managementRoleAssignments

Role Assignments. Bindings that grant a management role to a user, group, or policy. The managementRoleAssignments entity set lives under /exchange/v1.0/managementRoleAssignments in the Roles & access category.

Fact	Value
Path	`/exchange/v1.0/managementRoleAssignments`
Category	Roles & access
Tier	Tier 2, Exchange RBAC
Read role	`Rbac.Read.All` (Community)
Write role	`Rbac.ReadWrite.All` (Enterprise)
Backing cmdlets	Get-ManagementRoleAssignment, New-ManagementRoleAssignment, Set-ManagementRoleAssignment, Remove-ManagementRoleAssignment

Routes

Method	Path	Synopsis	Role	Plan
GET	`/exchange/v1.0/managementRoleAssignments`	List managementRoleAssignments entries.	`Rbac.Read`	Community
POST	`/exchange/v1.0/managementRoleAssignments`	POST /managementRoleAssignments. Name is optional - EXO auto-generates one from Role + assignee when omitted.	`Rbac.ReadWrite`	Enterprise
GET	`/exchange/v1.0/managementRoleAssignments/{key}`	Get a single managementRoleAssignments entry by Identity.	`Rbac.Read`	Community
PATCH	`/exchange/v1.0/managementRoleAssignments/{key}`	Partial update of the managementRoleAssignments at /managementRoleAssignments/{key}. Only body fields present are passed to the cmdlet. Returns 200 + the post-Set entity (rename-aware re-fetch when `name` is in the body).	`Rbac.ReadWrite`	Enterprise
DELETE	`/exchange/v1.0/managementRoleAssignments/{key}`	DELETE /managementRoleAssignments/{key}. ?force=true skips the confirmation guard.	`Rbac.ReadWrite`	Enterprise

GET /exchange/v1.0/managementRoleAssignments

List managementRoleAssignments entries.

Backing cmdlet: Get-ManagementRoleAssignment. Role: Rbac.Read (Community).

Parameter	In	Type	Description
`role`	query	string	Return only role assignments associated with the specified management role. Maps -Role on Get-ManagementRoleAssignment.
`roleAssignee`	query	string	Return role assignments for the specified role group, assignment policy, user, or USG. Maps -RoleAssignee on Get-ManagementRoleAssignment.
`assignmentMethod`	query	string	Comma-separated assignment types to include (Direct, SecurityGroup, RoleGroup, RoleAssignmentPolicy). Requires roleAssignee. Maps -AssignmentMethod on Get-ManagementRoleAssignment.
`exclusive`	query	bool (switch)	Return only exclusive role assignments. Maps -Exclusive on Get-ManagementRoleAssignment.
`configWriteScope`	query	string	Filter by management configuration scope type (None, OrganizationConfig, CustomConfigScope, ExclusiveConfigScope). Maps -ConfigWriteScope on Get-ManagementRoleAssignment.
`delegating`	query	bool (switch)	Return only delegating role assignments. Maps -Delegating on Get-ManagementRoleAssignment.
`enabled`	query	bool (switch)	Filter by enabled state. Maps -Enabled on Get-ManagementRoleAssignment.
`roleAssigneeType`	query	string	Filter by assignee type (User, SecurityGroup, RoleGroup, RoleAssignmentPolicy, etc.). Maps -RoleAssigneeType on Get-ManagementRoleAssignment.
`recipientWriteScope`	query	string	Filter by recipient write scope type. Maps -RecipientWriteScope on Get-ManagementRoleAssignment.
`getEffectiveUsers`	query	bool (switch)	Return effective users for the matching role assignments. Maps -GetEffectiveUsers on Get-ManagementRoleAssignment.
`customRecipientWriteScope`	query	string	Filter by the custom recipient management scope. Maps -CustomRecipientWriteScope on Get-ManagementRoleAssignment.
`exclusiveRecipientWriteScope`	query	string	Filter by the exclusive recipient management scope. Maps -ExclusiveRecipientWriteScope on Get-ManagementRoleAssignment.
`recipientGroupScope`	query	string	Filter by recipient group scope. Maps -RecipientGroupScope on Get-ManagementRoleAssignment.
`recipientAdministrativeUnitScope`	query	string	Filter by recipient administrative unit scope. Maps -RecipientAdministrativeUnitScope on Get-ManagementRoleAssignment.
`recipientOrganizationalUnitScope`	query	string	Filter by recipient organizational unit scope. Maps -RecipientOrganizationalUnitScope on Get-ManagementRoleAssignment.
`writableRecipient`	query	string	Return role assignments that apply to the specified writable recipient. Maps -WritableRecipient on Get-ManagementRoleAssignment.

List managementRoleAssignments

Stub auto-generated example for the managementRoleAssignments collection. Backing cmdlet: Get-ManagementRoleAssignment. Live-verify with ?$top=3&$select=Id,Name and replace the synthetic body before promoting to Tier 1.

GET /exchange/v1.0/managementRoleAssignments?$top=3 HTTP/1.1
Authorization: Bearer {token}

HTTP/1.1 200 OK

{
  "@odata.context": "http://localhost:5043/exchange/v1.0/$metadata#managementRoleAssignments",
  "value": []
}

Notes: Illustrative example derived from the cmdlet documentation, not a live capture: field names are real, values are placeholders.

POST /exchange/v1.0/managementRoleAssignments

POST /managementRoleAssignments. Name is optional - EXO auto-generates one from Role + assignee when omitted.

Backing cmdlet: New-ManagementRoleAssignment. Role: Rbac.ReadWrite (Enterprise).

Parameter	In	Type	Required
`role`	body		yes
`app`	body
`customConfigWriteScope`	body
`customRecipientWriteScope`	body
`customResourceScope`	body
`delegating`	body	boolean (switch)
`exclusiveConfigWriteScope`	body
`exclusiveRecipientWriteScope`	body
`name`	body
`policy`	body
`recipientAdministrativeUnitScope`	body
`recipientGroupScope`	body
`recipientOrganizationalUnitScope`	body
`recipientRelativeWriteScope`	body
`securityGroup`	body
`user`	body
`dryRun`	query	bool (switch)

Create rejected when required role is missing

New-ManagementRoleAssignment requires the role field. Omitting it fails body validation before the cmdlet is invoked, returning the canonical 400 envelope.

POST /exchange/v1.0/managementRoleAssignments HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "name": "exonaut-sample-managementRoleAssignments",
  "user": "admin@contoso.com"
}

HTTP/1.1 400 Bad Request
Content-Type: application/json

{
  "error": {
    "code": "BadRequest",
    "message": "The 'role' field is required.",
    "target": "role"
  },
  "correlationId": "0HN7K2M9P4QZ1"
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Create a management role assignment

Joins a management role to an assignee (user, role group, role-assignment policy, or service principal) via New-ManagementRoleAssignment. Role is required; the assignee parameter sets (App / Policy / SecurityGroup / User) are mutually exclusive - send exactly one.

POST /exchange/v1.0/managementRoleAssignments HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "name": "exonaut-sample-managementRoleAssignments",
  "role": "Mail Recipients",
  "user": "admin@contoso.com",
  "recipientRelativeWriteScope": "Organization"
}

HTTP/1.1 201 Created
Location: /exchange/v1.0/managementRoleAssignments/exonaut-sample-managementRoleAssignments

{
  "Id": "exonaut-sample-managementRoleAssignments",
  "Identity": "exonaut-sample-managementRoleAssignments",
  "name": "exonaut-sample-managementRoleAssignments",
  "role": "Mail Recipients",
  "user": "admin@contoso.com",
  "recipientRelativeWriteScope": "Organization",
  "enabled": true
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

GET /exchange/v1.0/managementRoleAssignments/{key}

Get a single managementRoleAssignments entry by Identity.

Backing cmdlet: Get-ManagementRoleAssignment. Role: Rbac.Read (Community).

Get a single managementRoleAssignments entry

Stub auto-generated example for GET /managementRoleAssignments/{key}. Backing cmdlet: Get-ManagementRoleAssignment with -Identity {key}. Returns the full entity body; 404 if the identity doesn’t resolve.

GET /exchange/v1.0/managementRoleAssignments/{key} HTTP/1.1
Authorization: Bearer {token}

HTTP/1.1 200 OK

{
  "@odata.context": "http://localhost:5043/exchange/v1.0/$metadata#managementRoleAssignments/$entity"
}

Notes: Illustrative example derived from the cmdlet documentation, not a live capture: field names are real, values are placeholders.

PATCH /exchange/v1.0/managementRoleAssignments/{key}

Partial update of the managementRoleAssignments at /managementRoleAssignments/{key}. Only body fields present are passed to the cmdlet. Returns 200 + the post-Set entity (rename-aware re-fetch when name is in the body).

Backing cmdlet: Set-ManagementRoleAssignment. Role: Rbac.ReadWrite (Enterprise).

Parameter	In	Type
`customConfigWriteScope`	body
`customRecipientWriteScope`	body
`customResourceScope`	body
`enabled`	body
`exclusiveConfigWriteScope`	body
`exclusiveRecipientWriteScope`	body
`recipientAdministrativeUnitScope`	body
`recipientGroupScope`	body
`recipientOrganizationalUnitScope`	body
`recipientRelativeWriteScope`	body
`dryRun`	query	bool (switch)

Update a management role assignment

Partial update of the role assignment at GET /managementRoleAssignments/{key} via Set-ManagementRoleAssignment. Only the body fields present are passed to the cmdlet; returns 200 with the post-Set entity.

PATCH /exchange/v1.0/managementRoleAssignments/{key} HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "enabled": false,
  "recipientRelativeWriteScope": "Organization"
}

HTTP/1.1 200 OK
Content-Type: application/json

{
  "Id": "exonaut-sample-managementRoleAssignments",
  "Identity": "exonaut-sample-managementRoleAssignments",
  "name": "exonaut-sample-managementRoleAssignments",
  "role": "Mail Recipients",
  "user": "admin@contoso.com",
  "recipientRelativeWriteScope": "Organization",
  "enabled": false
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

DELETE /exchange/v1.0/managementRoleAssignments/{key}

DELETE /managementRoleAssignments/{key}. ?force=true skips the confirmation guard.

Backing cmdlet: Remove-ManagementRoleAssignment. Role: Rbac.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
`force`	query	bool (switch)
`dryRun`	query	bool (switch)

Delete a management role assignment

Removes the role assignment at GET /managementRoleAssignments/{key} via Remove-ManagementRoleAssignment. Pass ?force=true to skip the confirmation guard. Returns 204 No Content.

DELETE /exchange/v1.0/managementRoleAssignments/{key} HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

HTTP/1.1 204 No Content

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

?dryRun=true previews of any write stay on Community.