Microsoft Entra ID · M365 Workloads & Services
Exchange Backup Administrator
Backs up and restores content including granular restore for Exchange Online in Microsoft 365 Backup.
Scope: Microsoft 365 Backup administration for Exchange Online
Permissions
- Create Exchange backup policies
- Perform mailbox restores
- Manage Exchange protection
- Granular item restore
- View restore points
Common use cases
- Mailbox disaster recovery
- Item-level restoration
- Backup policy management
- Compliance preservation
Best practices
- Test restore procedures
- Document backup scope
- Monitor backup jobs
Security considerations
- Can restore deleted mail
- Access to backup metadata
Common questions
When should I assign the Exchange Backup Administrator role?
Assign Exchange Backup Administrator when you need to: Mailbox disaster recovery; Item-level restoration; Backup policy management; and Compliance preservation. It is part of Microsoft Entra ID and should be granted as a least-privilege alternative to broader roles like Global Administrator.
What can someone with the Exchange Backup Administrator role do?
The Exchange Backup Administrator role grants permissions including: Create Exchange backup policies; Perform mailbox restores; Manage Exchange protection; Granular item restore; and View restore points. See the Permissions section above for the full list.
What are the security risks of the Exchange Backup Administrator role?
Key considerations when assigning Exchange Backup Administrator: Can restore deleted mail; and Access to backup metadata. Review the Security considerations section before assignment, and pair with Privileged Identity Management (PIM) for just-in-time access where possible.