Identity Manager 8.1 - Administration Guide for Connecting to SharePoint Online

Assigning account definitions to linked SharePoint Online user accounts

An account definition can be subsequently assigned to user accounts with Linked status. This may be necessary, for example, if:

• employees and user accounts have been linked manually
• automatic employee assignment is configured, but an account definition is not yet assigned in the SharePoint Online system.

To select user accounts through account definitions

1. Create an account definition.
2. Assign an account definition to the site collection.
3. Assign the account definition and manage level to user accounts in linked status.
   1. In Manager, select SharePoint Online | User accounts (user authenticated) | Linked but not configured | <Site collection>.
   2. Select Assign account definition to linked accounts.

Detailed information about this topic

• Assigning account definitions to target systems

Manually linking employees to SharePoint Online user accounts

An employee can be linked to multiple SharePoint Online user accounts, for example, so that you can assign an administrative user account in addition to the default user account. One employee can also use default user accounts with different types.

To manually assign user accounts to an employee

1. Select the Employees | Employees.

2. Select the employee in the result list and run Assign SharePoint Online user accounts from the task view.

3. Assign the user accounts.

4. Save the changes.

Related Topics

• Supported user account types

SharePoint Online user account use cases

SharePoint Online access permissions are supplied in different ways in the One Identity Manager, depending on the referenced authentication object.

Case 1: The associated authentication object is a group. The authentication system is managed in One Identity Manager. (Default case)

• The user account represents an Azure Active Directory group. This group can be assigned in the One Identity Manager as authentication object.
• The user account cannot be assigned to an employee. This means, the user account can only become a member in SharePoint Online roles and groups through direct assignment.
• Before an employee can log in to the SharePoint Online system, they require an Azure Active Directory user account. This user account must be a member of the Azure Active Directory group that is used as an authentication object.
• A new SharePoint Online user account can be created manually.
• The user account cannot be managed through an account definition.

Case 2: The authentication object is a user account. The authentication system is managed in One Identity Manager.

• The user account represents an Azure Active Directory user account. The user account is not assigned as an authentication object in One Identity Manager.
• The SharePoint Online user account can be assigned to an employee. This means that the user account can become a member in SharePoint Online roles and groups through inheritance and direct assignment.

  If an authentication object is assigned, the connected employee is found through the authentication object.

  If there is no authentication object assigned, the employee can be assigned automatically or manually. Automatic employee assignment depends on the TargetSystem | SharePointOnline | PersonAutoFullsync and TargetSystem | SharePointOnline | PersonAutoDefault configuration parameters.

• A new SharePoint Online user account can be manually created or by using an account definition. The Azure Active Directory user account used as the authentication object must belong to a domain trusted by the referenced authentication system.
• The user account can be managed through an account definition.

For detailed information about employee handling and administration, see the One Identity Manager Target System Base Module Administration Guide.

Supported user account types

Different types of user accounts, such as default user accounts, administrative user accounts, service accounts, or privileged user accounts can be mapped in One Identity Manager.

The following properties are used for mapping different user account types.

• Identity

  The Identity property (IdentityType column) is used to describe the type of user account.

  Table 16: Identities of user accounts

  Identity	Description	Value of the IdentityType column
  Primary identity	Employee's default user account.	Primary
  Organizational identity	Secondary user account used for different roles in the organization, for example for subcontracts with other functional areas.	Organizational
  Personalized admin identity	User account with administrative permissions, used by one employee.	Admin
  Sponsored identity	User account that is used for training purposes, for example.	Sponsored
  Shared identity	User account with administrative permissions, used by several employees.	Shared
  Service identity	Service account.	Service

  NOTE: To enable working with identities for user accounts, the employees also need identities. You can only link user accounts to which an identity is assigned with employees who have this same identity.

  The primary identity, the organizational identity, and the personal admin identity are used for different user accounts, which can be used by the same actual employee to execute their different tasks within the company.

  To provide user accounts with a personal admin identity or an organizational identity for an employee, you create subidentities for the employee. These subidentities are then linked to user accounts, enabling you to assign the required Entitlements to the different user accounts.

  User accounts with a sponsored identity, group identity, or service identity are linked to dummy employees that do not refer to a real person. These dummy employees are needed so that Entitlements can be inherited by the user accounts. When evaluating reports, attestations, or compliance checks, check whether dummy employees need to be considered separately.

  For detailed information about mapping employee identities, see the One Identity Manager Identity Management Base Module Administration Guide.

• Privileged user account

  Privileged user accounts are used to provide employees with additional privileges. This includes administrative user accounts or service accounts, for example. The user accounts are marked as Privileged user account (Column IsPrivilegedAccount).

Detailed information about this topic

• Default user accounts
• Administrative user accounts
• Privileged User Accounts