You are deploying Forefront Identity Manager (FIM) to your company network. End users will use the password self-service, user profile management, and group management from the FIM Portal. You use a…

Delegation should not be disabled for the FIM service account; rather, the FIM service account typically requires constrained delegation to allow it to act on behalf of users for self-service scenarios such as password reset and group management.

Disabling delegation for the SharePoint service account is incorrect because SharePoint may require delegation to function properly within the FIM Portal environment, and disabling it would impair functionality rather than fulfill an installation prerequisite.

The FIM installation account requires SQL sysadmin rights because the FIM setup process must create and configure the FIM Service database on SQL Server, which requires elevated database-level permissions during installation.

The FIM installation account must have SharePoint administrator permissions because the FIM Portal is built on SharePoint, and the installer must provision site collections, configure web applications, and deploy solutions within the SharePoint farm.

The SharePoint Application Pool must be configured to use the Configurable (FIM-specific) service account so that the FIM Portal can properly authenticate and communicate with the FIM Service, ensuring the correct identity context for portal operations.