サポートと今すぐチャット
サポートとのチャット

Identity Manager 8.2.1 - Administration Guide for Connecting to SharePoint Online

Mapping a SharePoint Online environment in One Identity Manager Synchronizing a SharePoint Online environment
Setting up initial synchronization with a SharePoint Online tenant SharePoint Online synchronization features Customizing the synchronization configuration Running synchronization Tasks following synchronization Troubleshooting Ignoring data error in synchronization
Managing SharePoint Online user accounts and employees Managing the assignments of SharePoint Online groups and roles Mapping of SharePoint Online objects in One Identity Manager
SharePoint Online tenants SharePoint Online user accounts SharePoint Online groups SharePoint Online permission levels SharePoint Online site collections SharePoint Online sites SharePoint Online roles Setting up SharePoint Online site collections and sites Reports about SharePoint Online objects
Handling of SharePoint Online objects in the Web Portal Basic data for managing a SharePoint Online environment Troubleshooting an SharePoint Online connection Configuration parameters for managing SharePoint Online Default project template for SharePoint Online Editing system objects

Changing manage levels for SharePoint Online user accounts

The default manage level is applied if you create user accounts using automatic employee assignment. You can change a user account manage level later.

To change the manage level for a user account

  1. In the Manager, select the SharePoint Online > User accounts (user authenticated) category.

  2. Select the user account in the result list.

  3. Select the Change main data task.

  4. Select the manage level in the Manage level list on the General tab.

  5. Save the changes.

Assigning account definitions to linked SharePoint Online user accounts

An account definition can be subsequently assigned to user accounts with Linked status. This may be necessary, for example, if:

  • Employees and user accounts were linked manually

  • Automatic employee assignment is configured, but when a user account is inserted, no account definition is assigned in the SharePoint Online system.

To manage user accounts through account definitions

  1. Create an account definition.

  2. Assign an account definition to the site collection.

  3. Assign a user account in the Linked state to the account definition. The account definition's default manage level is applied to the user account.

    1. In the Manager, select the SharePoint Online > User accounts (user authenticated) > Linked but not configured > Site collection> category.

    2. Select the Assign account definition to linked accounts task.

    3. In the Account definition menu, select the account definition.

    4. Select the user accounts that contain the account definition.

    5. Save the changes.

Detailed information about this topic

Manually linking employees to SharePoint Online user accounts

An employee can be linked to multiple SharePoint Online user accounts, for example, so that you can assign an administrative user account in addition to the default user account. One employee can also use default user accounts with different types.

NOTE: To enable working with identities for user accounts, the employees also need identities. You can only link user accounts to which an identity is assigned with employees who have this same identity.

To manually assign user accounts to an employee

  1. In the Manager, select the Employees > Employees category.

  2. Select the employee in the result list and run the Assign SharePoint Online user accounts task.

  3. Assign the user accounts.

  4. Save the changes.
Related topics

Application cases for SharePoint Online user account

Example:

Set up guest access to a site collection with read-only permissions. To do this, a SharePoint Online user account is added. The Azure Active Directory Guests group is assigned as authentication object to the user account. Clara Harris owns an Azure Active Directory user account, which is a member in this group. She can log in to the site collection with this and obtain all the SharePoint Online user account's permissions.

Jan Bloggs is also requires guest access to the site collection. He owns an Azure Active Directory user account in the same domain. In the Web Portal, he requests membership of the Azure Active Directory Guests group. Once the request is granted approval and assigned, he can log in on the site collection.

SharePoint Online access permissions are supplied in different ways in the One Identity Manager, depending on the referenced authentication object.

Case 1: The associated authentication object is a group. The authentication system is managed in One Identity Manager. (Default case)
  • The user account represents an Azure Active Directory group. This group can be assigned in the One Identity Manager as authentication object.

  • The user account cannot be assigned to an employee. This means, the user account can only become a member in SharePoint Online roles and groups through direct assignment.

  • Before an employee can log in to the SharePoint Online system, they require an Azure Active Directory user account. This user account must be a member of the Azure Active Directory group that is used as an authentication object.

  • A new SharePoint Online user account can be created manually.

  • The user account cannot be managed through an account definition.

Case 2: The authentication object is a user account. The authentication system is managed in One Identity Manager.
  • The user account represents an Azure Active Directory user account. The user account is not assigned as an authentication object in One Identity Manager.

  • The SharePoint Online user account can be assigned to an employee. This means that the user account can become a member in SharePoint Onlineroles and groups through inheritance and direct assignment.

    If an authentication object is assigned, the connected employee is found through the authentication object.

    If there is no authentication object assigned, the employee can be assigned automatically or manually. Automatic employee assignment depends on the TargetSystem | SharePointOnline | PersonAutoFullsync and TargetSystem | SharePointOnline | PersonAutoDefault configuration parameters.

  • A new SharePoint Online user account can be manually created or by using an account definition. The Azure Active Directory user account used as the authentication object must belong to a domain trusted by the referenced authentication system.

  • The user account can be managed through an account definition.

For more information about employee handling and administration, see the One Identity Manager Target System Base Module Administration Guide.

関連ドキュメント

The document was helpful.

評価を選択

I easily found the information I needed.

評価を選択