11

In SharePoint 2010 is it possible to delegate permissions to a user so they can edit other users profile properties through the standard web interface i.e. not through Central Administration?

An example would be allowing an HR employee to update other employees Job Titles. I would not want to allow any employee to update their own Job Title.

This question applies to MySites and the User Profile page used when MySites is not activated.

Thanks!

Improve this question

2 Answers 2

Reset to default
9

Contrary to the accepted answer, there's a number of ways to accomplish this using out-of-the-box SharePoint 2010 features.

  1. You can allow certain users permissions to manage any user profile in the system by granting them Manage Profiles permissions in Central Admin. You can find more info on TechNet: Assign administration of User Profile service features (SharePoint Server 2010) Manage Profiles permissions for User Profile Service Application
  2. For more granular control, each user can choose an Assistant who would then be able to edit the user's profile. User Profile Assistant
Improve this answer
5
  • Do you know if claims-based authz is supported with the Assistant field? Specifically, suppose that I've managed to customize the user profile page in a way that lets me select the assistant from a custom Claims Provider. When I tried that, the claim was resolved nicely and stored correctly, but when a person with that claim tried editing, it didn't let them.
    – Rytmis
    Commented Aug 14, 2012 at 19:05
  • I don't have an environment to test this using claims-based authentication but I believe this should work. What claims authentication provider are you using?
    – Vassili Altynikov
    Commented Aug 14, 2012 at 19:40
  • A custom provider. But I already resolved the answer to the question: it doesn't work and there's not much I can do about it. I decompiled the implementation of the page and related controls, and it turns out that the UserProfile compares the current user AccountName to whatever is the key of the PickerEntity in the picker. That means encoded claims won't (can't) work.
    – Rytmis
    Commented Aug 16, 2012 at 11:52
  • I'm disappointed to see that the accepted answer changed. Two key points in the question was that they did not want to do it through CA, but your first solution would require taht they use Profile Admin in CA. Second they were looking for the user to update a specific field and NOT do it through CA. You are not going to set HR to be the assistant for every person, and if you did that person would be able to edit every field shown on the edit form.
    – Mike Oryszak
    Commented Aug 23, 2012 at 15:10
  • Yes, this may not be the perfect answer as users granted manage profiles access this way are able to edit any field the profile owners can. I agree that the custom form gives more control. Approach #1 is still valid though as it only requires to grant the manage profiles permissions through Central Admin - the users don't need to go through Central Admin to edit other users' profiles.
    – Vassili Altynikov
    Commented Aug 23, 2012 at 15:59
1

This is not supported through the system, but it can be done with custom code running against an administrator account. This approach would also allow you to simplify the interface so that only the specific fields you want them to edit are displayed instead of the entire profile.

Improve this answer
5
  • Can you elaborate on your approach please? Is this in relation to MySites or the User Profile page? I was under the impression that you can configure which fields are displayed/editable by the user through the user profile properties area of Central Administration? Cheers
    – Jonny
    Commented Jun 8, 2010 at 8:16
  • Sorry for not making it clear, there are a number of concepts here so it may take a few comments to get through it.
    – Mike Oryszak
    Commented Jun 8, 2010 at 12:58
  • Within the default system you cannot grant users access to edit somebody else's profile through the regular profile interface. You can do it through Central Administration, but as you mentioned, this is not a good option. The alternative is to create a custom form that reads/writes the profile fields. To make this work you will need to provide an administrator account that has access to edit the profiles.
    – Mike Oryszak
    Commented Jun 8, 2010 at 13:00
  • There is configuration within the User Profiles area that allows you to define which fields the user can edit and where they are shown. This specifically handles the rendering of the Person.aspx page and accessibility of the fields via the web services for users (based on relationship). If you are building a custom form and executing running it as an Administrator then technically you will have access to edit EVERY field in the user's profile that is editable. There are probably 3x as many fields in the profile than actually show up on the normal Profile page.
    – Mike Oryszak
    Commented Jun 8, 2010 at 13:03
  • Since you are using a custom form, you can control specifically which of the fields are available. You have more control over the profile editing, but you have to do all of the leg work to create the page.
    – Mike Oryszak
    Commented Jun 8, 2010 at 13:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.