Microsoft Entra ID · M365 Workloads & Services
Exchange Recipient Administrator
Creates or updates Exchange Online recipients within the Exchange Online organization.
Scope: Exchange Online recipient management without full Exchange admin access
Permissions
- Create mailboxes
- Update recipient properties
- Manage distribution groups
- Configure mail contacts
- Manage resource mailboxes
Common use cases
- User mailbox provisioning
- Distribution list management
- Resource mailbox setup
- Mail contact management
Best practices
- Use for day-to-day recipient tasks
- Document recipient changes
- Follow naming conventions
Security considerations
- Cannot access mailbox content
- Limited to recipient objects
Common questions
When should I assign the Exchange Recipient Administrator role?
Assign Exchange Recipient Administrator when you need to: User mailbox provisioning; Distribution list management; Resource mailbox setup; and Mail contact management. It is part of Microsoft Entra ID and should be granted as a least-privilege alternative to broader roles like Global Administrator.
What can someone with the Exchange Recipient Administrator role do?
The Exchange Recipient Administrator role grants permissions including: Create mailboxes; Update recipient properties; Manage distribution groups; Configure mail contacts; and Manage resource mailboxes. See the Permissions section above for the full list.
What are the security risks of the Exchange Recipient Administrator role?
Key considerations when assigning Exchange Recipient Administrator: Cannot access mailbox content; and Limited to recipient objects. Review the Security considerations section before assignment, and pair with Privileged Identity Management (PIM) for just-in-time access where possible.