Created by Claude - please verify

Exchange RBAC - role groups, members and direct assignments of Mailbox Import Export, Mailbox Search and Role Management.

Required Microsoft Graph permissions

Exchange.ManageAsApp (+ View-Only Organization Management) — application permission, granted to the app registration with admin consent.

Licence: None.

Endpoints: Get-RoleGroup · Get-RoleGroupMember · Get-ManagementRoleAssignment -Role 'Mailbox Import Export' / 'Mailbox Search' / 'Role Management'

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Exchange Admin Role Groups & High-risk Roles

Exchange has its own admin roles, invisible to every Entra role report. Members of Organization Management can grant themselves anything; anyone holding Mailbox Import Export can export any mailbox to a PST, and Mailbox Search can search every mailbox. Direct assignments outside role groups are listed separately because reviews usually miss them.