I want to stop the students from creating distribution lists, changing their display name etc. I've gone into Roles & Auditing>User Roles> and created a role there with the stuff I want to lock down unticked, but I don't know how to apply that to the students other than going to their mailbox individually and changing their role assignment policy in mailbox settings. I could change the default assignment but then everyone would be locked down.