Identity Manager 8.2.1 - Administration Guide for Connecting to SharePoint Online

Task	Topic
Overview of SharePoint Online Groups	Overview of SharePoint Online roles
Assign user accounts	Assigning SharePoint Online user accounts directly to an entitlement
Assign groups	Assigning SharePoint Online groups to SharePoint Online roles
Assign system roles	Adding SharePoint Online entitlements to system roles
Assign business roles	Assigning SharePoint Online entitlements to business roles
Assign organizations	Assigning SharePoint Online entitlements to departments, cost centers, and locations
Exclude SharePoint Online roles	Effectiveness of SharePoint Online roles
Assigning extended properties	Assigning extended properties to SharePoint Online groups
Synchronize object	Synchronizing single objects

Task

Topic

Overview of SharePoint Online Groups

Overview of SharePoint Online roles

Assign user accounts

Assigning SharePoint Online user accounts directly to an entitlement

Assign groups

Assigning SharePoint Online groups to SharePoint Online roles

Assign system roles

Adding SharePoint Online entitlements to system roles

Assign business roles

Assigning SharePoint Online entitlements to business roles

Assign organizations

Assigning SharePoint Online entitlements to departments, cost centers, and locations

Exclude SharePoint Online roles

Effectiveness of SharePoint Online roles

Assigning extended properties

Assigning extended properties to SharePoint Online groups

Synchronize object

Synchronizing single objects

The behavior described under Effectiveness of SharePoint Online entitlement assignments can also be used for SharePoint Online roles.

The effect of the assignments is mapped in the O3SUserHasO3SRLAssign and BaseTreeHasO3SRLAssign tables through the XIsInEffect column.

Prerequisites

The QER | Structures | Inherite | GroupExclusion configuration parameter is set.

In the Designer, set the configuration parameter and compile the database.

NOTE: If you disable the configuration parameter at a later date, model components and scripts that are not longer required, are disabled. SQL procedures and triggers are still carried out. For more information about the behavior of preprocessor relevant configuration parameters and conditional compiling, see the One Identity Manager Configuration Guide.
Mutually exclusive SharePoint Online roles belong to the same site collection.

To exclude SharePoint Online roles

In the Manager, select the category SharePoint Online > Roles.
Select the role in the result list.
Select the Exclude SharePoint Online roles task.
In the Add assignments pane, assign the roles that are mutually exclusive to the selected role.

- OR -

In the Remove assignments pane, remove the roles that are no longer mutually exclusive.
Save the changes.

Site collections and sites are loaded into the One Identity Manager database through synchronization in the default installation of One Identity Manager. You can add new site collections and site in the One Identity Manager and publish them in the SharePoint Online target system. Predefined scripts and processes are provided for this purpose. You can use these as templates to make the site collections and sites requestable through the IT Shop.

NOTE: Customize these scripts and processes as required.

Table 30: Example scripts and processes
Script/Process	Description
Script O3S_CreateO3SSite	Creates a new site collection and the associate root site in the One Identity Manager database. Creates a user account that is entered as site collection administrator or root site author. NOTE: Enter a valid SharePoint Online timezone value for the UID_DialogTimeZone parameter. If the timezone is invalid, UTC is used. You will find a list of permitted timezones in the script commentary.
Script O3S_CreateO3SWeb	Creates a new site within a site collection in the One Identity Manager database.
Process O3S_O3SWeb_(De-)Provision	Creates a new site within a site collection. The process is triggered by the PROVISION event if the site in the One Identity Manager database is not labeled as the root site. Deletes a site. The process is triggered by the DEPROVISION event if the site in the One Identity Manager database is not labeled as the root site.
Process O3S_O3SSite_(De-)Provision	Creates a new site collection in a web application and the associated root site. The process is triggered by the PROVISION event. Deletes a site collection in a web application and the associated root site. The process is triggered by the DEPROVISION event.

The following step are required in additions:

Define a requestable product through which the site collection/site is requested from the IT Shop.
Define product properties that are mapped to the script parameter (for example, URL or site template). You must include these product properties when the site collection/site is requested.
Create a process for the PersonWantsOrg table that is started when the request is approved (event OrderGranted). This process call the matching script and sets the parameter values with the defined product properties you have defined. Then the site collection/site is added to the One Identity Manager database.
To add a new site collection to an existing synchronization project, extend the scope of the target system connection in the synchronization project.
Extending the scope
The scope should only include site collections in which the applicable synchronization user is entered in the SharePoint Online administration interface as the site collection administrator. There is no default user in SharePoint Online.

If the scope is not correctly set up, site collections cannot be loaded and synchronization is stopped.

To edit site collections in the scope of a SharePoint Online synchronization project
1. Open the Synchronization Editor.
2. Select the Configuration > Target system category.
3. Select the Scope view.
4. Click Edit scope. A list of site collections appears on the right-hand side.
5. Activate the site collections to synchronize.
  
  In the list, select only the site collections for which the synchronization user is the same as the administrator in SharePoint Online.
6. Click Commit to database to save the changes.

For more information about theIT Shop, see the One Identity Manager IT Shop Administration Guide. For detailed information about defining processes, see the One Identity Manager Configuration Guide.

Identity Manager 8.2.1 - Administration Guide for Connecting to SharePoint Online

Additional tasks for managing SharePoint Online roles

Overview of SharePoint Online roles

Effectiveness of SharePoint Online roles

Prerequisites

Setting up SharePoint Online site collections and sites

Related topics

请选择您的产品：

为向您提供更好的服务，请填写'Purpose of your Chat'（联系目的）：

针对您的问题建议的解决方案

Identity Manager 8.2.1 - Administration Guide for Connecting to SharePoint Online

Additional tasks for managing SharePoint Online roles

Overview of SharePoint Online roles

Effectiveness of SharePoint Online roles

Prerequisites

Setting up SharePoint Online site collections and sites

Related topics