{"id":7597,"date":"2023-05-15T12:16:33","date_gmt":"2023-05-15T10:16:33","guid":{"rendered":"https:\/\/www.teal-consulting.de\/?p=7597"},"modified":"2023-05-16T16:56:44","modified_gmt":"2023-05-16T14:56:44","slug":"exchange-split-permission","status":"publish","type":"post","link":"https:\/\/www.teal-consulting.de\/en\/2023\/05\/15\/exchange-split-permission\/","title":{"rendered":"Exchange Split Permission – AD permissions and processes"},"content":{"rendered":"
[vc_row css_animation=”” row_type=”row” use_row_as_full_screen_section=”no” type=”full_width” angled_section=”no” text_align=”left” background_image_as_pattern=”without_pattern”][vc_column][vc_empty_space height=”30″][vc_row_inner row_type=”row” type=”full_width” text_align=”left” css_animation=””][vc_column_inner][vc_column_text][\/vc_column_text][vc_empty_space height=”20″][vc_column_text]If you deal with the topic of tiering, sooner or later you will come across the topic of Exchange. Exchange is known to have (too) extensive permissions in the Active Directory.<\/p>\n

Even though Microsoft reduced the permissions in Shared Permission Mode via an update after the publication<\/a> of Dirk-Jan’s research, the generally accepted solution remains the introduction of AD Split Permission Mode.<\/p>\n

Microsoft makes some comments about this in their documentation (here<\/a> and here<\/a>) with the prominent warning:[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][vc_empty_space height=”10″][vc_column_text css=”.vc_custom_1684248146080{margin-top: 20px !important;margin-right: 20px !important;margin-bottom: 20px !important;margin-left: 20px !important;}”]\"\"[\/vc_column_text][vc_empty_space height=”10″][vc_column_text]At least the part with the security principles is exactly what you want to achieve, but the rest of the warning also discourages many from implementing AD Split Permission Mode.<\/p>\n

Surprisingly, Microsoft does not provide specific instructions on how to manage the different mailboxes and Exchange objects in AD Split Permission Mode, and there are only a few on the web (e.g. here<\/a>). Therefore, in this blog post we want to discuss what permissions are needed on the AD side and what a workflow might look like to create the objects.<\/p>\n

We deliberately do not make a detailed proposal for the OU structure and concrete permissions delegation, because the processes in each company are different, e.g. in company A the Exchange team manages the members of the distribution lists, in company B this is done by the first level support. However, we recommend creating a separate OU for each object type at an appropriate point in the tiering structure to be able to delegate rights granularly.<\/p>\n

Again, the disclaimer that we are not Exchange admins, so some of the nuances of Exchange administration may not be familiar to us.<\/p>\n

The examples below are from an on-prem Exchange environment, but will work in a hybrid environment with minimal adjustments.[\/vc_column_text][\/vc_column][\/vc_row][vc_row css_animation=”” row_type=”row” use_row_as_full_screen_section=”no” type=”full_width” angled_section=”no” text_align=”left” background_image_as_pattern=”without_pattern”][vc_column][vc_empty_space height=”50″][vc_row_inner row_type=”row” type=”full_width” text_align=”left” css_animation=””][vc_column_inner][vc_column_text]\n

Exchange Objects<\/h2>\n[\/vc_column_text][vc_empty_space height=”30″][vc_column_text]In the context of AD permissions, the lifecycles of the following (Exchange) objects are relevant:<\/p>\n