How to create profiles where only the “general”, “organization”, “address” and “phone numbers” data of the users can be edited?
AA does not have any GUI functionality to manage those User properties on an individual basis like that. We have Active Templates which have options for users but they are more generic permission sets that would grant control to all of the user's properties.
Some of those operations may potentially be controlled through AD object special permission properties on the user objects. Use this at your own risk, and since it is user object specific it will be a pain because these need to be applied on each user (which you could probably script if you're determined enough). Let's just use the "phone number" one as an example:
Open AA to the Security and Delegations tab
Browse your domain down to the user object you are trying to assign permissions to
Right-click it and do the properties
Click Advanced
Select a principal (presumably the help desk group or whomever needs to edit phone numbers)
In the list of special security permissions below scroll down to the Properties section and then look for "write phone and mail options" as shown in the screenshot below:
Note that there may be more permissions necessary for a user to actually perform the edit operation on the user account.
