An account definition can be subsequently assigned to user accounts with Linked status. This may be necessary, for example, if:
To select user accounts through account definitions
An employee can be linked to multiple SharePoint Online user accounts, for example, so that you can assign an administrative user account in addition to the default user account. One employee can also use default user accounts with different types.
|
NOTE: To enable working with identities for user accounts, the employees also need identities. You can only link user accounts to which an identity is assigned with employees who have this same identity. |
To manually assign user accounts to an employee
Select the Employees | Employees.
Select the employee in the result list and run Assign SharePoint Online user accounts from the task view.
Assign the user accounts.
Set up guest access to a site collection with read-only permissions. To do this, a SharePoint Online user account is created. The Azure Active Directory Guests group is assigned as authentication object to the user account. Clara Harris owns an Azure Active Directory user account, which is a member in this group. She can log in to the site collection with this and obtain all the SharePoint Online user account's permissions.
Jan Bloggs is also requires guest access to the site collection. He owns an Azure Active Directory user account in the same domain. In the Web Portal, he requests membership of the Azure Active Directory Guests group. Once the request is granted approval and assigned, he can log in on the site collection.
SharePoint Online access permissions are supplied in different ways in the One Identity Manager, depending on the referenced authentication object.
If an authentication object is assigned, the connected employee is found through the authentication object.
If there is no authentication object assigned, the employee can be assigned automatically or manually. Automatic employee assignment depends on the TargetSystem | SharePointOnline | PersonAutoFullsync and TargetSystem | SharePointOnline | PersonAutoDefault configuration parameters.
For detailed information about employee handling and administration, see the One Identity Manager Target System Base Module Administration Guide.
Different types of user accounts, such as default user accounts, administrative user accounts, service accounts, or privileged user accounts can be mapped in One Identity Manager.
The following properties are used for mapping different user account types.
Identity
The Identity property (IdentityType column) is used to describe the type of user account.
Identity | Description | Value of the IdentityType column |
---|---|---|
Primary identity | Employee's default user account. | Primary |
Organizational identity | Secondary user account used for different roles in the organization, for example for subcontracts with other functional areas. | Organizational |
Personalized admin identity | User account with administrative permissions, used by one employee. | Admin |
Sponsored identity | User account that is used for training purposes, for example. | Sponsored |
Shared identity | User account with administrative permissions, used by several employees. | Shared |
Service identity | Service account. | Service |
|
NOTE: To enable working with identities for user accounts, the employees also need identities. You can only link user accounts to which an identity is assigned with employees who have this same identity. |
The primary identity, the organizational identity, and the personal admin identity are used for different user accounts, which can be used by the same actual employee to execute their different tasks within the company.
To provide user accounts with a personal admin identity or an organizational identity for an employee, you create subidentities for the employee. These subidentities are then linked to user accounts, enabling you to assign the required Entitlements to the different user accounts.
User accounts with a sponsored identity, group identity, or service identity are linked to dummy employees that do not refer to a real person. These dummy employees are needed so that Entitlements can be inherited by the user accounts. When evaluating reports, attestations, or compliance checks, check whether dummy employees need to be considered separately.
For detailed information about mapping employee identities, see the One Identity Manager Identity Management Base Module Administration Guide.
Privileged user account
Privileged user accounts are used to provide employees with additional privileges. This includes administrative user accounts or service accounts, for example. The user accounts are marked as Privileged user account (Column IsPrivilegedAccount).
© 2021 One Identity LLC. ALL RIGHTS RESERVED. Feedback Terms of Use Privacy