Set-ManagementRoleAssignment — usage, script and reference

Quick start script

# Set-ManagementRoleAssignment — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-ExchangeOnline -CertificateThumbprint $thumb -AppId $appId -Organization $org

# 2. Capture the current state first — you cannot roll back what you never recorded
$before = Get-ManagementRoleAssignment
$before | Format-List

# 3. Make the change (dry run first)
Set-ManagementRoleAssignment -Identity <RoleAssignmentIdParameter> -RecipientAdministrativeUnitScope <AdministrativeUnitIdParameter> -RecipientGroupScope <GroupIdParameter> -WhatIf
Set-ManagementRoleAssignment -Identity <RoleAssignmentIdParameter> -RecipientAdministrativeUnitScope <AdministrativeUnitIdParameter> -RecipientGroupScope <GroupIdParameter>

# 4. Verify and diff
$after = Get-ManagementRoleAssignment
Compare-Object ($before | Out-String) ($after | Out-String)

Syntax — 7 parameter sets

RelativeRecipientWriteScope

Set-ManagementRoleAssignment [-Identity] <RoleAssignmentIdParameter> [-RecipientRelativeWriteScope <RecipientWriteScopeType>]
 [-Confirm]
 [-CustomConfigWriteScope <ManagementScopeIdParameter>]
 [-DomainController <Fqdn>]
 [-Enabled <Boolean>]
 [-Force]
 [-WhatIf]
 [<CommonParameters>]

CustomRecipientWriteScope

Set-ManagementRoleAssignment [-Identity] <RoleAssignmentIdParameter> [-CustomConfigWriteScope <ManagementScopeIdParameter>]
 [-Confirm]
 [-CustomRecipientWriteScope <ManagementScopeIdParameter>]
 [-DomainController <Fqdn>]
 [-Enabled <Boolean>]
 [-Force]
 [-WhatIf]
 [<CommonParameters>]

RecipientOrganizationalUnitScope

Set-ManagementRoleAssignment [-Identity] <RoleAssignmentIdParameter> [-RecipientOrganizationalUnitScope <OrganizationalUnitIdParameter>]
 [-Confirm]
 [-CustomConfigWriteScope <ManagementScopeIdParameter>]
 [-DomainController <Fqdn>]
 [-Enabled <Boolean>]
 [-Force]
 [-WhatIf]
 [<CommonParameters>]

ExclusiveScope

Set-ManagementRoleAssignment [-Identity] <RoleAssignmentIdParameter> [-ExclusiveConfigWriteScope <ManagementScopeIdParameter>] [-ExclusiveRecipientWriteScope <ManagementScopeIdParameter>]
 [-Confirm]
 [-DomainController <Fqdn>]
 [-Enabled <Boolean>]
 [-Force]
 [-WhatIf]
 [<CommonParameters>]

3 more parameter sets — see the parameter table below.

Parameters (15)

Parameter	Type	Required	What it controls
-Identity	RoleAssignmentIdParameter	yes	The Identity parameter specifies the name of the management role assignment to modify. If the name of the management role contains spaces, enclose it in quotation marks (").
-RecipientAdministrativeUnitScope	AdministrativeUnitIdParameter	yes	This parameter is functional only in the cloud-based service.
-RecipientGroupScope	GroupIdParameter	yes	This parameter is available only in the cloud-based service.
-Confirm	SwitchParameter		The Confirm switch specifies whether to show or hide the confirmation prompt. How this switch affects the cmdlet depends on whether the cmdlet requires confirmation before proceeding.
-CustomConfigWriteScope	ManagementScopeIdParameter		This parameter is available only in on-premises Exchange.
-CustomRecipientWriteScope	ManagementScopeIdParameter		The CustomRecipientWriteScope parameter specifies the existing recipient-based management scope to associate with this management role assignment. If the management scope name contains spaces, enclose it in quotation...
-CustomResourceScope	ManagementScopeIdParameter		This parameter is available only in the cloud-based service.
-DomainController	Fqdn		This parameter is available only in on-premises Exchange.
-Enabled	Boolean		The Enabled parameter specifies whether the management role assignment is enabled or disabled. The valid values are $true and $false.
-ExclusiveConfigWriteScope	ManagementScopeIdParameter		This parameter is available only in on-premises Exchange.
-ExclusiveRecipientWriteScope	ManagementScopeIdParameter		The ExclusiveRecipientWriteScope parameter specifies the existing recipient-based exclusive management scope to associate with this management role assignment. If the management scope name contains spaces, enclose it...
-Force	SwitchParameter		This parameter is available only in the cloud-based service.
-RecipientOrganizationalUnitScope	OrganizationalUnitIdParameter		The RecipientOrganizationalUnitScope parameter specifies the OU to scope the new role assignment to. If the OU name contains spaces, enclose the domain and OU in quotation marks (").
-RecipientRelativeWriteScope	RecipientWriteScopeType		The RecipientRelativeWriteScope parameter specifies the type of restriction to apply to a recipient scope.
-WhatIf	SwitchParameter		The WhatIf switch shows what the command does without making any changes. You don't need to specify a value with this switch.