Published Date: 5th November 2026
Last Updated: 4th November 2026
Category: Microsoft 365 / Exchange Online
Tested With: Exchange Online and Exchange Admin Center
Estimated completion time: Approximately 5 to 10 minutes
Add or Remove Roles from a Role Assignment Policy
A role assignment policy in Exchange Online contains one or more end-user roles that determine which mailbox and distribution-group settings users can manage themselves. Role assignment policies are part of the Role Based Access Control (RBAC) permissions model.
For example, roles can control whether users can modify personal contact information, manage distribution groups, or access specific mailbox options.
Important: Role assignment policies are intended for end-user permissions. They are different from administrator role groups. Administrator permissions are managed separately through Exchange Online RBAC.
Prerequisites
Before making changes, ensure that:
- You can sign in to the Microsoft 365 environment with an account that has appropriate Exchange permissions.
- You have access to the Exchange Admin Center.
- You know which role assignment policy needs to be modified.
- You know which end-user role should be added or removed.
- You understand how removing a role could affect users who are assigned that policy.
Microsoft states that Exchange permissions use the RBAC model. Appropriate permissions are required before administrative role-management operations can be performed.
Step 1: Access the Exchange Admin Center.
Open the Exchange Admin Center using an administrator account with the required permissions.
Step 2: Locate the Role Assignment Policy
Navigate to the area used to manage role assignment policies and locate the policy that you want to modify.
A Microsoft 365 organization normally has a Default Role Assignment Policy, and custom role assignment policies can also be used to provide different self-management capabilities to different users.
Step 3: Open the Role Assignment Policy
Select the role assignment policy that needs to be changed.
Review the policy before modifying its assigned roles.
Step 4: Review the Assigned Roles
Review the end-user roles currently associated with the policy.
Role assignment policies can include roles controlling various self-service functions in Exchange Online. For example, MyBaseOptions is required for users to access options in Outlook on the web from their own mailbox, while MyContactInformation relates to editing personal address and telephone information in the Global Address List.
Before removing an existing role, confirm that users assigned to the policy no longer require the functionality provided by that role.
Step 5: Add or Remove the Required Role
To add a role, select the required end-user role.
To remove a role, clear or remove the required role from the policy.
Caution: Removing a role affects the corresponding self-service capability for users who receive permissions from that role assignment policy. Review the impact before applying the change. Role assignment policies are specifically used to allow or prevent end-user self-management features.
Step 6: Save the Changes
Select the available Save or confirmation option to apply the modification.
Wait for the operation to complete before closing the page.
Step 7: Verify the Role Assignment
Reopen the role assignment policy and verify that:
- The newly added role is displayed, or
- The removed role is no longer assigned.
Where additional verification is required, Exchange Online PowerShell provides the Get-RoleAssignmentPolicy cmdlet for viewing the role assignment policies configured in the organization.
Important Considerations
Default Role Assignment Policy
Exchange Online includes a default role assignment policy called Default Role Assignment Policy. The default policy is specified by the mailbox plan assigned when users are licensed.
Changes to a policy should therefore be carefully reviewed before implementation, particularly when the policy applies broadly across the organization.
End-User Roles vs. Administrator Roles
Do not confuse a role assignment policy with an administrator role group.
- Role assignment policies provide end-user roles that control users’ self-management capabilities.
- In Exchange Online, administrator roles provide permissions and administrative tasks.
Common Problems
Role Assignment Policy Cannot Be Modified
Confirm that the administrator account has sufficient Exchange Online permissions.
Exchange Online role management is controlled through RBAC, and administrators require the appropriate permissions to manage Exchange roles and assignments.
User Still Has Access After a Role Is Removed
Check that:
- The correct role assignment policy was modified.
- The affected mailbox is assigned to the expected policy.
- The user does not receive the capability through a different applicable configuration.
Microsoft Learn documents both viewing policy assignments on mailboxes and modifying the policy assigned to a mailbox.
Required Role Is Not Available
Confirm that the role is an appropriate end-user role for a role assignment policy rather than an administrator role.
Role assignment policies are specifically designed for assigning end-user roles.
Exchange Admin Center Looks Different from the Screenshot
The Exchange Admin Center interface changes over time.
If the menu displayed in the KB differs from the current interface, refer to Microsoft’s current Exchange Online role assignment policy documentation before proceeding.
Frequently Asked Questions
What is a role assignment policy?
A role assignment policy is a collection of one or more end-user roles that allows users to manage specific mailbox settings and distribution-group features in Exchange Online.
What is the Default Role Assignment Policy?
Default Role Assignment Policy is the default policy identified by the mailbox plan assigned to users when their accounts are licensed.
Can different users have different role assignment policies?
Yes. Different role assignment policies can be applied to users to allow or prevent specific self-management capabilities.
Are role assignment policies the same as admin roles?
No. Role assignment policies apply end-user roles. The tasks that administrators can carry out in Exchange Online are defined by their administrative roles.
Can I check role assignment policies using PowerShell?
Yes. The Get-RoleAssignmentPolicy cmdlet lists existing role assignment policies, and specifying a policy identity can return details for a particular policy.
Summary
Role assignment policies provide a controlled method of determining which Exchange Online settings users can manage themselves.
The general process is:
Exchange Admin Center → Locate Role Assignment Policy → Select Policy → Review Roles → Add or Remove Required Role → Save → Verify
Always review the impact before removing an existing end-user role, particularly when modifying the Default Role Assignment Policy.
Oryon provides Microsoft 365 licensing, email hosting, migration, mailbox administration, security configuration, and ongoing technical support for businesses in Singapore.