1

I have a proof of concept that programmatically updates SharePoint 2010 user profile custom properties. To get this working I had to impersonate a user with domain administration permissions which was fine for a PoC in dev however I am now working on a production version using an account with least privilage but I cannot work out how to determine what least privilage actually is.

The custom user profile property is set up as shown in the screen shot below and using my domain admin account I can successfully make and commit (save) updates to the property on the profile of any SharePoint user.

enter image description here

According the Edit User Profile Property screen in Central Admin any users with the "Manage Profile" permission can edit any property value for any user however this seems to be a throwback to SharePoint 2007 (MOSS) as I cannot see anywhere how this permission can be set (or even exists!) in SharePoint 2010.

Any help greatfully received.

Improve this question

2 Answers 2

Reset to default
4

To set the Manage Profiles permissions do as follows:

  1. Go to Central Admin
  2. Choose Application Management > Manage Service Applicatrions
  3. Select the User Profile Service Application (do not click the link)
  4. Click Administrators in the ribbon
  5. Add the user and set the Manage Profiles permission for it
  6. Click OK
  7. Your done!
Improve this answer
3
  • You beat me to it!
    – SPDoctor
    Apr 15, 2011 at 12:55
  • Thanks Wictor (and SPDoctor), that has worked with one of the domain accounts I have set up however it is still not working with another that has less privilages. At least I can now work through the AD permissions on both accounts to determine precisely what permissions are required to update user profiles.
    – Matt Coffey
    Apr 15, 2011 at 15:01
  • 1
    depending on what parts of the object model you touch, you might need to set connection permissions as well (also under User Profile Service App, but instead of clicking Administrator, click Connection (dont have SP here so i think thats what it s called). This is needed if in code you can see your connection manager is null
    – Anders Rask
    Apr 16, 2011 at 10:46
1

If you go to the Service Applications management page in Central Administration, select the User Profile service application row (don't click on the text or you get the UPA management page) then click on Administrators in the ribbon, you can add a user and set the Manage Profile permission. I think this is what they are referring to in the message.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.