Applies to: Exchange Server 2010 SP3, Exchange Server 2010 SP2
Topic Last Modified: 2012-11-19
Use the New-RoleAssignmentPolicy cmdlet to create a new management role assignment policy on a server running Microsoft Exchange Server 2010.
Syntax
New-RoleAssignmentPolicy -Name <String> [-Confirm
[<SwitchParameter>]] [-Description <String>]
[-DomainController <Fqdn>] [-IsDefault
<SwitchParameter>] [-Organization
<OrganizationIdParameter>] [-Roles <RoleIdParameter[]>]
[-WhatIf [<SwitchParameter>]]
|
Detailed Description
When you create a new assignment policy, you can assign it to users using the New-Mailbox, Set-Mailbox, or Enable-Mailbox cmdlets. If you make the new assignment policy the default assignment policy, it's assigned to all new mailboxes that don't have an explicit assignment policy assigned to them.
You can add management roles to the new assignment policy when you create it, or you can create the assignment policy and add roles later. You must assign at least one management role to the new assignment policy for it to apply permissions to a mailbox. Without any roles assigned to the new assignment policy, users assigned to it won't be able to manage their mailbox configuration. To assign a management role after the assignment policy has been created, use the New-ManagementRoleAssignment cmdlet. For more information, see Add a Role to an Assignment Policy.
For more information about assignment policies, see Understanding Management Role Assignment Policies.
You need to be assigned permissions before you can run this cmdlet. Although all parameters for this cmdlet are listed in this topic, you may not have access to some parameters if they're not included in the permissions assigned to you. To see what permissions you need, see the "Assignment policies" entry in the Role Management Permissions topic.
Parameters
| Parameter | Required | Type | Description | ||
|---|---|---|---|---|---|
|
Name |
Required |
System.String |
The Name parameter specifies the name of the new assignment policy. If the assignment policy name contains spaces, enclose the name in quotation marks ("). The maximum length of the name is 64 characters. |
||
|
Confirm |
Optional |
System.Management.Automation.SwitchParameter |
The Confirm switch causes the command to pause processing and requires you to acknowledge what the command will do before processing continues. You don't have to specify a value with the Confirm switch. |
||
|
Description |
Optional |
System.String |
The Description parameter specifies the description that's displayed when the role assignment policy is viewed using the Get-RoleAssignmentPolicy cmdlet. Enclose the description in quotation marks ("). |
||
|
DomainController |
Optional |
Microsoft.Exchange.Data.Fqdn |
The DomainController parameter specifies the fully qualified domain name (FQDN) of the domain controller that writes this configuration change to Active Directory. |
||
|
IsDefault |
Optional |
System.Management.Automation.SwitchParameter |
The IsDefault switch specifies whether the new assignment policy should become the default assignment policy. New mailboxes or mailboxes moved to an Exchange 2010 server are assigned the default assignment policy when an explicit assignment policy isn't provided. You don't have to specify a value with this switch.
|
||
|
Organization |
Optional |
Microsoft.Exchange.Configuration.Tasks.OrganizationIdParameter |
This parameter is available for multi-tenant deployments. It isn't available for on-premises deployments. For more information about multi-tenant deployments, see Multi-Tenant Support. The Organization parameter specifies the organization in which you'll perform this action. This parameter doesn't accept wildcard characters, and you must use the exact name of the organization. |
||
|
Roles |
Optional |
Microsoft.Exchange.Configuration.Tasks.RoleIdParameter[] |
The Roles parameter specifies the management roles to assign to the role assignment policy when it's created. If a role name contains spaces, enclose the name in quotation marks ("). If you want to assign more that one role, separate the role names with commas. For a list of built-in management roles that you can assign to a role group, see Built-in Management Roles. |
||
|
WhatIf |
Optional |
System.Management.Automation.SwitchParameter |
The WhatIf switch instructs the command to simulate the actions that it would take on the object. By using the WhatIf switch, you can view what changes would occur without having to apply any of those changes. You don't have to specify a value with the WhatIf switch. |
Note:Input Types
To see the input types that this cmdlet accepts, see Cmdlet Input and Output Types. If the Input Type field for a cmdlet is blank, the cmdlet doesn’t accept input data.
Return Types
To see the return types, which are also known as output types, that this cmdlet accepts, see Cmdlet Input and Output Types. If the Output Type field is blank, the cmdlet doesn’t return data.
Examples
EXAMPLE 1
This example creates an assignment policy.
 Copy Code |
|
|---|---|
New-RoleAssignmentPolicy -Name "End User Policy" |
|
After the assignment policy is created, you can assign the assignment policy to a mailbox using the Set-Mailbox cmdlet.
| Copy Code |
|
|---|---|
Set-Mailbox Joe -RoleAssignmentPolicy "End User Policy" |
|
EXAMPLE 2
This example creates an assignment policy using the IsDefault switch.
| Copy Code |
|
|---|---|
New-RoleAssignmentPolicy -Name "Default End User Policy" -IsDefault |
|
EXAMPLE 3
This example creates an assignment policy that enables users to modify their personal information, manage their distribution group membership, and manage their voice mail. The new assignment policy is created as the new default assignment policy. Then, all existing mailboxes are configured to use the new assignment policy.
First, the new assignment policy is created and set as the new default assignment policy.
| Copy Code |
|
|---|---|
New-RoleAssignmentPolicy -Name "Limited End User Policy" -Roles "MyPersonalInformation", "MyDistributionGroupMembership", "MyVoiceMail" -IsDefault |
|
Because setting the new role assignment as default applies only to new mailboxes or mailboxes moved to an Exchange 2010 server, the Set-Mailbox cmdlet is used to configure the new assignment policy on all existing mailboxes.
| Copy Code |
|
|---|---|
Get-Mailbox -ResultSize Unlimited | Set-Mailbox -RoleAssignmentPolicy "Limited End User Policy" |
|