The default manage level is applied if you create user accounts using automatic employee assignment. You can change a user account manage level later.
To change the manage level for a user account
In the Manager, select the SharePoint Online > User accounts (user authenticated) category.
Select the user account in the result list.
Select the Change main data task.
Select the manage level in the Manage level list on the General tab.
An account definition can be subsequently assigned to user accounts with Linked status. This may be necessary, for example, if:
Employees and user accounts were linked manually
Automatic employee assignment is configured, but when a user account is inserted, no account definition is assigned in the SharePoint Online system.
To manage user accounts through account definitions
Create an account definition.
Assign a user account in the Linked state to the account definition. The account definition's default manage level is applied to the user account.
In the Manager, select the SharePoint Online > User accounts (user authenticated) > Linked but not configured > Site collection> category.
Select the Assign account definition to linked accounts task.
In the Account definition menu, select the account definition.
Select the user accounts that contain the account definition.
Save the changes.
An employee can be linked to multiple SharePoint Online user accounts, for example, so that you can assign an administrative user account in addition to the default user account. One employee can also use default user accounts with different types.
NOTE: To enable working with identities for user accounts, the employees also need identities. You can only link user accounts to which an identity is assigned with employees who have this same identity.
To manually assign user accounts to an employee
In the Manager, select the Employees > Employees category.
Select the employee in the result list and run the Assign SharePoint Online user accounts task.
Assign the user accounts.
Set up guest access to a site collection with read-only permissions. To do this, a SharePoint Online user account is added. The Azure Active Directory Guests group is assigned as authentication object to the user account. Clara Harris owns an Azure Active Directory user account, which is a member in this group. She can log in to the site collection with this and obtain all the SharePoint Online user account's permissions.
Jan Bloggs is also requires guest access to the site collection. He owns an Azure Active Directory user account in the same domain. In the Web Portal, he requests membership of the Azure Active Directory Guests group. Once the request is granted approval and assigned, he can log in on the site collection.
SharePoint Online access permissions are supplied in different ways in the One Identity Manager, depending on the referenced authentication object.
The user account represents an Azure Active Directory group. This group can be assigned in the One Identity Manager as authentication object.
The user account cannot be assigned to an employee. This means, the user account can only become a member in SharePoint Online roles and groups through direct assignment.
Before an employee can log in to the SharePoint Online system, they require an Azure Active Directory user account. This user account must be a member of the Azure Active Directory group that is used as an authentication object.
A new SharePoint Online user account can be created manually.
The user account cannot be managed through an account definition.
The user account represents an Azure Active Directory user account. The user account is not assigned as an authentication object in One Identity Manager.
The SharePoint Online user account can be assigned to an employee. This means that the user account can become a member in SharePoint Onlineroles and groups through inheritance and direct assignment.
If an authentication object is assigned, the connected employee is found through the authentication object.
If there is no authentication object assigned, the employee can be assigned automatically or manually. Automatic employee assignment depends on the TargetSystem | SharePointOnline | PersonAutoFullsync and TargetSystem | SharePointOnline | PersonAutoDefault configuration parameters.
A new SharePoint Online user account can be manually created or by using an account definition. The Azure Active Directory user account used as the authentication object must belong to a domain trusted by the referenced authentication system.
The user account can be managed through an account definition.
For more information about employee handling and administration, see the One Identity Manager Target System Base Module Administration Guide.
© 2024 One Identity LLC. ALL RIGHTS RESERVED. Conditions d’utilisation Confidentialité Cookie Preference Center
