Currently there is a single setting in AGOL that controls the abilities for organizational named users to (1) share content publically, (2) share groups publically, and (3) share their profile publically. The suggestion is to remove profile sharing from this setting. Making content/groups public and making a profile public have fundamentally different aims and a different set of risks.
Our users frequently need to be added to groups on multiple AGOL instances (both within our organization and with external organizations). It adds an unnecessary burden to our AGOL administrators to manually flip the profile visibility of our users and this is a task that could be managed individually by users themselves.
One common workflow for us is to create an AGOL account for a user. We use SAML authentication for our named users. The user then has to activate their account. THEN our administrators have to manually make the profile of that new user public. THEN the group manager on another site can add them to the appropriate group. Moving profile visibility to a separate control would simplify this workflow.
