When you create a role with limited scope (a scoped role), you specify the scope, along with the existing role it is based on and the Active Directory group to be assigned the role. The Active Directory group you specify must already be created. The following cmdlet is an example of a creating a role which has the privileges of one of the pre-defined administrative roles, but with limited scope. It creates a new role called Site01 Server Administrators. The role has the abilities of the predefined CsServerAdministrator role, but only for the servers located in the Site01 site. For this cmdlet to work, the Site01 site must already be defined, and a universal security group named Site01 Server Administrators must already exist.

	Copy Code
New-CsAdminRole -Identity "Site01 Server Administrators" -Template CsServerAdministrator -ConfigScopes "site:Site01"

After this cmdlet runs, all users who are members of the Site01 Server Administrators group will have server administrator privileges for the servers in Site01. Additionally, any users who are later added to this universal security group also gain the privileges of this role. Note that both the role itself, and the universal security group it is assigned to are called Site01 Server Administrators.

The following example limits user scope instead of server scope. It creates a Sales Users Administrator role to administer the user accounts in the Sales organizational unit. The SalesUsersAdministrator universal security group must already be created for this cmdlet to work.

	Copy Code
New-CsAdminRole -Identity "Sales Users Administrator " -Template CsUserAdministrator -UserScopes "OU:OU=Sales, OU=Lync Tenants, DC=Domain, DC=com"

To create a role that has access to a set of cmdlets not in one of the predefined roles, or to a set of scripts or modules, you again start by using one of the predefined roles as a template. Note that scripts and modules that roles are to be able to run must be stored in the following locations:

• The Lync module path, which is by default C:\Program Files\Common Files\Microsoft Lync Server 2013\Modules\Lync

• The user script path, which is by default C:\Program Files\Common Files\Microsoft Lync Server 2013\AdminScripts

To make a new role, you use the New-CsAdminRole cmdlet. Before running New-CsAdminRole, you must first create the underlying universal security group that will be associated with this role.

The following cmdlets serve as an example of a creating a new role. They create a new role type called MyHelpDeskScriptRole. The new role has the abilities of the predefined CsHelpDesk role, and can additionally run the functions in a script named “testscript”.

	Copy Code
New-CsAdminRole -Identity "MyHelpDeskScriptRole" -Template CsHelpDesk -ScriptModules @{Add="testScript.ps1"}

For this cmdlet to work, you must have first created the universal security group MyHelpDeskScriptRole.

After this cmdlet runs, you can assign users directly to this role (in which case they have global scope), or create a scoped role based on this role, as explained in Creating a Scoped Role, previously in this document.

Each Lync Server role is associated with an underlying Active Directory universal security group. Any users who you add to the underlying group gain the abilities of that role.

The examples in the preceding sections both created a new role and assigned an existing universal security group to the new role. To assign an existing role to one or more users, add those users to the group associated with the role. You can add both individual users and universal security groups to these groups.

For example, the CsAdministrator role is automatically granted to the CS Administrators universal security group in Active Directory. This universal security group is created in Active Directory when you deploy Lync Server. To grant a user or group this privilege, you can simply add them to the CS Administrators group.

A user can be given multiple RBAC roles by being added to the underlying Active Directory groups that correspond to each role.

Note that when you create a role, users who are later added to the underlying Active Directory group gain the abilities of that role.

You can modify the list of cmdlets and scripts that a role can run. You can modify both the cmdlets and scripts that custom roles can run, but you can modify only the scripts for predefined roles. Each cmdlet you type can add, remove, or replace cmdlets or scripts.

To modify a role, use the Set-CsAdminRole cmdlet. The following cmdlet removes one script from the role.

	Copy Code
Set-CsAdminRole -Identity "MyHelpDeskScriptRole" -ScriptModules @{Remove="testScript.ps1"}