Commands › Exchange Online

Set-RoleGroup

Exchange Online ExchangeOnlineManagement Set-*

Modify who can add or remove members to or from management role groups or change the name of the role group.

Quick start script

# Set-RoleGroup — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-ExchangeOnline -CertificateThumbprint $thumb -AppId $appId -Organization $org

# 2. Capture the current state first — you cannot roll back what you never recorded
$before = Get-RoleGroup
$before | Format-List

# 3. Make the change (dry run first)
Set-RoleGroup -Identity <RoleGroupIdParameter> -LinkedDomainController <String> -LinkedForeignGroup <UniversalSecurityGroupIdParameter> -WhatIf
Set-RoleGroup -Identity <RoleGroupIdParameter> -LinkedDomainController <String> -LinkedForeignGroup <UniversalSecurityGroupIdParameter>

# 4. Verify and diff
$after = Get-RoleGroup
Compare-Object ($before | Out-String) ($after | Out-String)

Syntax — 2 parameter sets

CrossForest

Set-RoleGroup [-Identity] <RoleGroupIdParameter> -LinkedDomainController <String> -LinkedForeignGroup <UniversalSecurityGroupIdParameter>
 [-LinkedCredential <PSCredential>]
 [-BypassSecurityGroupManagerCheck]
 [-Confirm]
 [-Description <String>]
 [-DisplayName <String>]
 [-DomainController <Fqdn>]
 [-ManagedBy <MultiValuedProperty>]
 [-Name <String>]
 [-WhatIf]
 [<CommonParameters>]

Default

Set-RoleGroup [-Identity] <RoleGroupIdParameter>
 [-Force]
 [-BypassSecurityGroupManagerCheck]
 [-Confirm]
 [-Description <String>]
 [-DisplayName <String>]
 [-ManagedBy <MultiValuedProperty>]
 [-Name <String>]
 [-WellKnownObject <String>]
 [-WhatIf]
 [<CommonParameters>]

Parameters (14)

Parameter	Type	Required	What it controls
-Identity	RoleGroupIdParameter	yes	The Identity parameter specifies the name of the role group to modify. If the name contains spaces, enclose the name in quotation marks (").
-LinkedDomainController	String	yes	This parameter is available only in on-premises Exchange.
-LinkedForeignGroup	UniversalSecurityGroupIdParameter	yes	This parameter is available only in on-premises Exchange.
-BypassSecurityGroupManagerCheck	SwitchParameter		The BypassSecurityGroupManagerCheck switch specifies whether to allow a user who isn't an owner of the group to modify or delete the group. You don't need to specify a value with this switch.
-Confirm	SwitchParameter		The Confirm switch specifies whether to show or hide the confirmation prompt. How this switch affects the cmdlet depends on whether the cmdlet requires confirmation before proceeding.
-Description	String		The Description parameter specifies the description displayed when the role group is viewed using the Get-RoleGroup cmdlet. Enclose the description in quotation marks (").
-DisplayName	String		The DisplayName parameter specifies the friendly name of the role group. If the name contains spaces, enclose the name in quotation marks ("). This parameter has a maximum length of 256 characters.
-DomainController	Fqdn		This parameter is available only in on-premises Exchange.
-Force	SwitchParameter		This parameter is available only in the cloud-based service.
-LinkedCredential	PSCredential		This parameter is available only in on-premises Exchange.
-ManagedBy	MultiValuedProperty		The ManagedBy parameter specifies the users or USG who can modify the configuration of a role group or add or remove members to or from a role group. The list you specify with this parameter overwrites the existing...
-Name	String		The Name parameter specifies the name of the role group. The name can contain up to 64 characters. If the name contains spaces, enclose the name in quotation marks (").
-WellKnownObject	String		This parameter is available only in the cloud-based service.
-WhatIf	SwitchParameter		The WhatIf switch doesn't work in Security & Compliance PowerShell.

Reference facts derived from Microsoft documentation, © Microsoft, licensed CC BY 4.0; restructured with original guidance by serv365.ai.