---
title: Minimum Permissions required to Manage AD Contacts
slug: minimum-permissions-required-to-manage-ad-contacts
createdAt: 2025-07-28T03:38:52.933Z
---

The Activate Orchestrator (Job) Service, service account will need the following permissions in Exchange and on the OU(s) where Contacts reside within Active Directory.

# Permissions required

## Create and Update

:::Heading{depth="3" indent="1"}
Grant to:
:::

- Activate Orchestrator service account.
  See Recommendation below

:::Heading{depth="3" indent="1"}
Grant in:
:::

- On-premise Exchange

:::Heading{depth="3" indent="1"}
Rights:
:::

- Recipient Management role

:::Heading{depth="3" indent="1"}
Grant on:
:::

- OU and all descendant objects

:::Heading{depth="3" indent="1"}
Rights:
:::

- List contents
- Read all properties
- Write all properties
- Read permissions

## Delete

:::Heading{depth="3" indent="1"}
Grant to:
:::

- Activate Orchestrator service account.

:::Heading{depth="3" indent="1"}
Grant on:
:::

- OU and all descendant objects

:::Heading{depth="3" indent="1"}
Rights:
:::

- Read
- Write
- Create all child objects
- Delete all child objects

## Recommendation

To grant these permissions it is recommended to:

- Create a group in an OU that only the Activate Orchestrator service account can write to.
  See KB Minimum permissions required for the Services Manager module for the rights required on the OU.
- Assign rights listed above to the group
- Create a Service that adds users to the group
  Ensure that a team with appropriate training to understand the access being requested are approvers for the service.
- Order the service for the Orchestrator service account

### Notes:

- If possible, remove permissions for users other than the Activate Orchestrator service account to manage objects in the OU(s).