Chat now with support
Chat with Support

Identity Manager 8.1 - Administration Guide for Connecting to SharePoint

Managing SharePoint Environments Setting Up SharePoint Farm Synchronization Basic data for managing a SharePoint environment SharePoint Farms SharePoint Web Applications SharePointSite Collections and Sites SharePoint User accounts SharePoint Roles and Groups
SharePoint Groups SharePoint Roles and Permission Levels
Permissions for SharePoint Web Applications Reports about SharePoint Site Collections Appendix: Configuration parameters for managing a SharePoint environment Appendix: Default Project Template for SharePoint

Deleting and Restoring SharePoint User Accounts

NOTE: As long as an account definition for an employee is valid, the employee retains the user account that was created by it. If the assignment of an account definition is removed, the user account that was created from this account definition is deleted.

To delete a user account

  1. Select SharePoint | User accounts (group authenticated) or SharePoint | User accounts (user authenticated).
  2. Select the user account in the result list.
  3. Click to delete the user account.
  4. Confirm the security prompt with Yes.

To restore a user account

  1. Select SharePoint | User accounts (group authenticated) or SharePoint | User accounts (user authenticated).
  2. Select the user account in the result list.
  3. Click in the result list toolbar.

When an authentication object assigned to a SharePoint user account is deleted from the One Identity Manager database, the link to the authentication object is removed from the SharePoint user account. Define a custom process to delete these user accounts from the One Identity Manager database.

Configuring deferred deletion

By default, user accounts are finally deleted from the database after 30 days. The user accounts are initially locked. You can reenable the user accounts until deferred deletion is run. After deferred deletion is run, the user account are deleted from the database and cannot be restored anymore. You can configure an alternative deletion delay on the table SPSUser in Designer.

Note: SharePoint user accounts cannot be locked. A user account marked for deletion remains enabled until deferred deletion has expired and the user account is finally deleted from the One Identity Manager database.

Lock the user account linked to the SharePoint user account as authentication object to prevent a user from logging into a site when the SharePoint user account is marked for deletion.

SharePoint Roles and Groups

User accounts inherit SharePoint permissions through SharePoint roles and SharePoint groups. SharePoint groups are always defined for one site collection in this way. SharePoint roles are defined for sites. They are assigned to groups, and the user accounts that are members of these groups inherit SharePoint permissions through them. SharePoint roles can also be assigned directly to user accounts. User account permissions on individual sites in a site collection are restricted through the SharePoint roles that are assigned to it.

Terms
  • A SharePoint Role is the permission level linked to a fixed site.
  • The assignment of SharePoint permissions to a permission level is called a role definition.
  • The assignment of user account or groups to a SharePoint role is called a role assignment.

Child sites can inherit permissions from the sites that the user accounts have on those sites. Every root site of a site collection or every site that has a child site. This permits the following scenarios:

  1. The child site inherits role definitions and role assignments.

    The permission levels and role definitions are valid as well as the role assignments from the parent (inheritance) site. User and groups cannot be explicitly authorized for the site. Only user accounts that have permissions for the parent (inheritance) site have access to the site.

  2. The child site inherits the role definitions and role assignments.

    You cannot define unique permission levels for child site. The SharePoint roles for this site reference the permission levels of the parent (inheritance) site and its role definitions. User accounts and groups can be assigned to the SharePoint roles of the child site based on this. If there are unique permission levels defined for the child site the permissions are overwritten by the inherited permissions.

  3. The child site does not inherit role definitions or role assignments.

    In this case unique permission levels with their role definitions can be added in the same way as the root site. The SharePoint roles based on the definitions are assigned to user accounts and groups.

Figure 2: SharePoint User Accounts Inheriting SharePoint Permissions in the One Identity Manager

SharePoint Groups

You can use groups in SharePoint to provide users with the same permissions. Groups that you add for site collections are valid for all sites in that site collection. SharePoint roles that you define for a site are assigned directly to groups. All user accounts that are members of these groups obtain the permissions defined in the SharePoint roles for this site.

You can edit the following group data in the One Identity Manager:

  • Object properties like display name, owner or visibility of memberships
  • Assigned SharePoint role and user accounts
  • Usage in the IT Shop
  • Risk assessment
  • Inheritance through roles and inheritance restrictions

To edit group master data

  1. Select SharePoint | Groups.
  2. Select the group in the result list. Select Change master data.

    - OR -

    Click in the result list toolbar.

  3. Enter the required data on the master data form.
  4. Save the changes.
Detailed information about this topic
Related Topics

Entering Master Data for SharePoint Groups

Table 31: Configuration parameters for setting up SharePoint groups
Configuration parameter Meaning
QER\CalculateRiskIndex Preprocessor relevant configuration parameter controlling system components for calculating an employee's risk index. Changes to the parameter require recompiling the database.

If the parameter is enabled, values for the risk index can be entered and calculated.

Enter the following master data for a group.

Table 32: SharePoint Group master data
Property Description
Display name Display name of the group.
Site collection Site collection the group is used in.
Owner Owner of the group. A SharePoint user account or a SharePoint group can be selected.
Service item Service item data for requesting the group through the IT Shop.
Distribution group alias Alias of the distribution group that the group is linked to.
Distribution group email Email address of the distribution group that the group is linked to.
Risk index

Value for evaluating the risk of assigning the group to user accounts. Enter a value between 0 and 1. This input field is only visible if the configuration parameter QER | CalculateRiskIndex is activated.

Category Categories for group inheritance. Groups can be selectively inherited by user accounts. To do this, groups and user accounts are divided into categories. Select one or more categories from the menu.
Description Spare text box for additional explanation.
Description (HTML) Additional information about the group in HTML format. (this is displayed in SharePoint in the description field "About me").
Memberships only visible to members Specifies whether only group members can see the list of members.
Group members can edit memberships Specifies whether all group members can edit the group memberships.
Request for membership permitted Specifies whether SharePoint users can request or end membership in these groups themselves.
Automatic membership on request Specifies whether SharePoint users automatically become members in the group once they request membership. The same applies when user end their membership.
Email address membership requested Email address that the group membership request or closure is sent to.

IT Shop

Specifies whether the group can be requested through the IT Shop. If this option is set, the group can be requested by the employees through the Web Portal and distributed with a defined approval process. The group can still be assigned directly to hierarchical roles.

Only for use in IT Shop

Specifies whether the group can only be requested through the IT Shop. If this option is set, the group can be requested by the employees through the Web Portal and distributed with a defined approval process. Direct assignment of the group to hierarchical roles or user accounts is no permitted.

Detailed information about this topic
Related Documents