Get-ManagementRoleAssignment — usage, script and reference

Quick start script

# Get-ManagementRoleAssignment — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-ExchangeOnline -CertificateThumbprint $thumb -AppId $appId -Organization $org

# 2. Run and inspect
Get-ManagementRoleAssignment | Format-List

# 3. Export for evidence / drift tracking
Get-ManagementRoleAssignment | Export-Clixml .\ManagementRoleAssignment-$(Get-Date -Format yyyyMMdd).xml

Syntax — 2 parameter sets

Identity

Get-ManagementRoleAssignment [[-Identity] <RoleAssignmentIdParameter>]
 [-ConfigWriteScope <ConfigWriteScopeType>]
 [-CustomConfigWriteScope <ManagementScopeIdParameter>]
 [-CustomRecipientWriteScope <ManagementScopeIdParameter>]
 [-Delegating <Boolean>]
 [-DomainController <Fqdn>]
 [-Enabled <Boolean>]
 [-Exclusive <Boolean>]
 [-ExclusiveConfigWriteScope <ManagementScopeIdParameter>]
 [-ExclusiveRecipientWriteScope <ManagementScopeIdParameter>]
 [-GetEffectiveUsers]
 [-RecipientAdministrativeUnitScope <AdministrativeUnitIdParameter>]
 [-RecipientGroupScope <GroupIdParameter>]
 [-RecipientOrganizationalUnitScope <OrganizationalUnitIdParameter>]
 [-RecipientWriteScope <RecipientWriteScopeType>]
 [-RoleAssigneeType <RoleAssigneeType>]
 [-WritableDatabase <DatabaseIdParameter>]
 [-WritableRecipient <GeneralRecipientIdParameter>]
 [-WritableServer <ServerIdParameter>]
 [<CommonParameters>]

RoleAssignee

Get-ManagementRoleAssignment [-AssignmentMethod <AssignmentMethod[]>]
 [-Role <RoleIdParameter>]
 [-ConfigWriteScope <ConfigWriteScopeType>]
 [-CustomConfigWriteScope <ManagementScopeIdParameter>]
 [-CustomRecipientWriteScope <ManagementScopeIdParameter>]
 [-Delegating <Boolean>]
 [-DomainController <Fqdn>]
 [-Enabled <Boolean>]
 [-Exclusive <Boolean>]
 [-ExclusiveConfigWriteScope <ManagementScopeIdParameter>]
 [-ExclusiveRecipientWriteScope <ManagementScopeIdParameter>]
 [-GetEffectiveUsers]
 [-RecipientAdministrativeUnitScope <AdministrativeUnitIdParameter>]
 [-RecipientGroupScope <GroupIdParameter>]
 [-RecipientOrganizationalUnitScope <OrganizationalUnitIdParameter>]
 [-RecipientWriteScope <RecipientWriteScopeType>]
 [-RoleAssignee <RoleAssigneeIdParameter>]
 [-RoleAssigneeType <RoleAssigneeType>]
 [-WritableDatabase <DatabaseIdParameter>]
 [-WritableRecipient <GeneralRecipientIdParameter>]
 [-WritableServer <ServerIdParameter>]
 [<CommonParameters>]

Parameters (22)

Parameter	Type	What it controls
-Identity	RoleAssignmentIdParameter	The Identity parameter specifies the name of the role assignment to retrieve. If the name of the role assignment contains spaces, enclose it in quotation marks ("). If the RoleAssignee parameter is used, you can't...
-AssignmentMethod	AssignmentMethod[]	The AssignmentMethod parameter specifies the type of role assignment to include in the results returned by the cmdlet. You can specify one or more of the following values:
-ConfigWriteScope	ConfigWriteScopeType	The ConfigWriteScope parameter specifies the type of management configuration scope to include in the results returned by the cmdlet. The valid values are None, OrganizationConfig, CustomConfigScope, and ExclusiveConfigScope.
-CustomConfigWriteScope	ManagementScopeIdParameter	This parameter is available only in on-premises Exchange.
-CustomRecipientWriteScope	ManagementScopeIdParameter	The CustomRecipientWriteScope parameter returns only the regular role assignments that include the specified recipient-based regular scope.
-Delegating	Boolean	The Delegating parameter specifies whether delegating or regular role assignments should be returned.
-DomainController	Fqdn	This parameter is available only in on-premises Exchange.
-Enabled	Boolean	The Enabled parameter specifies whether enabled or disabled role assignments should be returned. To return enabled role assignments, specify a value of $true. To return disabled role assignments, specify a value of $false.
-Exclusive	Boolean	The Exclusive parameter specifies whether exclusive or regular role assignments should be returned.
-ExclusiveConfigWriteScope	ManagementScopeIdParameter	This parameter is available only in on-premises Exchange.
-ExclusiveRecipientWriteScope	ManagementScopeIdParameter	The ExclusiveRecipientWriteScope parameter returns only the exclusive role assignments that include the specified recipient-based exclusive scope.
-GetEffectiveUsers	SwitchParameter	The GetEffectiveUsers switch specifies that the command should show the list of users in the role groups, role assignment policies, or USGs that are associated with the role assignment. You don't need to specify a...
-RecipientAdministrativeUnitScope	AdministrativeUnitIdParameter	This parameter is functional only in the cloud-based service.
-RecipientGroupScope	GroupIdParameter	This parameter is available only in the cloud-based service.
-RecipientOrganizationalUnitScope	OrganizationalUnitIdParameter	The RecipientOrganizationalUnitScope parameter returns only the role assignments that include the specified organizational unit (OU). If the OU tree contains spaces, enclose it in quotation marks (").
-RecipientWriteScope	RecipientWriteScopeType	The RecipientWriteScope parameter returns only the role assignments associated with the recipient scope restriction type specified. The valid values are None, MyGAL, Self, OU, CustomRecipientScope,...
-Role	RoleIdParameter	The Role parameter returns only the role assignments associated with the specified management role. If the name of the role contains spaces, enclose it in quotation marks (").
-RoleAssignee	RoleAssigneeIdParameter	The RoleAssignee parameter specifies the role group, assignment policy, user, or universal security group (USG) for which you want to view role assignments. If the RoleAssignee parameter is used, you can't use the...
-RoleAssigneeType	RoleAssigneeType	The RoleAssigneeType parameter specifies the type of role assignee to return. The valid values are User, SecurityGroup, RoleAssignmentPolicy, ForeignSecurityPrincipal, RoleGroup, LinkedRoleGroup and Computer.
-WritableDatabase	DatabaseIdParameter	This parameter is available only in on-premises Exchange.
-WritableRecipient	GeneralRecipientIdParameter	The WritableRecipient parameter specifies the recipient object you want to test to determine which role assignments allow it to be modified. The command takes into account the roles and scopes associated with each...
-WritableServer	ServerIdParameter	This parameter is available only in on-premises Exchange.