Overview of SharePoint Online Connector

The SharePoint Online (SPO) connector contains multiple Azure services including microservices, web jobs and Azure functions used for inventorying and managing SharePoint Online in EmpowerID. Inventoried information includes SPO site collections, user profiles, webs, groups, roles, role assignments and group membership. This information can managed in EmpowerID as well as managed and synchronized with data in any connected back-end user directories.

Supported Features and Attribute Mappings

• User Profile Management

  • Inventory user profiles

  • Edit user profiles

  • Bi-directional synchronization of SharePoint user profiles and EmpowerID Person attributes

• Groups Management

  • Inventory SharePoint groups

  • Add users and groups to SharePoint groups

  • Remove users and groups from SharePoint groups

• Roles

  • Inventory SharePoint roles / permissions

  • Inventory SharePoint role assignments of users and groups to SharePoint resources
    
    

    
    
    

• Webs

  • Inventory SharePoint webs

• Site Collections

  • Inventory SharePoint site collections

• User Profile Attribute Flow
  The default SharePoint profile properties that EmpowerID can synchronize with and the naming convention used is shown in the below table. Custom attributes can be added as needed.
  

Azure Components Required by the SharePoint Online Microservice

Key to the SharePoint Online connector is the SharePoint Online (SPO) microservice, which communicates with EmpowerID and your SharePoint to allow you to collect and manage your SharePoint data in EmpowerID. To do so, the microservice needs to be deployed to each SharePoint tenant and each of those tenants needs to be configured with additional Azure components. The number of components needed differs depending on whether you are self-hosting or using EmpowerID SaaS.

Azure Components for Self-hosting EmpowerID

If you are not using EmpowerID SaaS and want EmpowerID to manage one or more of your SharePoint tenants, you need to configure one of those tenants with all of the components shown on the “EmpowerID side” (left) of Figure 1. These components are necessary to inventory SharePoint. In addition to these, you also need to configure each SharePoint tenant to be managed by EmpowerID with all of the components shown on the “Self-hosted” side of Figure 1. The only exception is to this is the Azure AD SCIM app service. This service only needs to be set up once within Azure.

Figure 1 below image depicts the Azure components you need to configure when self-hosting EmpowerID. The purpose for each component is described in the table that follows the figure.

Open

Figure 1: Azure components you need to configure for SharePoint Online when self-hosting EmpowerID

Table 1: Azure Components you need to configure when self-hosting EmpowerID