Chat now with support
Chat with Support

Identity Manager 8.1 - Administration Guide for Connecting to SharePoint Online

Mapping a SharePoint Online environment in One Identity Manager Synchronizing a SharePoint Online environment Managing SharePoint Online user accounts and employees Managing the assignments of SharePoint Online groups and roles Mapping of SharePoint Online objects in One Identity Manager
SharePoint Online tenants SharePoint Online user accounts SharePoint Online groups SharePoint Online permission levels SharePoint Online site collections SharePoint Online sites SharePoint Online roles
Handling of SharePoint Online objects in Web Portal Basic data for managing a SharePoint Online environment Appendix: Configuration parameters for managing SharePoint Online Appendix: Default project template for SharePoint Online Appendix: Editing system objects About us

Assigning account definitions to linked SharePoint Online user accounts

An account definition can be subsequently assigned to user accounts with Linked status. This may be necessary, for example, if:

  • employees and user accounts have been linked manually
  • automatic employee assignment is configured, but an account definition is not yet assigned in the SharePoint Online system.

To select user accounts through account definitions

  1. Create an account definition.
  2. Assign an account definition to the site collection.
  3. Assign the account definition and manage level to user accounts in linked status.
    1. In Manager, select SharePoint Online | User accounts (user authenticated) | Linked but not configured | <Site collection>.
    2. Select Assign account definition to linked accounts.
Detailed information about this topic

Manually linking employees to SharePoint Online user accounts

An employee can be linked to multiple SharePoint Online user accounts, for example, so that you can assign an administrative user account in addition to the default user account. One employee can also use default user accounts with different types.

NOTE: To enable working with identities for user accounts, the employees also need identities. You can only link user accounts to which an identity is assigned with employees who have this same identity.

To manually assign user accounts to an employee

  1. Select the Employees | Employees.

  2. Select the employee in the result list and run Assign SharePoint Online user accounts from the task view.

  3. Assign the user accounts.

  4. Save the changes.
Related Topics

SharePoint Online user account use cases

Example

Set up guest access to a site collection with read-only permissions. To do this, a SharePoint Online user account is created. The Azure Active Directory Guests group is assigned as authentication object to the user account. Clara Harris owns an Azure Active Directory user account, which is a member in this group. She can log in to the site collection with this and obtain all the SharePoint Online user account's permissions.

Jan Bloggs is also requires guest access to the site collection. He owns an Azure Active Directory user account in the same domain. In the Web Portal, he requests membership of the Azure Active Directory Guests group. Once the request is granted approval and assigned, he can log in on the site collection.

SharePoint Online access permissions are supplied in different ways in the One Identity Manager, depending on the referenced authentication object.

Case 1: The associated authentication object is a group. The authentication system is managed in One Identity Manager. (Default case)
  • The user account represents an Azure Active Directory group. This group can be assigned in the One Identity Manager as authentication object.
  • The user account cannot be assigned to an employee. This means, the user account can only become a member in SharePoint Online roles and groups through direct assignment.
  • Before an employee can log in to the SharePoint Online system, they require an Azure Active Directory user account. This user account must be a member of the Azure Active Directory group that is used as an authentication object.
  • A new SharePoint Online user account can be created manually.
  • The user account cannot be managed through an account definition.
Case 2: The authentication object is a user account. The authentication system is managed in One Identity Manager.
  • The user account represents an Azure Active Directory user account. The user account is not assigned as an authentication object in One Identity Manager.
  • The SharePoint Online user account can be assigned to an employee. This means that the user account can become a member in SharePoint Online roles and groups through inheritance and direct assignment.

    If an authentication object is assigned, the connected employee is found through the authentication object.

    If there is no authentication object assigned, the employee can be assigned automatically or manually. Automatic employee assignment depends on the TargetSystem | SharePointOnline | PersonAutoFullsync and TargetSystem | SharePointOnline | PersonAutoDefault configuration parameters.

  • A new SharePoint Online user account can be manually created or by using an account definition. The Azure Active Directory user account used as the authentication object must belong to a domain trusted by the referenced authentication system.
  • The user account can be managed through an account definition.

For detailed information about employee handling and administration, see the One Identity Manager Target System Base Module Administration Guide.

Supported user account types

Different types of user accounts, such as default user accounts, administrative user accounts, service accounts, or privileged user accounts can be mapped in One Identity Manager.

The following properties are used for mapping different user account types.

  • Identity

    The Identity property (IdentityType column) is used to describe the type of user account.

    Table 16: Identities of user accounts
    Identity Description Value of the IdentityType column
    Primary identity Employee's default user account. Primary
    Organizational identity Secondary user account used for different roles in the organization, for example for subcontracts with other functional areas. Organizational
    Personalized admin identity User account with administrative permissions, used by one employee. Admin
    Sponsored identity User account that is used for training purposes, for example. Sponsored
    Shared identity User account with administrative permissions, used by several employees. Shared
    Service identity Service account. Service

    NOTE: To enable working with identities for user accounts, the employees also need identities. You can only link user accounts to which an identity is assigned with employees who have this same identity.

    The primary identity, the organizational identity, and the personal admin identity are used for different user accounts, which can be used by the same actual employee to execute their different tasks within the company.

    To provide user accounts with a personal admin identity or an organizational identity for an employee, you create subidentities for the employee. These subidentities are then linked to user accounts, enabling you to assign the required Entitlements to the different user accounts.

    User accounts with a sponsored identity, group identity, or service identity are linked to dummy employees that do not refer to a real person. These dummy employees are needed so that Entitlements can be inherited by the user accounts. When evaluating reports, attestations, or compliance checks, check whether dummy employees need to be considered separately.

    For detailed information about mapping employee identities, see the One Identity Manager Identity Management Base Module Administration Guide.

  • Privileged user account

    Privileged user accounts are used to provide employees with additional privileges. This includes administrative user accounts or service accounts, for example. The user accounts are marked as Privileged user account (Column IsPrivilegedAccount).

Detailed information about this topic
Related Documents