Exchange Online · Recipient Management
Recipient Management
Members have administrative access to create or modify Exchange Online recipients within the organization. Ideal for delegated administration of mailboxes and groups.
Scope: All recipient objects in Exchange Online
Permissions
- Distribution Groups - Create and manage distribution groups and mail-enabled security groups
- Mail Recipient Creation - Create mail users and mail contacts
- Mail Recipients - Modify existing mail users and mail contacts
- Message Tracking - Track message delivery
- Migration - Migrate mailboxes and content
- Move Mailboxes - Move mailbox operations
- Recipient Policies - Manage authentication, encryption, and OWA policies
- Reset Password - Reset mailbox passwords
Common use cases
- User provisioning and deprovisioning
- Group management for email distribution
- Mailbox configuration and maintenance
- Large organizations with dedicated recipient managers
Best practices
- Use for dedicated user management staff
- Combine with Help Desk for comprehensive support
- Implement approval workflows for mailbox creation
- Consider Exchange Recipient Administrator Entra role
Security considerations
- Can create and delete mailboxes
- Can reset mailbox passwords
- Can modify mailbox permissions and delegation
Common questions
When should I assign the Recipient Management role?
Assign Recipient Management when you need to: User provisioning and deprovisioning; Group management for email distribution; Mailbox configuration and maintenance; and Large organizations with dedicated recipient managers. It is part of Exchange Online and should be granted as a least-privilege alternative to broader roles like Global Administrator.
What can someone with the Recipient Management role do?
The Recipient Management role grants permissions including: Distribution Groups - Create and manage distribution groups and mail-enabled security groups; Mail Recipient Creation - Create mail users and mail contacts; Mail Recipients - Modify existing mail users and mail contacts; Message Tracking - Track message delivery; Migration - Migrate mailboxes and content; and Move Mailboxes - Move mailbox operations. See the Permissions section above for the full list.
What are the security risks of the Recipient Management role?
Key considerations when assigning Recipient Management: Can create and delete mailboxes; Can reset mailbox passwords; and Can modify mailbox permissions and delegation. Review the Security considerations section before assignment, and pair with Privileged Identity Management (PIM) for just-in-time access where possible.