managementScopes

Management Scopes. Filters limiting which objects a role assignment can act on. The managementScopes entity set lives under /exchange/v1.0/managementScopes in the Roles & access category.

Fact	Value
Path	`/exchange/v1.0/managementScopes`
Category	Roles & access
Tier	Tier 2, Exchange RBAC
Read role	`Rbac.Read.All` (Community)
Write role	`Rbac.ReadWrite.All` (Enterprise)
Backing cmdlets	Get-ManagementScope, New-ManagementScope, Set-ManagementScope, Remove-ManagementScope

Routes

Method	Path	Synopsis	Role	Plan
GET	`/exchange/v1.0/managementScopes`	List managementScopes entries.	`Rbac.Read`	Community
POST	`/exchange/v1.0/managementScopes`	Create a new managementScopes entry. Body keys map 1:1 to the cmdlet’s parameter names (camelCased). Returns 201 + Location + the freshly-fetched entity. Use ?dryRun=true to map to -WhatIf without applying.	`Rbac.ReadWrite`	Enterprise
GET	`/exchange/v1.0/managementScopes/{key}`	Get a single managementScopes entry by Identity.	`Rbac.Read`	Community
PATCH	`/exchange/v1.0/managementScopes/{key}`	Partial update of the managementScopes at /managementScopes/{key}. Only body fields present are passed to the cmdlet. Returns 200 + the post-Set entity (rename-aware re-fetch when `name` is in the body).	`Rbac.ReadWrite`	Enterprise
DELETE	`/exchange/v1.0/managementScopes/{key}`	Remove the managementScopes at /managementScopes/{key}. Returns 204 with no body.	`Rbac.ReadWrite`	Enterprise

GET /exchange/v1.0/managementScopes

List managementScopes entries.

Backing cmdlet: Get-ManagementScope. Role: Rbac.Read (Community).

Parameter	In	Type	Required	Description
`orphan`	query	bool (switch)		Optional: when true, returns only scopes NOT associated with any role assignment (Get-ManagementScope -Orphan). Server-side computed filter - the recommended way to find orphaned scopes safe to delete; not reachable via OData $filter.
`exclusive`	query	bool (switch)

List managementScopes

Stub auto-generated example for the managementScopes collection. Backing cmdlet: Get-ManagementScope. Live-verify with ?$top=3&$select=Id,Name and replace the synthetic body before promoting to Tier 1.

GET /exchange/v1.0/managementScopes?$top=3 HTTP/1.1
Authorization: Bearer {token}

HTTP/1.1 200 OK

{
  "@odata.context": "http://localhost:5043/exchange/v1.0/$metadata#managementScopes",
  "value": []
}

Notes: Illustrative example derived from the cmdlet documentation, not a live capture: field names are real, values are placeholders.

POST /exchange/v1.0/managementScopes

Create a new managementScopes entry. Body keys map 1:1 to the cmdlet’s parameter names (camelCased). Returns 201 + Location + the freshly-fetched entity. Use ?dryRun=true to map to -WhatIf without applying.

Backing cmdlet: New-ManagementScope. Role: Rbac.ReadWrite (Enterprise).

Parameter	In	Type	Required
`name`	body		yes
`exclusive`	body	boolean (switch)
`recipientRestrictionFilter`	body
`recipientRoot`	body
`dryRun`	query	bool (switch)

Create rbac management scope - duplicate (409)

RBAC management scope create returns 409 when an object of that name already exists. Backed by New-ManagementScope.

POST /exchange/v1.0/managementScopes HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "name": "exonaut-audit-scope",
  "recipientRestrictionFilter": "Name -like 'exonaut-zzz*'"
}

HTTP/1.1 409 Conflict

{
  "error": {
    "code": "Conflict",
    "message": "Cmdlet 'New-ManagementScope' failed: ||Active Directory operation failed on VI1PR01A17DC001.EURPR01A017.PROD.OUTLOOK.COM. The object 'CN=exonaut-audit-scope,CN=Scopes,CN=RBAC,CN=Configuration,CN=contoso.onmicrosoft.com,CN=ConfigurationUnits,DC=EURPR01A017,DC=PROD,DC=OUTLOOK,DC=COM' already exists.",
    "target": null,
    "innerError": {
      "cmdlet": "New-ManagementScope"
    }
  },
  "correlationId": "0HNLTJ0Q1D32R:00000001"
}

Create a rbac management scope

RBAC management scope create. Returns 201 + Location + the freshly-fetched object. Backed by New-ManagementScope.

POST /exchange/v1.0/managementScopes HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "name": "exonaut-audit-scope",
  "recipientRestrictionFilter": "Name -like 'exonaut-zzz*'"
}

HTTP/1.1 201 Created
Location: /exchange/v1.0/managementScopes/exonaut-audit-scope

{
  "@odata.context": "http://localhost:5043/exchange/v1.0/$metadata#managementScopes/$entity",
  "Id": "exonaut-audit-scope",
  "Name": "exonaut-audit-scope",
  "Identity": "exonaut-audit-scope",
  "DistinguishedName": "CN=exonaut-audit-scope,CN=Scopes,CN=RBAC,CN=Configuration,CN=contoso.onmicrosoft.com,CN=ConfigurationUnits,DC=EURPR01A017,DC=PROD,DC=OUTLOOK,DC=COM",
  "Guid": "242577be-9c47-4c54-9076-23d22e16c082",
  "ExchangeObjectId": "242577be-9c47-4c54-9076-23d22e16c082",
  "AdminDisplayName": "",
  "RecipientRoot": null,
  "RecipientFilter": "Name -like 'exonaut-zzz*'",
  "Filter": "Name -like 'exonaut-zzz*'",
  "ServerFilter": "",
  "DatabaseFilter": "",
  "TenantOrganizationFilter": "",
  "QueryFilter": null,
  "Exclusive": false,
  "ScopeRestrictionType": "RecipientScope",
  "OrganizationalUnitRoot": "contoso.onmicrosoft.com",
  "OrganizationId": "EURPR01A017.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/contoso.onmicrosoft.com - EURPR01A017.PROD.OUTLOOK.COM/ConfigurationUnits/contoso.onmicrosoft.com/Configuration",
  "ExchangeVersion": "1.10 (14.1.90.0)",
  "ObjectCategory": "EURPR01A017.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Scope",
  "ObjectClass": [
    "top",
    "msExchScope"
  ],
  "OriginatingServer": "VI1PR01A17DC001.EURPR01A017.PROD.OUTLOOK.COM",
  "ObjectState": "Unchanged",
  "IsValid": true,
  "WhenCreated": "2026-05-29T18:45:23+03:00",
  "WhenChanged": "2026-05-29T18:45:23+03:00",
  "WhenCreatedUTC": "2026-05-29T15:45:23Z",
  "WhenChangedUTC": "2026-05-29T15:45:23Z"
}

GET /exchange/v1.0/managementScopes/{key}

Get a single managementScopes entry by Identity.

Backing cmdlet: Get-ManagementScope. Role: Rbac.Read (Community).

Get a single managementScopes entry

Stub auto-generated example for GET /managementScopes/{key}. Backing cmdlet: Get-ManagementScope with -Identity {key}. Returns the full entity body; 404 if the identity doesn’t resolve.

GET /exchange/v1.0/managementScopes/{key} HTTP/1.1
Authorization: Bearer {token}

HTTP/1.1 200 OK

{
  "@odata.context": "http://localhost:5043/exchange/v1.0/$metadata#managementScopes/$entity"
}

Notes: Illustrative example derived from the cmdlet documentation, not a live capture: field names are real, values are placeholders.

PATCH /exchange/v1.0/managementScopes/{key}

Partial update of the managementScopes at /managementScopes/{key}. Only body fields present are passed to the cmdlet. Returns 200 + the post-Set entity (rename-aware re-fetch when name is in the body).

Backing cmdlet: Set-ManagementScope. Role: Rbac.ReadWrite (Enterprise).

Parameter	In	Type
`name`	body
`recipientRestrictionFilter`	body
`recipientRoot`	body
`dryRun`	query	bool (switch)

Update a management scope

Partially updates the recipient-filter management scope identified by {key} via Set-ManagementScope. Only the body fields supplied are passed to the cmdlet; a rename-aware re-fetch returns the post-update entity.

PATCH /exchange/v1.0/managementScopes/{key} HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "name": "exonaut-sample-managementScopes",
  "recipientRestrictionFilter": "Department -eq 'Finance'",
  "recipientRoot": "contoso.com/Users"
}

HTTP/1.1 200 OK
Content-Type: application/json

{
  "Id": "exonaut-sample-managementScopes",
  "Identity": "exonaut-sample-managementScopes",
  "Name": "exonaut-sample-managementScopes",
  "RecipientFilter": "Department -eq 'Finance'",
  "RecipientRoot": "contoso.com/Users",
  "ScopeRestrictionType": "RecipientScope",
  "Exclusive": false
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

DELETE /exchange/v1.0/managementScopes/{key}

Remove the managementScopes at /managementScopes/{key}. Returns 204 with no body.

Backing cmdlet: Remove-ManagementScope. Role: Rbac.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
`force`	query	bool (switch)
`dryRun`	query	bool (switch)

Delete a rbac management scope

Removes the rbac management scope by Identity. Returns 204. Backed by Remove-ManagementScope.

DELETE /exchange/v1.0/managementScopes/{key} HTTP/1.1
Authorization: Bearer {token}

HTTP/1.1 204 No Content

?dryRun=true previews of any write stay on Community.