---title: Enabling SharePoint Profile Sync---

Enabling SharePoint Profile Sync

If you have Microsoft SharePoint and are running the User Profile service, you can configure EmpowerID to synchronize the user profile properties in your SharePoint with the corresponding EmpowerID Person attributes for each SharePoint user with an EmpowerID Person identity. In this way, if a user changes a property for one of their attributes, that change can be brought into EmpowerID and pushed to any of your connected account stores, such as Active Directory. The number of SharePoint profile properties that EmpowerID can synchronize with and the naming convention used can be viewed by expanding the below drop-down.

The User Profile Service Application must be started in your SharePoint farm for EmpowerID Profile Sync to function correctly.

You determine how changes made to these properties in SharePoint affect EmpowerID by the settings you apply to the attribute flow rules for your SharePoint system. These rules are visually configured for each profile property and are always relative to the relationship between a user profile property in SharePoint and the corresponding EmpowerID Person attribute. In addition to setting attribute flow rules, you create a Resource Entitlement (RET) for a SharePoint User Profile and apply that policy to your SharePoint users in EmpowerID.

This topic explains how to enable profile sync for SharePoint and is divided into the following activities:

To create a SharePoint User Profile Resource Entitlement

In this example, we create a SharePoint User Profile Resource Entitlement and apply that entitlement to the Any Role Anywhere Business Role and Location. In this way, profile sync happens for anyone within the organization. You can be more selective in your RET application if desired, drilling down to specific Business Roles and Location, groups, Management Roles, and SetGroups.
From the EmpowerID Management Console, click the application icon and then select Role and Location Manager from the application menu. From the Business Roles tree to the left of Role and Location Manager, click Any Role and in theLocations tree to the right of Role and Location Manager, click Anywhere. In Role and Location Manager, select Resource Entitlements for Selected Business Role and Location from the Policy drop-down located above the grid. Click the Add New button. In the Select Resource Entitlement Type window that appears, select SharePoint User Profile from the drop-down list and then click OK.

This opens the Resource Entitlement Details screen, which is where you enter the information to define your SharePoint User Profile RET.

In the Resource Entitlement Details screen, do the following:

When you have completed entering your values, your screen should look similar to the following image:

Click Save. You should now see the RET in the Role and Location Manger grid. Next, we need to set the attribute flow rules for the SharePoint account store. We describe this below.

To set Attribute Flow Rules

From Role and Location Manager, click the EmpowerID icon and select Configuration Manager from the application menu. In Configuration Manager, expand the User Directories tree node and then click Attribute Flow Rules. Click theAccount Store drop-down located above the main panel of Configuration Manager and select your SharePoint account store. Click the Attribute Flow button located between the EmpowerID Person Attribute column and the Account Store Attributes column, and select a flow direction for each attribute from the context menu.

When setting the attribute flow rules, you can choose from one of the four options below for each attribute or property:

The attribute flow rule for the Email attribute must be set so that the flow occurs from EmpowerID to SharePoint. This means that changes to the person's Email attribute made in EmpowerID will flow to the WorkEmail attribute in SharePoint, but changes to the WorkEmail attribute in SharePoint will not flow to the Email attribute in EmpowerID.

The below image shows the attribute flow rules we have set for our environment. Notice that the attribute flow rule for Email is set to only flow from EmpowerID to SharePoint. All other attribute flow rules are set to bidirectional.


Next, we need to enable RET provisioning and de-provisioning, inventory and attribute flow for the SharePoint account store.

To enable RET provisioning and deprovisioning

From Configuration Manager, expand theUser Directories tree node and then clickAccount Stores. Double-click the SharePoint account store in the Configuration Manager grid or right-click it and selectEdit from the context menu. In theGeneral Pane of the Account Store Details screen that appears, do the following: In the Inventory Pane of the Account Store Details screen, toggle the Enable Inventory button from a red sphere to agreen check. This allows EmpowerID to inventory the user profile properties for each of your SharePoint users.

The Account Store Details screen should look like the below image:

At your next account store inventory run, you should see the user profiles in SharePoint.

Be sure to turn on the Resource Entitlement Inbox Processor Job and the Resource Entitlement Recalculation Job on one or more of your EmpowerID Web servers to ensure the SharePoint User Profile RET gets applied to your users. You turn these jobs on by checking the box beside the job on the appropriate Web servers within theEmpowerID Servers and Roles section of Configuration Manager.