This also applies to Skype for Business Server Control Panel.įor example, an Archiving Administrator cannot disable a user by using Skype for Business Server Control Panel because Skype for Business Server Control Panel abides by RBAC roles. If the user tries to run the Disable-CsUser cmdlet, that command will fail because users assigned the hypothetical role do not have the right to run the Disable-CsUser cmdlet.

The preceding list represents the only cmdlets that a user assigned a hypothetical RBAC role is allowed to run in a remote Windows PowerShell command-line interface session. In turn, the rights granted to an RBAC role are based on the cmdlets assigned to that role (cmdlets can be assigned to multiple RBAC roles).įor example, suppose a role has been assigned the following cmdlets: These universal security groups have a one-to-one correspondence with RBAC roles, which means that any user who is in the CsArchivingAdministrator security group has all the rights granted to the CsArchivingAdministrator RBAC role. When you install Skype for Business Server, a number of universal security groups, such as CsAdministrator, CsArchivingAdministrator and CsViewOnlyAdministrator, are created for you. The Skype for Business Server implementation of RBAC is based on two key elements: Active Directory security groups and Windows PowerShell cmdlets. In addition, these rights can be limited in scope: someone can be given the right to manage Enterprise Voice, but only in the Redmond site someone else can be given the right to manage users, but only if those user accounts are in the Finance organizational unit (OU). RBAC enables administrators to delegate control of specific management tasks in Skype for Business Server.įor example, instead of granting your organization's help desk full administrator privileges you can give these employees very specific rights: the right to manage only user accounts the right to manage only Enterprise Voice components the right to manage only archiving and Archiving Server. This cmdlet was introduced in Lync Server 2010. RBAC roles are used to specify the management tasks that users are allowed to carry out and to determine the scope in which users will be allowed to perform these tasks.

Modifies an existing role-based access control (RBAC) role.

Disable skype for business