For this role to grant permissions, it must be assigned to a role assignee, which can be a role group, user, or universal security group (USG). This assignment is done using management role assignments. Role assignments link role assignees and roles together. If more than one role is assigned to a role assignee, the role assignee is granted the combination of all the permissions granted by all the assigned roles.

In addition to linking role assignees to roles, role assignments can also apply custom or built-in management scopes. Management scopes control which recipient, server and database objects can be modified by role assignees. If this role is assigned to a role assignee, but a management scope allows the role assignee only to manage certain objects based on a defined scope, the role assignee can only use the permissions granted by this role on those specific objects. The permissions provided by this role can't be applied to objects outside the scope defined on the role assignment. For more information about role assignments and scopes, see the following topics:

• Understanding Management Role Assignments
  
  
• Understanding Management Role Scopes
  
  

This role is assigned to one or more role groups by default. For more information, see the "Default Management Role Assignments" section later in this topic.

If you want to view a list of role groups, users, or USGs assigned to this role, use the following command.

	Copy Code
Get-ManagementRoleAssignment -Role "<role name>"

Regular and delegating role assignments

Adding or removing role assignments

You can change which role assignees are assigned this role. By changing which role assignee is assigned this role, you change who is granted its permissions. You can assign this role to other built-in role groups, or you can create role groups and assign this role to them. You can also assign this role to users or USGs. However, we recommend that you limit assignment of roles to users and USGs because such assignments can greatly increase the complexity of your permissions model.

To assign this role to role assignees, the role must be assigned to a role group you're a member of, directly to you, or to a USG you're a member of, using a delegating role assignment. For more information about delegating role assignments, see the "Regular and Delegating Role Assignments" section.

You can also remove this role from built-in role groups, role groups you create, users, and USGs. However, there must always be at least one delegating role assignment between this role and a role group or USG. You can't delete the last delegating role assignment. This limitation helps prevent you from locking yourself out of the system.

Important:
There must be at least one delegating role assignment between this role and a role group or USG. You can't remove the last delegating role assignment associated with this role if the last assignment is to a user.

For more information about how to add or remove assignments between this role and role groups, users, and USGs, see the following topics:

• Manage Role Groups
  
  
• Add a Role to a User or USG
  
  
• Remove a Role from a User or USG
  
  

Changing the management scopes on role assignments

Enabling or disabling role assignments

This role has role assignments to one or more role assignees. The following table indicates whether the role assignment is regular or delegating, and also indicates the management scopes applied to each assignment. The following list describes each column:

• Regular assignment   Regular role assignments enable the role assignee to access the permissions provided by the management role entries on this role.
  
  
• Delegating assignment   Delegating role assignments give the role assignee the ability to assign this role to role groups, users, or USGs.
  
  
• Recipient read scope   The recipient read scope determines what recipient objects the role assignee is allowed to read from Active Directory.
  
  
• Recipient write scope   The recipient write scope determines what recipient objects the role assignee is allowed to modify in Active Directory.
  
  
• Configuration read scope   The configuration read scope determines what configuration and server objects the role assignee is allowed to read from Active Directory.
  
  
• Configuration write scope   The configuration write scope determines what organizational and server objects the role assignee is allowed to modify in Active Directory.
  
  

Default management role assignments for this role

This role has been configured to provide a role assignee with all necessary cmdlets and parameters to manage the features and components listed in the beginning of this topic. Other roles have also been provided to enable management of other features. By adding and removing roles to and from role groups, you can create a customized permissions model without the need to customize individual management roles. For a complete list of roles, see Built-in Management Roles. For more information about customizing role groups, see Manage Role Groups.

If you decide that you need to create a customized version of this role, you must create a role as a child of this role, and customize the new role.

Caution:
The following information enables you to perform advanced management of permissions. Customizing management roles can significantly increase the complexity of your permissions model. You could cause certain features to stop functioning if you replace a built-in management role with an incorrectly configured custom role.

The following are the most common steps to create a customized role and assign it to a role assignee:

1. Create a copy of this role. For more information, see Create a Role.
   
   
2. Change or remove the role entries on the new role using the Set-ManagementRoleEntry and Remove-ManagementRoleEntry cmdlets. You can't add additional role entries to the new role because it can only contain the role entries on the parent built-in role. For more information, see the following topics:
   
   
   • Change a Role Entry
     
     
   • Remove a Role Entry from a Role
     
     
3. If you want to replace the built-in role with this new customized role, remove any role assignments associated with the built-in role. For more information, see the following topics:
   
   
   • “Add or remove a role to or from a role group” section in Manage Role Groups
     
     
   • Remove a Role from a User or USG
     
     
4. Add the new customized role to the required role assignees. For more information, see the following topics:
   
   
   • “Add or remove a role to or from a role group” section in Manage Role Groups
     
     
   • Add a Role to a User or USG
     
     

     Important:
     If you want other users, in addition to the user that created the role, to be able to assign the new customized role, be sure to add a delegating role assignment to at least one role assignee. For more information, see Delegate Role Assignments.