Azure Active Directory and Role Delegations

If you are designing access to 0365 resources to your tenant for the supporting teams, you are probably familiar with not using *Default" Access Role groups, instead creating custom RBAC role groups and tailor them according to your needs. To tighten the security you would also think perhaps removing some of the cmdlet's comes with default Role assignments. Such work is always tedious and important in my opinion. Of course you can use default role groups if you are a small shop and not worried about creating a mess on the directory services.

Wanting to create RBAC custom roles becomes valuable and necessary on large enterprises. This way you can manage RBAC Custom AD security group membership on premises  and delegate access you need to your supporting teams. 

Working with Azure Active Directory, you will realize  you cannot add AD Security groups into any of the default Role groups, only option you have available are to add users and service Principals 

I am not sure when MS Azure team would consider fixing this issues, until then stayed tune and start looking workaround for the issue. Using PowerShell and adding individual users fairly simple task however, the mess I have mentioned earlier would come into play doing it that way and additional operational burden to your supporting teams.

Useful links to read more about the Roles

https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/directory-assign-admin-roles

Casey, Dedeal

Azure Certified Solutions Architect

AWS Certified Cloud Practitioner 

https://simplepowershell.blogspot.com/  (blog)

https://smtp25.blogspot.com/ (blog)

https://telnet25.wordpress.com/ (blog)

https://twitter.com/Message_Talk (Twitter)

Adding Send AS Mailbox Permissions to O365 Mailbox

If you are in the hybrid environment and looking for assigning mailbox permissions to migrated user on premises mailbox/s you will find below article handy. Changes are done on premises Active Directory needs to sync to Office 354 Azure Directory services via AD Sync.

Add-RecipientPermission (This cmdlet is available only in the cloud-based service.)

https://docs.microsoft.com/en-us/powershell/module/exchange/mailboxes/add-recipientpermission?view=exchange-ps

Add-MailboxPermission (This cmdlet is available in on-premises Exchange and in the cloud-based service)

https://docs.microsoft.com/en-us/powershell/module/exchange/mailboxes/add-mailboxpermission?view=exchange-ps

# VARS

$CloudMB1   = "Jason.Born@SecuredNinja.org"   # Cloud Mailbox

$SharedMB1  = "HRShared1@SecuredNinja.org"    # On prem

$SharedMB2  = "HRShared2@SecuredNinja.org"    # On prem

# ADDING  MB Permissions

Write-host "Adding AD Permissions"

Add-MailboxPermission –Identity $SharedMB1 –User $CloudMB1 `

                      –AccessRights FullAccess –AutoMapping $True -InheritanceType All -WhatIf

# VERIFY AD PERMISSIONS 

Write-host "Verifying AD Permissions"

$Output1 = Get-Mailbox -Identity $SharedMB1  | Get-MailboxPermission |`

where {$_.user.tostring() -ne "NT AUTHORITY\SELF" -and $_.IsInherited -eq $false} |`

Select-Object User,AccessRights,IsInherited,Deny

# ADD <SEND AS >

Write-host "Adding <SEND AS>  Permissions"

Add-RecipientPermission -Identity $SharedMB1 -Trustee $CloudMB1 -AccessRights SendAs -WhatIf

#VERIFY  <SEND AS>

Write-host "Verifying <SEND AS>  Permissions"

Get-RecipientPermission -Identity $SharedMB1

# REMOVE <SEND AS>

Write-host "REMOVING <SEND AS>  Permissions"

$removeUser = "Casey.Dedeal@SecuredNinja.org"

Remove-RecipientPermission -Identity $SharedMB2 -Trustee $removeUser -AccessRights SendAs -WhatIf

# REMOVE <FULL MB>

Write-host "REMOVING <FULL MB>  Permissions"

$CloudMB = "Casey.Dedeal@SecuredNinja.org"

Remove-MailboxPermission –Identity $SharedMB2 –User $CloudMB –AccessRights FullAccess -WhatIf

Casey DeDeal
Azure Certified Solutions Architect 
Principal Systems Engineer
https://msazure365.blogspot.com/ (blog)
https://simplepowershell.blogspot.com/  (blog)

https://twitter.com/Message_Talk (Twitter)