roleAssignmentPolicies

User Mailbox Permissions. Default permission sets controlling what users can manage on their own mailbox. The roleAssignmentPolicies entity set lives under /exchange/v1.0/roleAssignmentPolicies in the Roles & access category.

Fact	Value
Path	`/exchange/v1.0/roleAssignmentPolicies`
Category	Roles & access
Tier	Tier 2, Exchange RBAC
Read role	`Rbac.Read.All` (Community)
Write role	`Rbac.ReadWrite.All` (Enterprise)
Backing cmdlets	Get-RoleAssignmentPolicy, New-RoleAssignmentPolicy, Set-RoleAssignmentPolicy, Remove-RoleAssignmentPolicy

Routes

Method	Path	Synopsis	Role	Plan
GET	`/exchange/v1.0/roleAssignmentPolicies`	List roleAssignmentPolicies entries.	`Rbac.Read`	Community
POST	`/exchange/v1.0/roleAssignmentPolicies`	Create a new roleAssignmentPolicies entry. Body keys map 1:1 to the cmdlet’s parameter names (camelCased). Returns 201 + Location + the freshly-fetched entity. Use ?dryRun=true to map to -WhatIf without applying.	`Rbac.ReadWrite`	Enterprise
GET	`/exchange/v1.0/roleAssignmentPolicies/{key}`	Get a single roleAssignmentPolicies entry by Identity.	`Rbac.Read`	Community
PATCH	`/exchange/v1.0/roleAssignmentPolicies/{key}`	Partial update of the roleAssignmentPolicies at /roleAssignmentPolicies/{key}. Only body fields present are passed to the cmdlet. Returns 200 + the post-Set entity (rename-aware re-fetch when `name` is in the body).	`Rbac.ReadWrite`	Enterprise
DELETE	`/exchange/v1.0/roleAssignmentPolicies/{key}`	Remove the roleAssignmentPolicies at /roleAssignmentPolicies/{key}. Returns 204 with no body.	`Rbac.ReadWrite`	Enterprise

GET /exchange/v1.0/roleAssignmentPolicies

List roleAssignmentPolicies entries.

Backing cmdlet: Get-RoleAssignmentPolicy. Role: Rbac.Read (Community).

List roleAssignmentPolicies

Stub auto-generated example for the roleAssignmentPolicies collection. Backing cmdlet: Get-RoleAssignmentPolicy. Live-verify with ?$top=3&$select=Id,Name and replace the synthetic body before promoting to Tier 1.

GET /exchange/v1.0/roleAssignmentPolicies?$top=3 HTTP/1.1
Authorization: Bearer {token}

HTTP/1.1 200 OK

{
  "@odata.context": "http://localhost:5043/exchange/v1.0/$metadata#roleAssignmentPolicies",
  "value": []
}

Notes: Illustrative example derived from the cmdlet documentation, not a live capture: field names are real, values are placeholders.

POST /exchange/v1.0/roleAssignmentPolicies

Create a new roleAssignmentPolicies entry. Body keys map 1:1 to the cmdlet’s parameter names (camelCased). Returns 201 + Location + the freshly-fetched entity. Use ?dryRun=true to map to -WhatIf without applying.

Backing cmdlet: New-RoleAssignmentPolicy. Role: Rbac.ReadWrite (Enterprise).

Parameter	In	Type	Required
`name`	body		yes
`description`	body
`isDefault`	body	boolean (switch)
`roles`	body
`dryRun`	query	bool (switch)

Create role assignment policy - duplicate (409)

Role assignment policy create returns 409 when an object of that name already exists. Backed by New-RoleAssignmentPolicy.

POST /exchange/v1.0/roleAssignmentPolicies HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "name": "exonaut-audit-rap"
}

HTTP/1.1 409 Conflict

{
  "error": {
    "code": "Conflict",
    "message": "Cmdlet 'New-RoleAssignmentPolicy' failed: ||Active Directory operation failed on VI1PR01A17DC001.EURPR01A017.PROD.OUTLOOK.COM. The object 'CN=exonaut-audit-rap,CN=Policies,CN=RBAC,CN=Configuration,CN=contoso.onmicrosoft.com,CN=ConfigurationUnits,DC=EURPR01A017,DC=PROD,DC=OUTLOOK,DC=COM' already exists.",
    "target": null,
    "innerError": {
      "cmdlet": "New-RoleAssignmentPolicy"
    }
  },
  "correlationId": "0HNLTJ0Q1D32E:00000001"
}

Create a role assignment policy

Role assignment policy create. Returns 201 + Location + the freshly-fetched object. Backed by New-RoleAssignmentPolicy.

POST /exchange/v1.0/roleAssignmentPolicies HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "name": "exonaut-audit-rap"
}

HTTP/1.1 201 Created
Location: /exchange/v1.0/roleAssignmentPolicies/exonaut-audit-rap

{
  "@odata.context": "http://localhost:5043/exchange/v1.0/$metadata#roleAssignmentPolicies/$entity",
  "Id": "exonaut-audit-rap",
  "Name": "exonaut-audit-rap",
  "Identity": "exonaut-audit-rap",
  "DistinguishedName": "CN=exonaut-audit-rap,CN=Policies,CN=RBAC,CN=Configuration,CN=contoso.onmicrosoft.com,CN=ConfigurationUnits,DC=EURPR01A017,DC=PROD,DC=OUTLOOK,DC=COM",
  "Guid": "bac333c0-da00-4cae-90f5-fe20b8b301dc",
  "ExchangeObjectId": "bac333c0-da00-4cae-90f5-fe20b8b301dc",
  "Description": "",
  "IsDefault": false,
  "AssignedRoles": [],
  "RoleAssignments": [],
  "OrganizationalUnitRoot": "contoso.onmicrosoft.com",
  "OrganizationId": "EURPR01A017.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/contoso.onmicrosoft.com - EURPR01A017.PROD.OUTLOOK.COM/ConfigurationUnits/contoso.onmicrosoft.com/Configuration",
  "ExchangeVersion": "0.11 (14.0.509.0)",
  "ObjectCategory": "EURPR01A017.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-RBAC-Policy",
  "ObjectClass": [
    "top",
    "msExchRBACPolicy"
  ],
  "OriginatingServer": "VI1PR01A17DC001.EURPR01A017.PROD.OUTLOOK.COM",
  "ObjectState": "Unchanged",
  "IsValid": true,
  "WhenCreated": "2026-05-29T18:45:17+03:00",
  "WhenChanged": "2026-05-29T18:45:17+03:00",
  "WhenCreatedUTC": "2026-05-29T15:45:17Z",
  "WhenChangedUTC": "2026-05-29T15:45:17Z",
  "AdminDisplayName": ""
}

GET /exchange/v1.0/roleAssignmentPolicies/{key}

Get a single roleAssignmentPolicies entry by Identity.

Backing cmdlet: Get-RoleAssignmentPolicy. Role: Rbac.Read (Community).

Get a single roleAssignmentPolicies entry

Stub auto-generated example for GET /roleAssignmentPolicies/{key}. Backing cmdlet: Get-RoleAssignmentPolicy with -Identity {key}. Returns the full entity body; 404 if the identity doesn’t resolve.

GET /exchange/v1.0/roleAssignmentPolicies/{key} HTTP/1.1
Authorization: Bearer {token}

HTTP/1.1 200 OK

{
  "@odata.context": "http://localhost:5043/exchange/v1.0/$metadata#roleAssignmentPolicies/$entity"
}

Notes: Illustrative example derived from the cmdlet documentation, not a live capture: field names are real, values are placeholders.

PATCH /exchange/v1.0/roleAssignmentPolicies/{key}

Partial update of the roleAssignmentPolicies at /roleAssignmentPolicies/{key}. Only body fields present are passed to the cmdlet. Returns 200 + the post-Set entity (rename-aware re-fetch when name is in the body).

Backing cmdlet: Set-RoleAssignmentPolicy. Role: Rbac.ReadWrite (Enterprise).

Parameter	In	Type
`description`	body
`isDefault`	body	boolean (switch)
`name`	body
`dryRun`	query	bool (switch)

Update a role assignment policy

Partial update of an end-user role assignment policy via Set-RoleAssignmentPolicy. Only the body fields present are passed to the cmdlet; the response is the post-Set entity (rename-aware re-fetch when name changes).

PATCH /exchange/v1.0/roleAssignmentPolicies/{key} HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "name": "exonaut-sample-roleAssignmentPolicies",
  "description": "Updated end-user role policy for the Exonaut sample tenant (contoso.com)."
}

HTTP/1.1 200 OK
Content-Type: application/json

{
  "Id": "exonaut-sample-roleAssignmentPolicies",
  "Identity": "exonaut-sample-roleAssignmentPolicies",
  "Name": "exonaut-sample-roleAssignmentPolicies",
  "Description": "Updated end-user role policy for the Exonaut sample tenant (contoso.com)."
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

DELETE /exchange/v1.0/roleAssignmentPolicies/{key}

Remove the roleAssignmentPolicies at /roleAssignmentPolicies/{key}. Returns 204 with no body.

Backing cmdlet: Remove-RoleAssignmentPolicy. Role: Rbac.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
`dryRun`	query	bool (switch)

Delete a role assignment policy

Removes the role assignment policy by Identity. Returns 204. Backed by Remove-RoleAssignmentPolicy.

DELETE /exchange/v1.0/roleAssignmentPolicies/{key} HTTP/1.1
Authorization: Bearer {token}

HTTP/1.1 204 No Content

?dryRun=true previews of any write stay on Community.