By default, the user that was used to create the Office 365 service is made a member of the Organization Management role group in the Exchange Online organization. This user can manage the entire Office 365 organization, including configuration of organization-level settings and management of Exchange Online recipients.

You can add additional administrators in the Office 365 organization, depending on the management that needs to take place. You can add additional organization administrators and recipient administrators enable specialist users to perform compliance tasks such as discovery, configure custom permissions, and more. All permissions management for Office 365 administrators must be performed in the Exchange Online organization using either the Exchange Control Panel (ECP) or remote PowerShell.

However, it's important to note that there is no transfer of permissions between the on-premises organization and the Office 365 organization. Any permissions that you've defined in the on-premises organization must be re-created in the Office 365 organization.

See the following topics for more information:

• Create a Role Group
  
  
• Add a Role to a Role Group
  
  
• Remove a Role from a Role Group
  
  
• Copy a Role Group
  
  
• Add Members to a Role Group
  
  
• Remove Members from a Role Group
  
  

As with administrator permissions, end users in Exchange Online can be granted permissions. By default, end users are granted permissions via the default role assignment policy. This policy is applied to every mailbox in the Exchange Online organization. If the permissions granted by default are sufficient, you don't need to change anything.

If you do want to customize end user permissions, you can either modify the existing default role assignment policy, or you can create new assignment policies. If you create multiple assignment policies, you can assign different policies to different groups of mailboxes, enabling you to control permissions granted to each group depending on their requirements. All permissions management for cloud-based end users must be performed in the Exchange Online organization using either the ECP or remote PowerShell.

Like administrator permissions, end user permissions aren't transferred between the on-premises organization and the Exchange Online organization. Any permissions that you've defined in the on-premises organization must be re-created in the Exchange Online organization.

The following table lists the permissions granted by the default role assignment policies in the Exchange Online organization.

Default role assignment policy permissions

See the following topics for more information:

• Add an Assignment Policy
  
  
• Remove an Assignment Policy
  
  
• Add a Role to an Assignment Policy
  
  
• Remove a Role from an Assignment Policy
  
  
• Change the Assignment Policy on a Mailbox
  
  
• Change the Default Assignment Policy