The Adobe Admin Console allows a system administrator to configure domains and directories which are used for login via Federated ID for Single Sign-On (SSO). Once ownership of a domain is demonstrated using a DNS token and it has been linked to a Federated ID directory, users who have e-mail addresses within the claimed domain can log in to Creative Cloud via an Identity Provider system (IdP) once corresponding accounts have been created on the relevant Adobe Admin Console. The process is provisioned either as a software service which runs within the company network and is accessible from the Internet or a cloud service hosted by a third party that allows for the verification of user login details via secure communication using the SAML protocol.
One such IdP is Microsoft Azure, a cloud-based service which facilitates secure identity management.
The Azure AD uses the userPrincipalName attribute or allows you to specify the attribute (in a custom installation) to be used from on-premises as the user principal name in Azure AD. If the value of the userPrincipalName attribute does not correspond to a verified domain in Azure AD, it will be replaced with a default .onmicrosoft.com value.
When a user authenticates to the application, Azure AD issues a SAML token to the app that contains information (or claims) about users that uniquely identifies them. By default, this information includes a user's username, email address, first name, and last name. You can view or edit the claims sent in the SAML token to the application under the Attributes tab and release the user name attribute.
Before configuring a domain for single sign-on using Microsoft Azure as the IdP, the following requirements must be met:
- An approved domain which corresponds to the DNS domain your users reside within, which is linked to a federated directory on your Adobe admin console. For further details, please see our general documentation on setting up identity.
- Microsoft Azure dashboard is accessible and you are logged in as an administrator able to create a new enterprise application
-
Note:
To authenticate users by email, set UserIdentifier to user.mail. To authenticate users by UserPrincipalName, set UserIdentifier to user.userprincipalname.
-
- Use the URL of the EntityID from the metadata in the Identifier field in your Azure configuration:
This address takes the following form: https://www.okta.com/saml2/service-provider/spi1t5qdd3rI7onSl0x78 - Use the URL of the AssertionConsumerService for the Reply URL in your Azure configuration
This address takes the following form: https://adbe-example-dot-com-a8bd-prd.okta.com/auth/saml20/accauthlinktest
- Use the URL of the EntityID from the metadata in the Identifier field in your Azure configuration:
To assign users via Microsoft Azure to permit them to log in using the Adobe Creative Cloud connector, perform the steps below. Note that you will still need to assign licenses via the Adobe admin console.
-
Ensure that you assign the users via Azure.
-
Also, ensure that you add users within the Adobe Admin console as Federated ID and assign them to a group for entitlement.
-
At this point, type your email address/upn into the Adobe sign-in form, press tab, and you are federated back to Azure AD:
- In a web browser: www.adobe.com click sign in at the top right corner of the page
- Within the Creative Cloud Desktop application
- From an Adobe Creative Cloud application such as Photoshop or Illustrator from the menu Help > Sign in...
If you encounter problems, please see our troubleshooting document.
Twitter™ and Facebook posts are not covered under the terms of Creative Commons.