Home |  Service Status |  Team Blog |  Forums
Outlook Web App > For Administrators > Assign Roles and Permissions > Administrator Role Groups >
Give Users the Ability to Reset Passwords

Topic Last Modified: 2009-10-06

Wouldn't it be great if you could give help desk personnel permission to reset forgotten passwords without giving them access to other administrative functionality in the Outlook Live organization? You have several options:

  • Add the help desk personnel to the Help Desk role group   By default, the Reset Password role is assigned to the Help Desk role group. But note: the Help Desk role group includes these additional roles:
    • User Options   This role allows users to access the Options page of other users for troubleshooting purposes. Here's how: Access Another User's Options Page
    • View-Only Recipients   This role allows the user to see the configuration of all mailboxes, mail users, mail contacts, groups, and dynamic distribution groups. The help desk personnel can see the object configurations, but they can't modify anything.

If this additional scope works for your organization, you don't have to do anything else.

Too much power?

What if you think that the additional roles give too much power to the help desk personnel? You have these options:

Add the help desk personnel to the Help Desk role group

In the Web management interface:

  1. Select My Organization > Users & Groups > Administrator Roles.
  2. Select the Help Desk role group, and then click Details.
  3. Under Members, click Add.
  4. In the Select Members dialog box, select one or more users. You can search for users by typing all or part of a display name, and then clicking Search icon. You can also sort the list by clicking the Display Name or E-Mail Address column headings.
  5. Click Add.
  6. Click OK to return to the role group page.
  7. Click Save to save the change to the role group.

The new member is displayed under Members in the details pane for the selected role group.

Back to top

Optional Step: Remove the extra roles from the Help Desk role group

You perform this step using Windows PowerShell.

To learn how to install and configure Windows PowerShell and connect to Outlook Live, see Use Windows PowerShell.

Remove the extra roles from the Help Desk role group

Run the following commands after you have connected to the Outlook Live server-side session:

Copy
Remove-ManagementRoleAssignment "User Options-Help Desk" -Confirm:$false
Remove-ManagementRoleAssignment "View-Only Recipients-Help Desk"-Confirm:$false

Note   To assign the removed roles back to the Help Desk role group, run the following commands:

Copy
New-ManagementRoleAssignment -Role "User Options" -SecurityGroup "Help Desk"
New-ManagementRoleAssignment -Role "View-Only Recipients" -SecurityGroup "Help Desk"

Back to top

Assign the Help Desk role to a security group

There are three steps:

  1. Create a security group   Do this using Windows PowerShell.
  2. Assign the Reset Password role to the security group   Do this using Windows PowerShell.
  3. Add users to the security group   You can do this using the Web management interface or using Windows PowerShell.

1. Create a security group

Run the following command after you have connected to the Outlook Live server-side session:

Copy
New-DistributionGroup -Name <Group Name> -Type Security

For example, to create a security group named "Password Resets", run the following command:

Copy
New-DistributionGroup -Name "Password Resets" -Type Security

2. Assign the Reset Password role to the security group

Run the following command after you have connected to the Outlook Live server-side session:

Copy
New-ManagementRoleAssignment -Role "Reset Password" -SecurityGroup <security group>

For example, to assign the "Reset Password" role to the security group named "Password Resets", run the following command:

Copy
New-ManagementRoleAssignment -Role "Reset Password" -SecurityGroup "Password Resets"

3. Add users to the security group

You can use the Web management interface or Windows PowerShell. After the users are added to the group, they can reset users' passwords.

Using the Web management interface

  1. Select My Organization > Users & Groups > Public Groups.
  2. In the Groups list, select the group and click Details.
  3. In the Membership section, click Add.
  4. In the Select Members page, select the users you want to add. When you are finished, click OK.
  5. On the Group page, click Save.

Using Windows PowerShell

Run the following command after you have connected to the Outlook Live server-side session:

Copy
Add-DistributionGroupMember <security group> -Member <user>

For example, to add the user "Ayla Kol" to the security group "Password Resets", run the following command:

Copy
Add-DistributionGroupMember "Password Resets" -Member "Ayla Kol"

Note   You can use the Update-DistributionGroupMember cmdlet with the Members parameter to specify multiple users separated by commas. However, the list of users you specify overwrites the current members of the security group.

Back to top

Next steps

Page view tracker