Trouble using RBAC to change passwords and distribution groups

[Mulan]

We are currently hosting email for a lot of school . We are currently running on an OU for each one district and we need a local district tech coordinator to handle as much of there own system as it can be accomplished. At least as much as they can perform via the ECP. There are three large management problems are configuring the user passwords, distribution group membership and building another distribution groups. Each one user can be able to configure their own passwords but we need the tech coordinator to be capable to reconfigure their passwords also. Over the summer, there are so many teachers will forget their passwords or the passwords will be dead now . So we need the local user to manage the operation of those resets.

I am trying to provide them as much as can be done . Microsoft's TechNet site present ResetPassword as the ManagementRole but when I go for doing a get-managementrole, it is not listed there ! At last, it is possible yet to facilitate them to make or remove a user and mailbox via the ECP?

[Jeffrey]

I found something which points this very problem and states that ECP does not manage RBAC administrator scopes in fine way. If an administrator has been configured up to only be facilitated to modify a section of the organization's users, the Mailboxes UI slab becomes Read-Only and the administrator is unable to modify the mailbox features" I guess that it is also compatible with the distribution groups. And this is the demonstration using Role Assignment Policy .

1, Make a custom Role Assignment Policy

2, Associate the MyBaseOptions, MyDistributionGroups role with the policy.

3, Configure the local district techs mailbox with the help of custom Role Assignment Policy.

[Mastermind]

1) According to me the proper and feasible method to go for the password trick is from AD, you can delegate over very OU the administrator account to reconfigure the password and it will be assumes as the quick and simple in this way.

2) I think, that new one user trick is in SP1.

One more thing, I wanted to say here , have you also made the Management Role Assignments and allocated the associated users in this section ? As far as reconfiguring the Password moves, it is within the cloud version but currently not in the on-premise version .

[Mulan]

Thanks for the suggestion here , I a agree with you , delegating control in AD specified as the option there . I was just thinking that I could have them perform all of things via the ECP and have them out of AD properly . There maybe , I am over simplifying the complete RBAC system...but I have made a Role Group (with those entire Roles allocated ) and I used the Members move to associate the members to the selected Role Group. Is not that allocation enough? If the Role Group contains the power assigned by the Roles and the group contains the members, do I still require to made the Management Role Assignment?

It amazes me Microsoft would not reconfigure the Password assigned . That is only the most common causes for help desk calls!