How to list admin role group members in Exchange Online

Before you start

Use an account that can read role assignments. Microsoft lists Organization Management for role assignments in Exchange Online and says members of View-Only Management can view their configuration. Changing a role group needs the Role Management role, which Organization Management holds by default.

Know where admin rights come from. A role group gives its members the management roles assigned to it. Several Microsoft Entra roles map to role groups: Microsoft lists Global Administrator and Exchange Administrator as Organization Management, Global Reader as View-Only Organization Management and Exchange Recipient Administrator as Recipient Management. The examples read and export; they add or remove no member and change no role group.

Option 1

List admin role group members with PowerShell

Install the module once, then connect and export 1 row for each member of each role group.

# Install once, if the module is not already installed.
Install-Module ExchangeOnlineManagement -Scope CurrentUser

$ErrorActionPreference = 'Stop'
Connect-ExchangeOnline -ShowBanner:$false
try {
    $groups = @(Get-RoleGroup -ResultSize Unlimited)
    $report = @(foreach ($group in $groups) {
        foreach ($member in Get-RoleGroupMember -Identity $group.Name -ResultSize Unlimited) {
            [pscustomobject]@{
                RoleGroup = $group.Name
                Member = $member.Name
                DisplayName = $member.DisplayName
                Address = "$($member.PrimarySmtpAddress)"
                Type = "$($member.RecipientTypeDetails)"
                Roles = ($group.Roles -join '; ')
            }
        }
    })
    if ($report.Count -eq 0) {
        Write-Output "None of the $($groups.Count) role groups has a member."
    } else {
        $report | Sort-Object RoleGroup, Member |
            Export-Csv -Path './exchange-role-group-members.csv' -NoTypeInformation -Encoding utf8
        Write-Output "$($report.Count) members of $($groups.Count) role groups exported."
    }
} finally {
    Disconnect-ExchangeOnline -Confirm:$false
}

The CSV has 1 row for each role group and member, with the group's roles beside it. A member can be a user, a mail-enabled security group or another role group, so a group in the list gives the same rights to everyone in it.

List the role groups 1 person belongs to

Reconnect with Connect-ExchangeOnline, then filter role groups by the person's distinguished name, as Microsoft's example does.

# Run while connected to Exchange Online. Replace the example account.
$dn = (Get-User -Identity 'person@example.com').DistinguishedName -replace "'", "''"
Get-RoleGroup -Filter "Members -eq '$dn'" | Select-Object Name, Description

Option 2

Review role groups in the admin centre

1. Sign in to the Exchange admin centre for the correct tenant.
2. Go to Roles > Admin roles, which lists every built-in and custom role group with its description.
3. Select a role group by its name. The General tab shows Managed by and Write scope, and the Assigned tab lists its members.
4. Close the pane without choosing Add, Delete or Edit basics, so nothing changes.

This suits checking 1 role group. It does not suit a review of every group, since the admin centre shows the members of 1 group at a time and offers no export of them.

Common questions

Why is a Global Administrator not listed by name?

Microsoft adds a group named TenantAdmins_ followed by a number to Organization Management, and Global Administrators are its members through Microsoft Entra ID. Its membership can't be changed in Exchange. To see who holds the Entra roles, see how to list admin role assignments in Microsoft Entra ID.

Can I change the roles of a built-in role group?

Microsoft says not to. Copy the built-in role group and change the copy, or create a custom role group. Built-in role groups can't be removed or renamed.

Why does a member added today not have the rights yet?

Microsoft says people may have to sign out and sign in again before a change to their role group membership takes effect.