Topic Last Modified: 2010-07-18
To enable you to delegate administrative tasks while maintaining high security, Microsoft Communications Server 2010 introduces role-based access control (RBAC). With RBAC, administrative privilege is granted by assigning users to pre-defined administrative roles. Communications Server 2010 includes a rich set of built-in administrative roles, and you can assign user groups to these roles.
Better Server Security and
Centralization
In previous versions of Communications Server, administrative rights were defined very broadly, and users with administrative access for a server running Communications Server could make many types of changes. With RBAC, access and authorization is based more precisely on a user’s Communications Server role. This enables greater use of the security practice of "least privilege," granting administrators and users only the rights that are necessary for their job.
 Important: |
|---|
| RBAC restrictions work only on administrators working remotely, using either the Communications Server Control Panel or Communications Server Management Shell. A user sitting at a server running Communications Server is not restricted by RBAC. Therefore, physical security of your Communications Server is important to preserve RBAC restrictions. |
Roles and Scope
In RBAC, a role is a list of cmdlets defined by Communications Server, designed to be useful for a certain type of administrator or technician. A scope is the set of objects which the cmdlets defined in a role can operate on. The objects that scope affects can be either user accounts (grouped by organizational unit) or servers (grouped by site).
The following table lists the predefined roles in Communications Server 2010, and gives a general overview of the types of tasks each can do. The fourth column shows the similar Microsoft Exchange role for each Communications Server role, if there is one.
For a detailed list of exactly which cmdlets each role can run, see the table later in this section.
Pre-Defined Administrative Roles
| Role | Tasks allowed | Underlying Active Directory Group | Exchange equivalent |
|---|---|---|---|
|
CsAdministrator |
Can perform all administrative tasks and modify all settings, including creating roles and assigning users to roles. Can expand a deployment by adding new sites, pools and services. |
CS Administrators |
Organization Management |
|
CsUserAdministrator |
Can enable and disable users for Communications Server, move users and assign existing policies to users. Cannot modify policies. |
CS User Administrators |
Mail Recipients |
|
CsVoiceAdministrator |
Can create, configure and manage voice-related settings and policies. |
CS Voice Administrators |
Not applicable. |
|
CsServerAdministrator |
Can manage, monitor, and troubleshoot servers and services. Can drain servers and stop and start services, and apply software updates. Cannot make changes with global configuration impact. |
CS Server Administrators |
Server Management |
|
CsViewOnlyAdministrator |
Can view the deployment, including user and server information, in order to monitor deployment health. |
CS View-Only Administrators |
View-Only Organization Management |
|
CsHelpDesk |
Can view the deployment, including users properties and policies. Can execute specific troubleshooting tasks. Cannot change user properties or policies, server configuration, or services. |
CS HelpDesk |
HelpDesk |
|
CsArchivingAdministrator |
Can modify archiving configuration and policies. |
CS Archiving Administrators |
Retention Management, Legal Hold |
|
CsResponseGroupAdministrator |
Can manage the configuration of the Response Group service within a site. |
CS Response Group Administrators |
Not applicable |
|
CsLocationAdministrator |
Lowest level of rights for E911 management, including creating E911 locations and network identifiers, and associating these with each other. This role is always assigned with a global scope. |
CS Location Administrators |
Not applicable |
All predefined roles shipped in Communications Server have a global scope. To follow least privilege practices, you should not assign users to roles with global scope if they are going to administer only a limited set of servers or users. To accomplish this, you can create roles which are based on the predefined roles, but with a more limited scope.
Creating a Role
When you create a role, you specify the scope, along
with the existing role it is based on and the Active Directory
group to be assigned the role. The Active Directory group you
specify must already be created. The following cmdlet is an example
of a creating a role with limited scope. It creates a new role
called Dublin Server Administrators. The new role has
the abilities of the predefined CsServerAdministrator role, but
only for the servers located in the Dublin site. For this cmdlet to
work, the Dublin site must already be defined, and a security group
named Dublin Server Administrators must already
exist
New-CsAdminRole -Identity "Dublin Server
Administrators" -Template CsServerAdministrator -ConfigScopes
“site:Dublin"
Once this cmdlet runs, all users who are members of the
Dublin Server Administrators group will have server
administrator privileges for the servers in Dublin. Additionally,
any users who are later added to this security group also gain the
privileges of this role. Note that both the role itself, and the
security group it is assigned to are called Dublin Server
Administrators.
The following example limits user scope instead of
server scope; It creates a Sales Users Administrator
role to administer the user accounts in the Sales organizational
unit. The SalesUsersAdministrator security group must already be
created for this cmdlet to work.
New-CsAdminRole -Identity "Sales Users
Administrator " -Template CsUserAdministrator -UserScopes
“OU:OU=Sales, OU=OCS Tenants, DC=Domain, DC=com"
A user can be given multiple RBAC roles by being added to the underlying Active Directory groups that correspond to each role.
Note that when you create a role, users who are later added to the underlying Active Directory group gain the abilities of that role.
Assigning Roles to Users
Each Communications Server role is associated with an underlying Active Directory security group, which is created in Active Directory when you deploy Communications Server. Any users who you add to the underlying group gain the abilities of that role.
The examples in the preceding section both created a new role and assigned a group to it. To assign an existing role to one or more users, add those users to the group associated with the role. You can add both individual users and security groups to these role groups
For example, the CsAdministrator role is automatically granted to the CS Administrators security group in Active Directory; this security group is created in Active Directory when you install deploy Communications Server. To grant a user or group this privilege, you can simply add them to the CS Administrators group.
Planning for RBAC
For each person who is to be given any kind of administrative rights for your Communications Server deployment, consider exactly which tasks they need to perform, then assign them to roles with the least privilege and scope necessary for their job.
Users who have the CsAdministrator role can create all types of roles, including roles based on CsAdministrator, and assign users to them. The best practice is to assign the CsAdministrator role to a very small set of trusted users.
Cmdlets Permitted for
Pre-Defined Roles
The following sections list the cmdlets that each pre-defined role is permitted to run.
CsAdministrator
The CsAdministrator role is permitted to run all cmdlets.
CsUserAdministrator
The CsUserAdministrator role is permitted to run the following cmdlets:
- Disable-CSUser
- Enable-CSUser
- Get-CSAdUser
- Get-CSUser
- Get-CSUserPoolInfo
- Move-CSUser
- Move-CSLegacyUser
- Set-CSUser
- Grant-CSClientPolicy
- Grant-CSClientVersionPolicy
- Grant-CSConferencingPolicy
- Grant-CSDialPlan
- Grant-CSExternalAccessPolicy
- Grant-CSHostedVoicemailPolicy
- Grant-CSLocationPolicy
- Grant-CSPinPolicy
- Grant-CSVoicePolicy
- Get-CSArchivingPolicy
- Get-CSClientPolicy
- Get-CSClientVersionPolicy
- Get-CSConferencingPolicy
- Get-CSExternalAccessPolicy
- Get-CSHostedVoicemailPolicy
- Get-CSLocationPolicy
- Get-CSPinPolicy
- Get-CSVoicePolicy
- Get-CSClientPinInfo
- Unlock-CSClientPin
- Lock-CSClientPin
- Set-CSClientPin
- Get-CSClientVersionConfiguration
- Get-CSDialPlan
- Get-CsSite
- Get-CsComputer
- Get-CsNetworkInterface
- Get-CSPool
- Get-CSService
- Get-CSSipDomain
- Revoke-CSClientCertificate
- Get-CSManagementStoreReplicationStatus
- Get-CSAdContact
- Get-CSUserAcp
- Set-CSUserAcp
- Remove-CSUserAcp
- Get-CsArchivingConfiguration
- Get-CsPresencePolicy
- Grant-CsPresencePolicy
- Get-CsWindowsService
- Get-CSPstnUsage
- Get-CSRoutingConfiguration
- Set-CSCommonAreaPhone
- Remove-CSCommonAreaPhone
- Get-CSCommonAreaPhone
- New-CSCommonAreaPhone
- Set-CSAnalogDevice
- Remove-CSAnalogDevice
- Get-CSAnalogDevice
- New-CSAnalogDevice
- Set-CSExUmContact
- Remove-CSExUmContact
- Get-CSExUmContact
- New-CSExUmContact
CsVoiceAdministrator
The CsVoiceAdministrator role is permitted to run the following cmdlets:
- Get-CSApplicationEndpoint
- Get-CSUser
- Get-CSAnnouncement
- Get-CSCallParkOrbit
- Get-CSService
- Get-CSSite
- Get-CSPool
- Get-CSComputer
- Get-CSNetworkInterface
- Get-CSUnassignedNumber
- Import-CSAnnouncementFile
- New-CSAnnouncement
- New-CSCallParkOrbit
- New-CSUnassignedNumber
- Remove-CSAnnouncement
- Remove-CSCallParkOrbit
- Remove-CSUnassignedNumber
- Set-CSAnnouncement
- Set-CSCallParkOrbit
- Set-CSCallParkServiceMusicOnHoldFile
- Set-CSUnassignedNumber
- Get-CSNetworkBandwidthPolicyProfile
- Get-CSNetworkInterRegionRoute
- Get-CSNetworkInterSitePolicy
- Get-CSNetworkRegion
- Get-CSNetworkRegionLink
- Get-CSNetworkSite
- Get-CSNetworkSubnet
- New-CSNetworkBandwidthPolicyProfile
- New-CSNetworkInterRegionRoute
- New-CSNetworkInterSitePolicy
- New-CSNetworkRegion
- New-CSNetworkRegionLink
- New-CSNetworkSite
- New-CSNetworkSubnet
- Remove-CSNetworkInterRegionRoute
- Remove-CSNetworkInterSitePolicy
- Remove-CSNetworkRegion
- Remove-CSNetworkRegionLink
- Remove-CSNetworkSite
- Remove-CSNetworkSubnet
- Set-CSNetworkBandwidthPolicyProfile
- Set-CSNetworkInterRegionRoute
- Set-CSNetworkInterSitePolicy
- Set-CSNetworkRegion
- Set-CSNetworkRegionLink
- Set-CSNetworkSite
- Set-CSNetworkSubnet
- Get-CSVoicemailReroutingConfiguration
- Set-CSVoicemailReroutingConfiguration
- Remove-CSVoicemailReroutingConfiguration
- New-CSVoicemailReroutingConfiguration
- Get-CSTrunkConfiguration
- Set-CSTrunkConfiguration
- Remove-CSTrunkConfiguration
- New-CSTrunkConfiguration
- Get-CSOutboundTranslationRule
- Set-CSOutboundTranslationRule
- Remove-CSOutboundTranslationRule
- New-CSOutboundTranslationRule
- Get-CSPstnUsage
- Set-CSPstnUsage
- Get-CSVoiceRoute
- Set-CSVoiceRoute
- Remove-CSVoiceRoute
- New-CSVoiceRoute
- Get-CSRoutingConfiguration
- Set-CSRoutingConfiguration
- Remove-CSRoutingConfiguration
- Get-CSDialPlan
- Set-CSDialPlan
- Remove-CSDialPlan
- New-CSDialPlan
- Get-CSVoiceNormalizationRule
- Set-CSVoiceNormalizationRule
- Remove-CSVoiceNormalizationRule
- New-CSVoiceNormalizationRule
- Get-CSVoicePolicy
- Set-CSVoicePolicy
- Remove-CSVoicePolicy
- New-CSVoicePolicy
- Get-CSVoiceTestConfiguration
- Set-CSVoiceTestConfiguration
- Remove-CSVoiceTestConfiguration
- New-CSVoiceTestConfiguration
- Get-CSVoiceConfiguration
- Set-CSVoiceConfiguration
- Remove-CSVoiceConfiguration
- Get-CSUcPhoneConfiguration
- Set-CSUcPhoneConfiguration
- Remove-CSUcPhoneConfiguration
- New-CSUcPhoneConfiguration
- Get-CSHostedVoicemailPolicy
- Set-CSHostedVoicemailPolicy
- Remove-CSHostedVoicemailPolicy
- New-CSHostedVoicemailPolicy
- Test-CSP2PAV
- New-CsAnalogDevice
- Get-CsAnalogDevice
- Get-CSExUmContact
- Set-CSExUmContact
- New-CsExUmContact
- Remove-CsAnalogDevice
- Remove-CsCommonAreaPhone
- Remove-CsExUmContact
- Set-CsAnalogDevice
- Set-CsCommonAreaPhone
- New-CsCommonAreaPhone
- Test-CSVoiceNormalizationRule
- Test-CSDialPlan
- Test-CSVoiceRoute
- Test-CSVoicePolicy
- Test-CSVoiceTestConfiguration
- Test-CSVoiceUser
- Get-CSDeviceUpdateRule
- Remove-CSDeviceUpdateRule
- Approve-CSDeviceUpdateRule
- Reset-CSDeviceUpdateRule
- Restore-CSDeviceUpdateRule
- Clear-CsDeviceUpdateFile
- Import-CsDeviceUpdate
- Clear-CsDeviceUpdateLog
- Get-CsDeviceUpdateConfiguration
- Set-CsDeviceUpdateConfiguration
- New-CsDeviceUpdateConfiguration
- Remove-CsDeviceUpdateConfiguration
- Get-CsTestDevice
- Set-CsTestDevice
- New-CsTestDevice
- Remove-CsTestDevice
- Get-CSManagementStoreReplicationStatus
- Test-CsLisCivicAddress
- Test-CsLisConfiguration
- Debug-CsLisConfiguration
- Export-CsLisConfiguration
- Test-CsLocationPolicy
- Test-CsPhoneBootStrap
- Test-CsPstnOutboundCall
- Test-CsPstnPeerToPeerCall
- Unlock-CsClientPin
- Unpublish-CsLisConfiguration
- Set-CSPstnGateway
- Set-CsQoEConfiguation
- Set-CSRgsAgentGroup
- Set- CSRgsHoursofBusiness
- Set-CSRgsConfiguration
- Set-CSRgsHolidaySet
- Set-CSRgsQueue
- Set-CSRgsWorkflow
- Get-CsAdContact
- Get-CsAdUser
- Get-CsAudioTestServiceApplicationContact
- Get-CsBandwidthPolicyServiceConfiguration
- Get-CsClientPinInfo
- Get-CommonAreaPhone
- Get-CpsConfiguration
- Get-CsEnhancedEmergencyServiceDisclaimer
- Get-CsLisCivicAddress
- Get-CsLisLocation
- Get-CsLisPort
- Get-CsLisServiceProvider
- Get-CsLisSubnet
- Get-CsLisSwitch
- Get-CsLisWirelessAccessPoint
- Get-CsLocationPolicy
- Get-CsMediaConfiguration
- Get-CsNetworkConfiguration
- Get-CsQOEConfiguration
- Get-PinPolicy
- Get-CSRgsAgentGroup
- Get-CSRgsBusinessHours
- Get-CSRgsConfiguration
- Get-CSRgsHolidaySet
- Get-CSRgsQueue
- Get-CSRgsWorkflow
- Get-CSUserPoolInfo
- Get-CSUserPoolInfo
- Get-CsWebServiceConfiguration
- Get-CsWindowsService
- Grant-CsDialPlan
- Grant-CsHostedVoicemailPolicy
- Grant-CsLocationPolicy
- Grant-CsVoicePolicy
- Import-CsLisConfiguration
- Import-CSRgsAudioFile
- Lock-CsClientPin
- Move-CsApplicationEndpoint
- Move-CsConferenceDirectory
- Move-CSRgsConfiguration
- New-CSRgsAgentGroup
- New-CsQoEConfiguration
- New-CsNetworkMediaBypassConfiguration
- New-CsNetworkBWPolicy
- New-CsNetworkBWAlternatePath
- New-CsMediaConfiguration
- New-CsLocationPolicy
- New-CsCpsConfiguration
- New-CsBandwidthPolicyServiceConfiguration
- New-CSRgsAnswer
- New-CSRgsCallAction
- New-CSRgsHoliday
- New-CSRgsHolidaySet
- New-CSRgsHoursOfBusiness
- New-CSRgsQuestion
- New-CSRgsQueue
- New-CSRgsTimeRange
- New-CSRgsWorkflow
- New-CSRgsWorkflowPrompt
- New-CsRoutingConfiguration
- New-CsVoiceRegex
- Publish-CsLisConfiguration
- Remove-CsBandwidthPolicyServiceConfiguration
- Remove-CsCpsConfiguration
- Remove-CsEnhancedEmergencyServiceDisclaimer
- Remove-CsLisLocation
- Remove-CsLisPort
- Remove-CsLisServiceProvider
- Remove-CsLisSubnet
- Remove-CsLisSwitch
- Remove-CsLisWirelessAccessPoint
- Remove-CsLocationPolicy
- Remove-CsMediaConfiguration
- Remove-CsNetworkBandwidthPolicyProfile
- Remove-CsNetworkConfiguration
- Remove-CsQoEConfiguration
- Remove-CSRgsAgentGroup
- Remove-CSRgsHolidaySet
- Remove-CSRgsHoursOfBusiness
- Remove-CSRgsQueue
- Remove-CSRgsWorkflow
- Set-CsAudioTestServiceApplicationContact
- Set-CsBandwidthPolicyServiceConfiguration
- Set-CsNetworkConfiguration
- Set-CsMediationServer
- Set-CsMediaConfiguration
- Set-CsLocationPolicy
- Set-CsLisWirelessAccessPoint
- Set-CsLisSwitch
- Set-CsLisSubnet
- Set-CsLisServiceProvider
- Set-CsLisPort
- Set-CsLisLocation
- Set-CsEnhancedEmergencyServiceDisclaimer
- Set-CsCpsConfiguration
- Set-CsClientPin
CsServerAdministrator
The CsServerAdministrator role is permitted to run the following cmdlets:
- Get-CsApplicationEndpoint
- Get-CsPresencePolicy
- Set-CsPresencePolicy
- New-CsPresencePolicy
- Remove-CsPresencePolicy
- Get-CSWindowsService
- Start-CSWindowsService
- Stop-CsWindowsService
- Get-CSCertificate
- Get-CSAccessEdgeConfiguration
- Get-CSAddressBookConfiguration
- Get-CSAllowAllDomains
- Get-CSAllowedDomain
- Get-CSAnnouncement
- Get-CSArchivingConfiguration
- Get-CSArchivingPolicy
- Get-CSAVEdgeConfiguration
- Get-CSBandwidthPolicyServiceConfiguration
- Get-CSBlockedDomain
- Get-CSCallParkOrbit
- Get-CSCdrConfiguration
- Get-CSClientPolicy
- Get-CSClientVersionConfiguration
- Get-CSClientVersionPolicy
- Get-CSConferenceDirectory
- Get-CSConferenceDisclaimer
- Get-CSConferencingConfiguration
- Get-CSConferencingPolicy
- Get-CSCpsConfiguration
- Get-CSDeviceUpdateConfiguration
- Get-CSDeviceUpdateRule
- Get-CSDiagnosticFilterConfiguration
- Get-CSDiagnosticHeaderConfiguration
- Get-CSDialInConferencingAccessNumber
- Get-CSDialInConferencingConfiguration
- Get-CSDialInConferencingDtmfConfiguration
- Get-CSDialInConferencingLanguageList
- Get-CSDialPlan
- Get-CSEnhancedEmergencyServiceDisclaimer
- Get-CSExternalAccessPolicy
- Get-CSTrustedApplication
- Get-CSTrustedApplicationEndpoint
- Get-CSExUmContact
- Get-CSFileTransferFilterConfiguration
- Get-CSHealthMonitoringConfiguration
- Get-CSHostedVoicemailPolicy
- Get-CSHostingProvider
- Get-CSImFilterConfiguration
- Get-CSLisCivicAddress
- Debug-CSLisConfiguration
- Get-CSLisLocation
- Get-CSLisPort
- Get-CSLisServiceProvider
- Get-CSLisSubnet
- Get-CSLisSwitch
- Get-CSLisWirelessAccessPoint
- Get-CSLocationPolicy
- Get-CSManagementConnection
- Get-CSManagementStoreReplicationStatus
- Get-CSMediaConfiguration
- Get-CSMeetingConfiguration
- Get-CSNetworkBandwidthPolicyProfile
- Get-CSNetworkInterRegionRoute
- Get-CSNetworkInterSitePolicy
- Get-CSNetworkRegion
- Get-CSNetworkRegionLink
- Get-CSNetworkSite
- Get-CSNetworkSubnet
- Get-CSNetworkConfiguration
- Get-CSOutboundTranslationRule
- Get-CSPstnUsage
- Get-CSPinPolicy
- Get-CSPrivacyConfiguration
- Get-CSProxyConfiguration
- Get-CSPublicProvider
- Get-CSQoEConfiguration
- Get-CSRegistrarConfiguration
- Get-CSRgsAgentGroup
- Get-CSRgsBusinessHours
- Get-CSRgsConfiguration
- Get-CSRgsHolidaySet
- Get-CSRgsQueue
- Get-CSRgsWorkflow
- Get-CSRoutingConfiguration
- Get-CSServerApplication
- Get-CSSimpleUrlConfiguration
- Get-CSSipDomain
- Get-CSStaticRoutingConfiguration
- Get-CSTestDevice
- Get-CSTrunkConfiguration
- Get-CSUcPhoneConfiguration
- Get-CSUserReplicatorConfiguration
- Get-CSUserServicesConfiguration
- Get-CSUnassignedNumber
- Get-CSVoiceConfiguration
- Get-CSVoicemailReroutingConfiguration
- Get-CSVoiceNormalizationRule
- Get-CSVoicePolicy
- Get-CSVoiceRoute
- Get-CSVoiceTestConfiguration
- Get-CSWebServiceConfiguration
- Get-CSComputer
- Get-CSPool
- Get-CSService
- Get-CSSite
- Get-CSTopology
- Get-CsNetworkInterface
- Set-CSAccessEdgeConfiguration
- Set-CSAddressBookConfiguration
- New-CSAddressBookConfiguration
- Remove-CSAddressBookConfiguration
- Set-CSAllowAllDomains
- Set-CSAllowedDomain
- New-CSAllowedDomain
- Remove-CSAllowedDomain
- Set-CSAnnouncement
- New-CSAnnouncement
- Remove-CSAnnouncement
- Set-CSAVEdgeConfiguration
- New-CSAVEdgeConfiguration
- Remove-CSAVEdgeConfiguration
- Set-CSBandwidthPolicyServiceConfiguration
- New-CSBandwidthPolicyServiceConfiguration
- Remove-CSBandwidthPolicyServiceConfiguration
- Set-CSBlockedDomain
- New-CSBlockedDomain
- Remove-CSBlockedDomain
- Set-CSCallParkOrbit
- New-CSCallParkOrbit
- Remove-CSCallParkOrbit
- Set-CSCdrConfiguration
- New-CSCdrConfiguration
- Remove-CSCdrConfiguration
- Set-CSClientPolicy
- New-CSClientPolicy
- Remove-CSClientPolicy
- Set-CSClientVersionConfiguration
- New-CSClientVersionConfiguration
- Remove-CSClientVersionConfiguration
- New-CSConferenceDirectory
- Remove-CSConferenceDirectory
- Move-CSConferenceDirectory
- Set-CSConferenceDisclaimer
- Remove-CSConferenceDisclaimer
- Set-CSConferencingConfiguration
- New-CSConferencingConfiguration
- Remove-CSConferencingConfiguration
- Set-CSConferencingPolicy
- New-CSConferencingPolicy
- Remove-CSConferencingPolicy
- Set-CSCpsConfiguration
- New-CSCpsConfiguration
- Remove-CSCpsConfiguration
- Set-CSDeviceUpdateConfiguration
- New-CSDeviceUpdateConfiguration
- Remove-CSDeviceUpdateConfiguration
- Remove-CSDeviceUpdateRule
- Set-CSDiagnosticFilterConfiguration
- New-CSDiagnosticFilterConfiguration
- Remove-CSDiagnosticFilterConfiguration
- Set-CSDiagnosticHeaderConfiguration
- New-CSDiagnosticHeaderConfiguration
- Remove-CSDiagnosticHeaderConfiguration
- Set-CSDialInConferencingAccessNumber
- New-CSDialInConferencingAccessNumber
- Remove-CSDialInConferencingAccessNumber
- Set-CSDialInConferencingConfiguration
- New-CSDialInConferencingConfiguration
- Remove-CSDialInConferencingConfiguration
- Set-CSDialInConferencingDtmfConfiguration
- New-CSDialInConferencingDtmfConfiguration
- Remove-CSDialInConferencingDtmfConfiguration
- Set-CSDialPlan
- New-CSDialPlan
- Remove-CSDialPlan
- Set-CSEnhancedEmergencyServiceDisclaimer
- Remove-CSEnhancedEmergencyServiceDisclaimer
- Set-CSExternalAccessPolicy
- New-CSExternalAccessPolicy
- Remove-CSExternalAccessPolicy
- Set-CSTrustedApplication
- New-CSTrustedApplication
- Remove-CSTrustedApplication
- Set-CSTrustedApplicationEndpoint
- New-CSTrustedApplicationEndpoint
- Remove-CSTrustedApplicationEndpoint
- Set-CSExUmContact
- New-CSExUmContact
- Remove-CSExUmContact
- Set-CSFileTransferFilterConfiguration
- New-CSFileTransferFilterConfiguration
- Remove-CSFileTransferFilterConfiguration
- Set-CSHealthMonitoringConfiguration
- New-CSHealthMonitoringConfiguration
- Remove-CSHealthMonitoringConfiguration
- Set-CSHostedVoicemailPolicy
- New-CSHostedVoicemailPolicy
- Remove-CSHostedVoicemailPolicy
- Set-CSHostingProvider
- New-CSHostingProvider
- Remove-CSHostingProvider
- Set-CSImFilterConfiguration
- New-CSImFilterConfiguration
- Remove-CSImFilterConfiguration
- Set-CSLisLocation
- Remove-CSLisLocation
- Set-CSLisPort
- Remove-CSLisPort
- Set-CSLisServiceProvider
- Remove-CSLisServiceProvider
- Set-CSLisSubnet
- Remove-CSLisSubnet
- Set-CSLisSwitch
- Remove-CSLisSwitch
- Set-CSLisWirelessAccessPoint
- Remove-CSLisWirelessAccessPoint
- Set-CSLocationPolicy
- New-CSLocationPolicy
- Remove-CSLocationPolicy
- Set-CSManagementConnection
- Remove-CSManagementConnection
- Set-CSMediaConfiguration
- New-CSMediaConfiguration
- Remove-CSMediaConfiguration
- Set-CSMeetingConfiguration
- New-CSMeetingConfiguration
- Remove-CSMeetingConfiguration
- Set-CSNetworkBandwidthPolicyProfile
- New-CSNetworkBandwidthPolicyProfile
- Remove-CSNetworkBandwidthPolicyProfile
- Set-CSNetworkInterRegionRoute
- New-CSNetworkInterRegionRoute
- Remove-CSNetworkInterRegionRoute
- Set-CSNetworkInterSitePolicy
- New-CSNetworkInterSitePolicy
- Remove-CSNetworkInterSitePolicy
- Set-CSNetworkRegion
- New-CSNetworkRegion
- Remove-CSNetworkRegion
- Set-CSNetworkRegionLink
- New-CSNetworkRegionLink
- Remove-CSNetworkRegionLink
- Set-CSNetworkSite
- New-CSNetworkSite
- Remove-CSNetworkSite
- Set-CSNetworkSubnet
- New-CSNetworkSubnet
- Remove-CSNetworkSubnet
- Set-CSOutboundTranslationRule
- New-CSOutboundTranslationRule
- Remove-CSOutboundTranslationRule
- Set-CSPstnUsage
- Set-CSPinPolicy
- New-CSPinPolicy
- Remove-CSPinPolicy
- Set-CSPrivacyConfiguration
- New-CSPrivacyConfiguration
- Remove-CSPrivacyConfiguration
- Set-CSProxyConfiguration
- New-CSProxyConfiguration
- Remove-CSProxyConfiguration
- Set-CSPublicProvider
- New-CSPublicProvider
- Remove-CSPublicProvider
- Set-CSQoEConfiguration
- New-CSQoEConfiguration
- Remove-CSQoEConfiguration
- Set-CSRegistrarConfiguration
- New-CSRegistrarConfiguration
- Remove-CSRegistrarConfiguration
- Set-CSRgsAgentGroup
- New-CSRgsAgentGroup
- Remove-CSRgsAgentGroup
- Set-CSRgsHoursOfBusiness
- Remove-CSRgsHoursOfBusiness
- New-CSRgsHoursOfBusiness
- Set-CSRgsConfiguration
- Move-CSRgsConfiguration
- Set-CSRgsHolidaySet
- New-CSRgsHolidaySet
- Remove-CSRgsHolidaySet
- Set-CSRgsQueue
- New-CSRgsQueue
- Remove-CSRgsQueue
- Set-CSRgsWorkflow
- New-CSRgsWorkflow
- Remove-CSRgsWorkflow
- Set-CSRoutingConfiguration
- New-CSRoutingConfiguration
- Remove-CSRoutingConfiguration
- Set-CSServerApplication
- New-CSServerApplication
- Remove-CSServerApplication
- Set-CSSimpleUrlConfiguration
- New-CSSimpleUrlConfiguration
- Remove-CSSimpleUrlConfiguration
- Set-CSSipDomain
- New-CSSipDomain
- Remove-CSSipDomain
- Set-CSStaticRoutingConfiguration
- New-CSStaticRoutingConfiguration
- Remove-CSStaticRoutingConfiguration
- Set-CSTestDevice
- New-CSTestDevice
- Remove-CSTestDevice
- Set-CSTrunkConfiguration
- New-CSTrunkConfiguration
- Remove-CSTrunkConfiguration
- Set-CSUcPhoneConfiguration
- New-CSUcPhoneConfiguration
- Remove-CSUcPhoneConfiguration
- Set-CSUserReplicatorConfiguration
- New-CSUserReplicatorConfiguration
- Remove-CSUserReplicatorConfiguration
- Set-CSUserServicesConfiguration
- New-CSUserServicesConfiguration
- Remove-CSUserServicesConfiguration
- Set-CsUnassignedNumber
- New-CsUnassignedNumber
- Remove-CsUnassignedNumber
- Set-CSVoiceConfiguration
- Remove-CSVoiceConfiguration
- Set-CSVoicemailReroutingConfiguration
- New-CSVoicemailReroutingConfiguration
- Remove-CSVoicemailReroutingConfiguration
- Set-CSVoiceNormalizationRule
- New-CSVoiceNormalizationRule
- Remove-CSVoiceNormalizationRule
- Set-CSVoicePolicy
- New-CSVoicePolicy
- Remove-CSVoicePolicy
- Set-CSVoiceRoute
- New-CSVoiceRoute
- Remove-CSVoiceRoute
- Set-CSVoiceTestConfiguration
- New-CSVoiceTestConfiguration
- Remove-CSVoiceTestConfiguration
- Set-CSWebServiceConfiguration
- New-CSWebServiceConfiguration
- Remove-CSWebServiceConfiguration
- Approve-CSDeviceUpdateRule
- Reset-CSDeviceUpdateRule
- Restore-CSDeviceUpdateRule
- Enable-CSHostingProvider
- Disable-CSHostingProvider
- Test-CSLisCivicAddress
- Test-CSLisConfiguration
- Export-CSLisConfiguration
- Import-CSLisConfiguration
- Publish-CSLisConfiguration
- UnPublish-CSLisConfiguration
- Test-CSLocationPolicy
- Enable-CSPublicProvider
- Disable-CSPublicProvider
- Test-CSVoiceNormalizationRule
- Test-CSVoicePolicy
- Test-CSVoiceRoute
- Test-CSVoiceTestConfiguration
- Test-CsFederatedPartner
- Test-CsGroupExpansion
- Test-CsAddressBookService
- Test-CsAddressBookWebQuery
- Test-CsAVConference
- Test-CsClientAuth
- Test-CsDialInConferencing
- Test-CsGroupIM
- Test-CsIM
- Test-CsPresence
- Test-CsRegistration
- Test-CsP2PAV
- Test-CsPhoneBootstrap
- Test-CsPstnOutboundCall
- Test-CsPstnPeerToPeerCall
- Test-CsVoiceUser
- Test-CsDialPlan
- Clear-CsDeviceUpdateFile
- Clear-CsDeviceUpdateLog
- Get-CsAdContact
- Get-CsAdminRole
- Get-CsAdminRoleAssignment
- Get-CsAdUser
- Get-CsAnalogDevice
- Get-CsAudioTestServiceApplicationContact
- Get-CsClientCertificate
- Get-CsClientPinInfo
- Get-CsClientVersionPolicyRule
- Get-CsCommonAreaPhone
- New-CsCommonAreaPhone
- Remove-CsCommonAreaPhone
- Set-CsCommonAreaPhone
- Get-CsRgsHoursOfBusiness
- Get-CsTrustedApplicationComputer
- Get-CsTrustedApplicationPool
- Get-CsUser
- Get-CsUserAcp
- Get-CsUserDatabaseState
- Get-CsUserPoolInfo
- Import-CSAnnouncementFile
- Import-CsConfiguration
- Import-CsDeviceUpdate
- Import-CSRgsAudioFile
- Export-CsConfiguration
- Invoke-CsManagementStoreReplication
- Move-CsApplicationEndpoint
- New-CsAnalogDevice
- New-CsClientPolicyEntry
- New-CsClientVersionPolicy
- New-CsClientVersionPolicyRule
- New-CsDiagnosticsFilter
- New-CsIssuedCertId
- New-CsNetworkBWAlternatePath
- New-CsNetworkBWPolicy
- New-CsNetworkMediaBypassConfiguration
- New-CSRgsAnswer
- New-CSRgsCallAction
- New-CSRgsHoliday
- New-CSRgsQuestion
- New-CSRgsTimeRange
- New-CSRgsWorkflowPrompt
- New-CsSimpleUrl
- New-CsSimpleUrlEntry
- New-CsSipProxyCustom
- New-CsSipProxyRealm
- New-CsSipProxyTCP
- New-CsSipProxyTLS
- New-CsSipProxyTransport
- New-CsSipProxyUseDefault
- New-CsSipProxyUseDefaultCert
- New-CsStaticRoute
- New-CsTrustedApplicationComputer
- New-CsTrustedApplicationPool
- New-CsVoiceRegex
- New-CsWebTrustedCACertificate
- Remove-CsAnalogDevice
- ReMove-CsClientVersionPolicy
- ReMove-CsClientVersionPolicyRule
- ReMove-CsNetworkConfiguration
- ReMove-CsTrustedApplicationComputer
- ReMove-CsTrustedApplicationPool
- Set-CsAnalogDevice
- Set-CsApplicationServer
- Set-CsAudioTestServiceApplicationContact
- Set-CsCallParkServiceMusicOnHoldFile
- Set-CsClientVersionPolicy
- Set-CsClientVersionPolicyRule
- Set-CsConferenceServer
- Set-CsDirector
- Set-CsEdgeServer
- Set-CsManagementServer
- Set-CsMediationServer
- Set-CsMonitoringServer
- Set-CsNetworkConfiguration
- Set-CsPstnGateway
- Set-CsRegistrar
- Set-CsSite
- Set-CsTrustedApplicationPool
- Set-CsUserDatabaseState
- Set-CsUserServer
- Set-CsWebServer
- Update-CsAddressBook
- Update-CsUserDatabase
CsViewOnlyAdministrator
The CsViewOnlyAdministrator role is permitted to run the following cmdlets:
- Get-CSAccessEdgeConfiguration
- Get-CSAddressBookConfiguration
- Get-CSAllowAllDomains
- Get-CSAllowedDomain
- Get-CSAnnouncement
- Get-CSArchivingConfiguration
- Get-CSArchivingPolicy
- Get-CSAVEdgeConfiguration
- Get-CSBandwidthPolicyServiceConfiguration
- Get-CSBlockedDomain
- Get-CSCallParkOrbit
- Get-CSCdrConfiguration
- Get-CSClientPolicy
- Get-CSClientVersionConfiguration
- Get-CSClientVersionPolicy
- Get-CSConferenceDirectory
- Get-CSConferenceDisclaimer
- Get-CSConferencingConfiguration
- Get-CSConferencingPolicy
- Get-CSCpsConfiguration
- Get-CSDeviceUpdateConfiguration
- Get-CSDeviceUpdateRule
- Get-CSDiagnosticFilterConfiguration
- Get-CSDiagnosticHeaderConfiguration
- Get-CSDialInConferencingAccessNumber
- Get-CSDialInConferencingConfiguration
- Get-CSDialInConferencingDtmfConfiguration
- Get-CSDialInConferencingLanguageList
- Get-CSDialPlan
- Get-CSEnhancedEmergencyServiceDisclaimer
- Get-CSExternalAccessPolicy
- Get-CSTrustedApplication
- Get-CSTrustedApplicationEndpoint
- Get-CSExUmContact
- Get-CSFileTransferFilterConfiguration
- Get-CSHealthMonitoringConfiguration
- Get-CSHostedVoicemailPolicy
- Get-CSHostingProvider
- Get-CSImFilterConfiguration
- Get-CSLisCivicAddress
- Debug-CSLisConfiguration
- Get-CSLisLocation
- Get-CSLisPort
- Get-CSLisServiceProvider
- Get-CSLisSubnet
- Get-CSLisSwitch
- Get-CSLisWirelessAccessPoint
- Get-CSLocationPolicy
- Get-CSManagementConnection
- Get-CSManagementStoreReplicationStatus
- Get-CSMediaConfiguration
- Get-CSMeetingConfiguration
- Get-CSNetworkBandwidthPolicyProfile
- Get-CSNetworkRInteregionRoute
- Get-CSNetworkInterSitePolicy
- Get-CSNetworkRegion
- Get-CSNetworkRegionLink
- Get-CSNetworkSite
- Get-CSNetworkSubnet
- Get-CSNetworkConfiguration
- Get-CSOutboundTranslationRule
- Get-CSPstnUsage
- Get-CSPinPolicy
- Get-CSPrivacyConfiguration
- Get-CSProxyConfiguration
- Get-CSPublicProvider
- Get-CSQoEConfiguration
- Get-CSRegistrarConfiguration
- Get-CSRgsAgentGroup
- Get-CSRgsBusinessHours
- Get-CSRgsConfiguration
- Get-CSRgsHolidaySet
- Get-CSRgsQueue
- Get-CSRgsWorkflow
- Get-CSRgsHoursOfBusiness
- Get-CSRoutingConfiguration
- Get-CSServerApplication
- Get-CSSimpleUrlConfiguration
- Get-CSSipDomain
- Get-CSStaticRoutingConfiguration
- Get-CSTestDevice
- Get-CSTrunkConfiguration
- Get-CSUcPhoneConfiguration
- Get-CSUserReplicatorConfiguration
- Get-CSUserServicesConfiguration
- Get-CSUnassignedNumber
- Get-CSVoicemailReroutingConfiguration
- Get-CSVoiceNormalizationRule
- Get-CSVoicePolicy
- Get-CSVoiceRoute
- Get-CSVoiceTestConfiguration
- Get-CSWebServiceConfiguration
- Get-CSComputer
- Get-CSPool
- Get-CSSite
- Get-CSService
- Test-CSNetworkInterface
- Test-CSSetupPermission
- Get-CSTopology
- Get-CSAnalogDevice
- Get-CSCommonAreaPhone
- Get-CSCertificate
- Get-CSWindowsService
- Get-CSAdUser
- Get-CSUser
- Get-CSClientPinInfo
- Get-CSVoiceConfiguration
- Get-CsPresencePolicy
- Get-CsAdContact
- Get-CsAudioTestServiceApplicationContact
- Get-CsClientCertificate
- Get-CsClientVersionPolicyRule
- Get-CsTrustedApplicationComputer
- Get-CsTrustedApplicationPool
- Get-CsUserAcp
- Get-CsUserDatabaseState
- Get-CsUserPoolInfo
CsHelpDesk
The CsHelpDesk role is permitted to run the following cmdlets:
- Get-CSAccessEdgeConfiguration
- Get-CSAddressBookConfiguration
- Get-CSAllowAllDomains
- Get-CSAllowedDomain
- Get-CSAnnouncement
- Get-CSArchivingConfiguration
- Get-CSArchivingPolicy
- Get-CSAVEdgeConfiguration
- Get-CSBandwidthPolicyServiceConfiguration
- Get-CSBlockedDomain
- Get-CSCallParkOrbit
- Get-CSCdrConfiguration
- Get-CSClientPolicy
- Get-CSClientVersionConfiguration
- Get-CSClientVersionPolicy
- Get-CSConferenceDirectory
- Get-CSConferenceDisclaimer
- Get-CSConferencingConfiguration
- Get-CSConferencingPolicy
- Get-CSCpsConfiguration
- Get-CSDeviceUpdateConfiguration
- Get-CSDeviceUpdateRule
- Get-CSDiagnosticFilterConfiguration
- Get-CSDiagnosticHeaderConfiguration
- Get-CSDialInConferencingAccessNumber
- Get-CSDialInConferencingConfiguration
- Get-CSDialInConferencingDtmfConfiguration
- Get-CSDialInConferencingLanguageList
- Get-CSDialPlan
- Get-CSEnhancedEmergencyServiceDisclaimer
- Get-CSExternalAccessPolicy
- Get-CSTrustedApplication
- Get-CSTrustedApplicationEndpoint
- Get-CSExUmContact
- Get-CSFileTransferFilterConfiguration
- Get-CSHealthMonitoringConfiguration
- Get-CSHostedVoicemailPolicy
- Get-CSHostingProvider
- Get-CSImFilterConfiguration
- Get-CSLisCivicAddress
- Get-CSLisConfiguration
- Get-CSLisLocation
- Get-CSLisPort
- Get-CSLisServiceProvider
- Get-CSLisSubnet
- Get-CSLisSwitch
- Get-CSLisWirelessAccessPoint
- Get-CSLocationPolicy
- Get-CSManagementConnection
- Get-CSManagementStoreReplicationStatus
- Get-CSMediaConfiguration
- Get-CSMeetingConfiguration
- Get-CSNetworkBandwidthPolicyProfile
- Get-CSNetworkInterRegionRoute
- Get-CSNetworkInterSitePolicy
- Get-CSNetworkRegion
- Get-CSNetworkRegionLink
- Get-CSNetworkSite
- Get-CSNetworkSubnet
- Get-CSNetworkConfiguration
- Get-CSOutboundTranslationRule
- Get-CSPstnUsage
- Get-CSPinPolicy
- Get-CSPrivacyConfiguration
- Get-CSProxyConfiguration
- Get-CSPublicProvider
- Get-CSQoEConfiguration
- Get-CSRegistrarConfiguration
- Get-CSRgsAgentGroup
- Get-CSRgsBusinessHours
- Get-CSRgsConfiguration
- Get-CSRgsHolidaySet
- Get-CSRgsQueue
- Get-CSRgsWorkflow
- Get-CSRoutingConfiguration
- Get-CSServerApplication
- Get-CSSimpleUrlConfiguration
- Get-CSSipDomain
- Get-CSStaticRoutingConfiguration
- Get-CSTestDevice
- Get-CSTrunkConfiguration
- Get-CSUcPhoneConfiguration
- Get-CSUserReplicatorConfiguration
- Get-CSUserServicesConfiguration
- Get-CSUnassignedNumber
- Get-CSVoiceConfiguration
- Get-CSVoicemailReroutingConfiguration
- Get-CSVoiceNormalizationRule
- Get-CSVoicePolicy
- Get-CSVoiceRoute
- Get-CSVoiceTestConfiguration
- Get-CSWebServiceConfiguration
- Get-CSComputer
- Get-CSPool
- Get-CSService
- Get-CSSite
- Get-CSTopology
- Get-CSAnalogDevice
- Get-CSCommonAreaPhone
- Get-CsAdUser
- Get-CsUser
- Get-CSClientPinInfo
- Lock-CSClientPin
- Unlock-CSClientPin
- Set-CSClientPin
- Get-CSClientVersionPolicyRule
- Get-CSWindowsService
- Get-CsNetworkInterface
- Get-CsPresencePolicy
- Test-CsFederatedPartner
- Test-CsGroupExpansion
- Test-CsAddressBookService
- Test-CsAddressBookWebQuery
- Test-CsAVConference
- Test-CsClientAuth
- Test-CsDialInConferencing
- Test-CsGroupIM
- Test-CsIM
- Test-CsPresence
- Test-CsRegistration
- Test-CsPhoneBootstrap
- Test-CsP2PAV
- Test-CsPstnOutboundCall
- Test-CsPstnPeerToPeerCall
- Test-CsVoiceUser
- Get-CsAdContact
- Get-CsRgsHoursOfBusiness
- Get-CsUserAcp
- Get-CsUserPoolInfo
- Get-CsAudioTestServiceApplicationContact
CsArchivingAdministrator
The CsArchivingAdministrator role is permitted to run the following cmdlets:
- New-CsArchivingPolicy
- Get-CsArchivingPolicy
- Set-CsArchivingPolicy
- Remove-CsArchivingPolicy
- Grant-CsArchivingPolicy
- New-CsArchivingConfiguration
- Get-CsArchivingConfiguration
- Set-CsArchivingConfiguration
- Remove-CsArchivingConfiguration
- Get-CsUser
- Export-CsArchivingData
- Get-CsSite
- Get-CsService
- Get-CsPool
- Get-CsComputer
- Get-CsNetworkInterface
- Get-CsManagementStoreReplicationStatus
- Get-CSWindowsService
- Get-CsUserPoolInfo
- Set-CsArchivingServer
CsResponseGroupAdministrator
The CsResponseGroupAdministrator role is permitted to run the following cmdlets:
- Get-CSRgsAgentGroup
- Get-CSRgsHoursofBusiness
- Get-CSRgsConfiguration
- Get-CSRgsHolidaySet
- Get-CSRgsQueue
- Get-CSRgsWorkflow
- Get-CSService
- Get-CSUser
- Import-CSRgsAudioFile
- Move-CSRgsConfiguration
- New-CSRgsAgentGroup
- New-CSRgsAnswer
- New-CSRgsHoursofBusiness
- New-CSRgsCallAction
- New-CSRgsHoliday
- New-CSRgsHolidaySet
- New-CSRgsQuestion
- New-CSRgsQueue
- New-CSRgsTimeRange
- New-CSRgsWorkflow
- New-CSRgsWorkflowPrompt
- Remove-CSRgsAgentGroup
- Remove-CSRgsHoursofBusiness
- Remove-CSRgsHolidaySet
- Remove-CSRgsQueue
- Remove-CSRgsWorkflow
- Set-CSRgsAgentGroup
- Set- CSRgsHoursofBusiness
- Set-CSRgsConfiguration
- Set-CSRgsHolidaySet
- Set-CSRgsQueue
- Set-CSRgsWorkflow
- Get-CsSite
- Get-CsPool
- Get-CsComputer
- Get-CSWindowsService
- Get-CsNetworkInterface
- Get-CsManagementStoreReplicationStatus
- Get-CsUserPoolInfo
CsLocationAdministrator
The CsLocationAdministrator role is permitted to run the following cmdlets:
- Get-CSNetworkSite
- Get-CSNetworkSubnet
- New-CSNetworkSite
- New-CSNetworkSubnet
- Remove-CSNetworkSite
- Remove-CSNetworkSubnet
- Set-CSNetworkSite
- Set-CSNetworkSubnet
- Get-CSLisCivicAddress
- Test-CSLisCivicAddress
- Debug-CSLisConfiguration
- Publish-CSLisConfiguration
- Unpublish-CSLisConfiguration
- Get-CSLisLocation
- Remove-CSLisLocation
- Set-CSLisLocation
- Get-CSLisPort
- Remove-CSLisPort
- Set-CSLisPort
- Get-CSLisSubnet
- Remove-CSLisSubnet
- Set-CSLisSubnet
- Get-CSLisSwitch
- Remove-CSLisSwitch
- Set-CSLisSwitch
- Get-CSLisWirelessAccessPoint
- Remove-CSLisWirelessAccessPoint
- Set-CSLisWirelessAccessPoint
- Get-CsSite
- Get-CsService
- Get-CsPool
- Get-CSUser
- Get-CsComputer
- Get-CSWindowsService
- Get-CsNetworkInterface
- Get-CsManagementStoreReplicationStatus
- Get-CsUserPoolInfo
- Get-CSLocationPolicy
- Grant-CSLocationPolicy
- Export-CsLisConfiguration
- Get-CsLisServiceProvider
- Get-CsWebServiceConfiguration
- Import-CsLisConfiguration
- Test-CsLisConfiguration
- Test-CsLocationPolicy