Exchange Admin Roles
Find Exchange admin roles and the recorded Audit Log Viewers role for Search-UnifiedAuditLog. The assignment notes include a historical permission issue, not a confirmed current access procedure.
Source-derived reference
These notes were recovered from OneNote. Configuration, permissions and operating results have not been freshly verified. Confirm the applicable authority and environment before acting.
Admin Role
You can find the list of all adminRole at
https://admin.cloud.microsoft/exchange -> Expand Roles -> Click Admin roles Which will open up https://admin.cloud.microsoft/exchange#/adminRoles
Screenshot retained for review
About Role: Audit Log Viewers
Created By: Jason Treadwell created an Admin role called "Audit Log Viewers".
WHY?: This role was created to allow the use of Search-UnifiedAuditLog in powershell.
Roles Applied: View-Only Audit Logs
Audit Log Viewers - Search-UnifiedAuditLog
Search-UnifiedAuditLog in powershell requires you to be a member of "Audit Log Viewers".
See a list of built-in roles with this permission run the following in powershell:
Connect-ExchangeOnlineGet-ManagementRoleEntry "*\Search-UnifiedAuditLog" | Select-Object -ExpandProperty Role -UniqueOUTPUT as at 13Mar2026
Information Protection Investigator
Information Protection Analyst
Audit Logs
View-Only Audit Logs
Audit Log Views Role - Assign User To Role
Permissions Required: This step requires "Global Administrator or Privileged Role Administrator" NOTE: Jason Treadwell struggled to get this to work with Global Administrator, used "Privileged Role Administrator" instead.
- Goto: https://admin.cloud.microsoft/exchange#/adminRoles
- Search for "Audit Log"
- Click on "Audit Log Viewers"
Screenshot retained for review
- Click the "Assigned" tab (as per screenshot below)
- Press the Add button If you do not have the correct permissions the add button will be missing from the below.
Screenshot retained for review