To better understand how permissioning and access works, it's important to understand the relationship between members, roles and role groups. So let's briefly touch on these relationships. 

A role is used to grant permissions that allow a user to perform a specific set of tasks. A typical use case here would be a situation where you assign the Case Management role to a user that needs to work with eDiscovery cases. A role group, however, is a set of roles. You use a role group to allow people to perform their jobs within the Security and Compliance Center. For example, a user who is a member of the Compliance Administrator role group will be assigned the roles that included in that role group. In this case, the user would be assigned the roles of Case Management, Content Search, Organization Configuration and a few others because a user who functions as a compliance admin is going to need these permissions for those tasks to do their job. 

The Security and Compliance Center includes default role groups for the most common tasks and functions that you'll need to assign users to. Microsoft recommends that you grant necessary access by adding users as members to the default role groups they're provided. It's important to note that while you can edit or delete existing role groups, it's not recommended by Microsoft. Instead of editing a default role group, what you should if necessary, is copy the group, modify it and then save it with a different name.