Chat now with support
Chat with Support

Identity Manager 8.0 - Administration Guide for Connecting to SharePoint

Managing SharePoint Environments Setting Up SharePoint Farm Synchronization Basic Data for Managing SharePoint SharePoint Farms SharePoint Web Applications SharePointSite Collections and Sites SharePoint User Accounts SharePoint Roles and Groups
SharePoint Groups SharePoint Roles and Permission Levels
Permissions for SharePoint Web Applications Reports about SharePoint Site Collections Appendix: Configuration Parameters for Managing SharePoint Appendix: Default Project Template for SharePoint

Deleting and Restoring SharePoint User Accounts

Deleting and Restoring SharePoint User Accounts

 NOTE: As long as an account definition for an employee is valid, the employee retains the user account that was created by it. If the account definition assignment is removed, the user account created through this account definition, is deleted.

To delete a user account

  1. Select the category SharePoint | User accounts (group authenticated) or SharePoint | User accounts (user authenticated).
  2. Select the user account in the result list.
  3. Click to delete the user account.
  4. Confirm the security prompt with Yes.

To restore user account

  1. Select the category SharePoint | User accounts (group authenticated) or SharePoint | User accounts (user authenticated).
  2. Select the user account in the result list.
  3. Click in the result list toolbar.

When an authentication object assigned to a SharePoint user account is deleted from the One Identity Manager database, the link to the authentication object is removed from the SharePoint user account. Define a custom process to delete these user accounts from the One Identity Manager database.

Configuring Deferred Deletion

By default, user accounts are finally deleted from the database after 30 days.The user accounts are initially disabled. You can reenable the user accounts until deferred deletion is run. After deferred deletion is run, the user account are deleted from the database and cannot be restored anymore. You can configure an alternative deletion delay on the table SPSUser in the Designer.

Note: SharePoint user accounts cannot be locked. A user account marked for deletion remains enabled until deferred deletion has expired and the user account is finally deleted from the One Identity Manager database.

Lock the user account linked to the SharePoint user account as authentication object to prevent a user from logging into a site when the SharePoint user account is marked for deletion.

SharePoint Roles and Groups

SharePoint Roles and Groups

User accounts inherit SharePoint permissions through SharePoint roles and SharePoint groups. SharePoint groups are always defined for one site collection in this way. SharePoint roles are defined for sites. They are assigned to groups and the user accounts that are members of these groups, inherit SharePoint permissions through them. SharePoint roles can also be assigned directly to user accounts. User account permissions on individual sites in a site collection are restricted through the SharePoint roles that are assigned to it.

Terms
  • A SharePoint Role is the permission level linked to a fixed site.
  • The assignment of SharePoint permissions to a permission level is called a role definition.
  • The assignment of user account or groups to a SharePoint role is called a role assignment.

Child sites can inherit permissions from the sites that the user accounts have on those sites. Every root site of a site collection or every site that has a child site. This permits the following scenarios:

  1. The child site inherits role definitions and role assignments.

    The permission levels and role definitions are valid as well as the role assignments from the parent (inheritance) site. User and groups cannot be explicitly authorized for the site. Only user accounts that have permissions for the parent (inheritance) site have access to the site.

  2. The child site inherits the role definitions and role assignments.

    You cannot define unique permission levels for child site. The SharePoint roles for this site reference the permission levels of the parent (inheritance) site and its role definitions. User accounts and groups can be assigned to the SharePoint roles of the child site based on this. If there are unique permission levels defined for the child site the permissions are overwritten by the inherited permissions.

  3. The child site does not inherit role definitions or role assignments.

    In this case unique permission levels with their role definitions can be added in the same way as the root site. The SharePoint roles based on this are assigned to user accounts and groups.

Figure 2: SharePoint User Accounts Inheriting SharePoint Permissions in the One Identity Manager

SharePoint Groups

SharePoint Groups

You can use groups in SharePoint to provide users with the same permissions. Groups that you add for site collections are valid for all sites in that site collection. SharePoint roles that you define for a site are assigned directly to groups. All user accounts that are members of these groups obtain the permissions defined in the SharePoint roles for this site.

You can edit the following group data in the One Identity Manager:

  • Object properties like display name, owner or visibility of memberships
  • Assigned SharePoint role and user accounts
  • Usage in the IT Shop
  • Risk Assessment
  • Inheritance through roles and inheritance restrictions

To edit group master data

  1. Select the category SharePoint | Groups.
  2. Select the group in the result list. Select Change master data in the task view.

    - OR -

    Click in the result list toolbar.

  3. Enter the required data on the master data form.
  4. Save the changes.
Detailed information about this topic
Related Topics

Entering Master Data for SharePoint Groups

Entering Master Data for SharePoint Groups

Table 33: Configuration Parameters for Setting Up SharePoint Groups
Configuration parameter Meaning
QER\CalculateRiskIndex Preprocessor relevant configuration parameter controlling system components for calculating an employee's risk index. Changes to the parameter require recompiling the database.

If the parameter is set, values can be entered and calculated for the risk index.

Enter the following master data for a group.

Table 34: SharePoint Group Master Data
Property Description
Display name Display name of the group.
Site collection Site collection the group is used in.
Owner Owner of the group. A SharePoint user account or a SharePoint group can be selected.
Service item Service item data for requesting the group through the IT Shop.
Distribution group alias Alias of the distribution group that the group is linked to.
Distribution group email Email address of the distribution group that the group is linked to.
Risk index

Value for evaluating the risk of assigning the group to user accounts. Enter a value between 0 and 1. This property is only visible when the configuration parameter QER\CalculateRiskIndex is set.

Category Categories for group inheritance. Groups can be selectively inherited by user accounts. To do this, groups and user accounts are divided into categories. Use this menu to allocate one or more categories to the group.
Description Spare text box for additional explanation.
Description (HTML) Additional information about the group in HTML format. (this is displayed in SharePoint in the description field "About me").
Memberships only visible to members Specifies whether only group members can see the list of members.
Group members can edit memberships Specifies whether all group members can edit the group memberships.
Request for membership permitted Specifies whether SharePoint users can request or end membership in these groups themselves.
Automatic membership on request Specifies whether SharePoint users automatically become members in the group once they request membership. The same applies when user end their membership.
Email address membership requested Email address that the group membership request or closure is sent to.

IT Shop

Specifies whether the group can be requested through the IT Shop. This group can be requested by staff through the Web Portal and granted through a defined approval process. The group can still be assigned directly to hierarchical roles.

Only for use in IT Shop

Specifies whether the group can only be requested through the IT Shop. This group can be requested by staff through the Web Portal and granted through a defined approval process. The group may not be assigned directly to hierarchical roles.

Detailed information about this topic
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating