In many organizations, there are separate administrators for Exchange and Active Directory, which leads to a need to delegate administrative functions, so that distinct boundaries of administrative rights are maintained. In this type of model, known as a split permissions model, operations are decentralized in that two or more operation teams manage aspects of Exchange and Active Directory. For example, one operations team might manage domain and forest functions, while another operations team manages Exchange-related functions. In these situations, certain rights must be delegated to all personnel so that they may complete their job functions without compromising the operational and security boundaries.

This guide discusses the necessary minimum rights needed for Exchange administrators to manage Exchange-related data in Active Directory as it pertains to user, inetOrgPerson, group, and contact objects so that separation of administrative tasks can be implemented. Further, this document is a reference guide for administrators implementing a split permissions model.