a management role assignment policy on a server running Microsoft Exchange Server 2013.

For information about the parameter sets in the Syntax section below, see Syntax.

New-RoleAssignmentPolicy -Name <String> [-Confirm [<SwitchParameter>]] [-Description <String>] [-DomainController <Fqdn>] [-IgnoreDehydratedFlag <SwitchParameter>] [-IsDefault <SwitchParameter>] [-Organization <OrganizationIdParameter>] [-Roles <RoleIdParameter[]>] [-WhatIf [<SwitchParameter>]]

This example creates an assignment policy.

New-RoleAssignmentPolicy -Name "End User Policy"

After the assignment policy is created, you can assign the assignment policy to a mailbox using the Set-Mailbox cmdlet.

Set-Mailbox Joe -RoleAssignmentPolicy "End User Policy"

This example creates an assignment policy using the IsDefault switch.

New-RoleAssignmentPolicy -Name "Default End User Policy" -IsDefault

This example creates an assignment policy that enables users to modify their personal information, manage their distribution group membership, and manage their voice mail. The new assignment policy is created as the new default assignment policy. Then, all existing mailboxes are configured to use the new assignment policy.

First, the new assignment policy is created and set as the new default assignment policy.

New-RoleAssignmentPolicy -Name "Limited End User Policy" -Roles "MyPersonalInformation", "MyDistributionGroupMembership", "MyVoiceMail" -IsDefault

Because setting the new role assignment as default applies only to new mailboxes or mailboxes moved to an Exchange 2013 server, the Set-Mailbox cmdlet is used to configure the new assignment policy on all existing mailboxes.

Get-Mailbox -ResultSize Unlimited | Set-Mailbox -RoleAssignmentPolicy "Limited End User Policy"

When you create an assignment policy, you can assign it to users using the New-Mailbox, Set-Mailbox, or Enable-Mailbox cmdlets. If you make the new assignment policy the default assignment policy, it's assigned to all new mailboxes that don't have an explicit assignment policy assigned to them.

You can add management roles to the new assignment policy when you create it, or you can create the assignment policy and add roles later. You must assign at least one management role to the new assignment policy for it to apply permissions to a mailbox. Without any roles assigned to the new assignment policy, users assigned to it won't be able to manage their mailbox configuration. To assign a management role after the assignment policy has been created, use the New-ManagementRoleAssignment cmdlet. For more information, see Manage Role Assignment Policies.

For more information about assignment policies, see Understanding Management Role Assignment Policies.

You need to be assigned permissions before you can run this cmdlet. Although all parameters for this cmdlet are listed in this topic, you may not have access to some parameters if they're not included in the permissions assigned to you. To see what permissions you need, see the "Assignment policies" entry in the Role Management Permissions topic.

 

Parameter Required Type Description

Name

Required

System.String

The Name parameter specifies the name of the new assignment policy. If the assignment policy name contains spaces, enclose the name in quotation marks ("). The maximum length of the name is 64 characters.

Confirm

Optional

System.Management.Automation.SwitchParameter

The Confirm switch causes the command to pause processing and requires you to acknowledge what the command will do before processing continues. You don't have to specify a value with the Confirm switch.

Description

Optional

System.String

The Description parameter specifies the description that's displayed when the role assignment policy is viewed using the Get-RoleAssignmentPolicy cmdlet. Enclose the description in quotation marks (").

DomainController

Optional

Microsoft.Exchange.Data.Fqdn

The DomainController parameter specifies the fully qualified domain name (FQDN) of the domain controller that writes this configuration change to Active Directory.

IgnoreDehydratedFlag

Optional

System.Management.Automation.SwitchParameter

This parameter is reserved for internal Microsoft use.

IsDefault

Optional

System.Management.Automation.SwitchParameter

The IsDefault switch specifies whether the new assignment policy should become the default assignment policy. New mailboxes or mailboxes moved to an Exchange 2013 server are assigned the default assignment policy when an explicit assignment policy isn't provided. You don't have to specify a value with this switch.

NoteNote:
Setting an assignment policy as default doesn't change the role assignment on existing mailboxes. To change the assignment policies on existing mailboxes, use the Set-Mailbox cmdlet.

Organization

Optional

Microsoft.Exchange.Configuration.Tasks.OrganizationIdParameter

The Organization parameter is reserved for internal Microsoft use.

Roles

Optional

Microsoft.Exchange.Configuration.Tasks.RoleIdParameter[]

The Roles parameter specifies the management roles to assign to the role assignment policy when it's created. If a role name contains spaces, enclose the name in quotation marks ("). If you want to assign more that one role, separate the role names with commas.

For a list of built-in management roles that you can assign to a role group, see Built-in Management Roles.

WhatIf

Optional

System.Management.Automation.SwitchParameter

The WhatIf switch instructs the command to simulate the actions that it would take on the object. By using the WhatIf switch, you can view what changes would occur without having to apply any of those changes. You don't have to specify a value with the WhatIf switch.

To see the input types that this cmdlet accepts, see Cmdlet Input and Output Types. If the Input Type field for a cmdlet is blank, the cmdlet doesn’t accept input data.

To see the return types, which are also known as output types, that this cmdlet accepts, see Cmdlet Input and Output Types. If the Output Type field is blank, the cmdlet doesn’t return data.

 
Did you find this helpful?
(1500 characters remaining)
Thank you for your feedback
Show:
© 2014 Microsoft. All rights reserved.