ChangeIntelIT change radar
Public mode

No access to your tenant or devices. Every item links to its source. What this means

Some sources, documents or advisories need attention: 271/271 feeds/APIs · 464/464 docs · 8/9 advisories · checked 21:06 UTC Customize Public modeDiscuss ChangeIntel on Discord

Roles and permissions

Explore Microsoft's documented roles and permissions, and follow changes to each public reference.

Exchange Online RBAC

Exchange Online permissions and role groups

Microsoft reference
Source and coverage

Documented default role groups. Cmdlet entries, parameters, custom roles, management scopes and memberships are not established by this overview.

1 of 1 reference page has a baseline · 0 failed their last read. A failed or unparsed page cannot establish that a role or permission disappeared.

These public references do not establish tenant assignments or effective access. Reference labels and anchors do not establish stable vendor template IDs or confirmed renames.

Observed changes and exact document comparisons

Saved searches 0

Keep up to eight named searches. Saved in this browser. Filters are also shareable in the page address.

28 matching entries · captured 23 Oct 2026, 08:30 UTC

Article history
Role or permissionReference typeDocumented terms
Communication Compliancelabel:Communication ComplianceDefault role group (reference label)
1 documented terms

Default roles assigned (reference text)

  • Communication Compliance Admin Communication Compliance Investigation
Communication Compliance Administratorslabel:Communication Compliance AdministratorsDefault role group (reference label)
1 documented terms

Default roles assigned (reference text)

  • Communication Compliance Admin
Compliance Administratorlabel:Compliance AdministratorDefault role group (reference label)
1 documented terms

Default roles assigned (reference text)

  • Communication Compliance Admin Insider Risk Management Admin
Compliance Managementlabel:Compliance ManagementDefault role group (reference label)
1 documented terms

Default roles assigned (reference text)

  • Audit Logs Compliance Admin Data Loss Prevention Information Rights Management Journaling Message Tracking Retention Management Transport Rules View-Only Audit Logs View-Only Configuration View-Only Recipients
Discovery Managementlabel:Discovery ManagementDefault role group (reference label)
1 documented terms

Default roles assigned (reference text)

  • Legal Hold Mailbox Search
ExchangeServiceAdmins_-<unique value>¹label:ExchangeServiceAdmins_-<unique value>¹Default role group (reference label)
1 documented terms

Default roles assigned (reference text)

  • n/a
Help Desklabel:Help DeskDefault role group (reference label)
1 documented terms

Default roles assigned (reference text)

  • Reset Password User Options View-Only Recipients
Hygiene Managementlabel:Hygiene ManagementDefault role group (reference label)
1 documented terms

Default roles assigned (reference text)

  • Transport Hygiene View-Only Configuration View-Only Recipients
Information Protectionlabel:Information ProtectionDefault role group (reference label)
1 documented terms

Default roles assigned (reference text)

  • Information Protection Admin Information Protection Analyst² Information Protection Investigator Information Protection Reader
Information Protection Adminslabel:Information Protection AdminsDefault role group (reference label)
1 documented terms

Default roles assigned (reference text)

  • Information Protection Admin
Information Protection Analystslabel:Information Protection AnalystsDefault role group (reference label)
1 documented terms

Default roles assigned (reference text)

  • Information Protection Analyst²
Information Protection Investigatorslabel:Information Protection InvestigatorsDefault role group (reference label)
1 documented terms

Default roles assigned (reference text)

  • Information Protection Investigator
Information Protection Readerslabel:Information Protection ReadersDefault role group (reference label)
1 documented terms

Default roles assigned (reference text)

  • Information Protection Reader
Insider Risk Managementlabel:Insider Risk ManagementDefault role group (reference label)
1 documented terms

Default roles assigned (reference text)

  • Insider Risk Management Admin Insider Risk Management Investigation
Insider Risk Management Adminslabel:Insider Risk Management AdminsDefault role group (reference label)
1 documented terms

Default roles assigned (reference text)

  • Insider Risk Management Admin
Insider Risk Management Investigatorslabel:Insider Risk Management InvestigatorsDefault role group (reference label)
1 documented terms

Default roles assigned (reference text)

  • Insider Risk Management Investigation
Organization Managementlabel:Organization ManagementDefault role group (reference label)
1 documented terms

Default roles assigned (reference text)

  • Audit Logs Communication Compliance Admin Communication Compliance Investigation Compliance Admin Data Loss Prevention Distribution Groups E-Mail Address Policies Federated Sharing Information Protection Admin Information Protection Analyst² Information Protection Investigator Information Protection Reader Information Rights Management Insider Risk Management Admin Insider Risk Management Investigation Journaling Legal Hold Mail Enabled Public Folders Mail Recipient Creation Mail Recipients Mail Tips Message Tracking Migration Move Mailboxes Org Custom Apps Org Marketplace Apps Organization Client Access Organization Configuration Organization Transport Settings Privacy Management Admin Privacy Management Investigation Public Folders Recipient Policies Remote and Accepted Domains Reset Password Retention Management Role Management Security Admin Security Group Creation and Membership Security Reader TenantPlacesManagement Transport Hygiene Transport Rules User Options View-Only Audit Logs View-Only Configuration View-Only Recipients
Privacy Managementlabel:Privacy ManagementDefault role group (reference label)
1 documented terms

Default roles assigned (reference text)

  • Privacy Management Admin Privacy Management Investigation
Privacy Management Administratorslabel:Privacy Management AdministratorsDefault role group (reference label)
1 documented terms

Default roles assigned (reference text)

  • Privacy Management Admin
Privacy Management Investigatorslabel:Privacy Management InvestigatorsDefault role group (reference label)
1 documented terms

Default roles assigned (reference text)

  • Privacy Management Investigation
Recipient Managementlabel:Recipient ManagementDefault role group (reference label)
1 documented terms

Default roles assigned (reference text)

  • Distribution Groups Mail Recipient Creation Mail Recipients Message Tracking Migration Move Mailboxes Recipient Policies Reset Password
Records Managementlabel:Records ManagementDefault role group (reference label)
1 documented terms

Default roles assigned (reference text)

  • Audit Logs Journaling Message Tracking Retention Management Transport Rules
RIM-MailboxAdmins<GUID>label:RIM-MailboxAdmins<GUID>Default role group (reference label)
1 documented terms

Default roles assigned (reference text)

  • ApplicationImpersonation
Security Administratorlabel:Security AdministratorDefault role group (reference label)
1 documented terms

Default roles assigned (reference text)

  • Security Admin SensitivityLabelAdministrator
Security Operatorlabel:Security OperatorDefault role group (reference label)
1 documented terms

Default roles assigned (reference text)

  • Tenant AllowBlockList Manager

Source: Microsoft, © Microsoft Corporation. Read the original for descriptions, exceptions and applicability.

ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 25 Oct 21:06 UTC · 271 of 271 readable · 269 fully read · documentation 464/464 current

No accounts or analytics; your preferences stay in your browser. Information, not advice. ChangeIntel is an independent tool and is not affiliated with or endorsed by Microsoft, Apple, Google, Broadcom (VMware), Jamf, Oracle, Mozilla, or any other vendor it covers. Product names are trademarks of their owners. Built by Evotec.