Creative Cloud for education | Deployment Guide

Sign in to the Admin Console.

In addition to the licenses purchased, the Overview page shows New Free Offer cards for Spark with Premium Features.

Click Getting Started.

On the Confirm Type of Organization screen, select the category that your organization belongs to.

Agree to the terms and conditions, if you select K-12, Primary & Secondary Education.

Click Confirm and Continue.

The Overview page shows the card for Spark with Premium Features. You can now start deploying Spark for your users.

Identify the domain administrator in your school/district.

The school/district owns the named user licenses given to K-12 (Primary/Secondary) students (For Adobe Spark or All Apps). So, these licenses must be deployed using Enterprise or Federated IDs. As part of the setup, you have to prove that you own the domain, by updating the DNS records. If you do not have access, ensure that you let the domain admins know to make that update for you.

Plan the Identity system for your organization. Decide if you want to set up Enterprise ID users or Federated ID type users.

If you want to set up single sign-on (SSO), identify the administrator for the school-provided IDs (login credentials).

Set up SSO if students have Google Suite IDs provided to them, and you want to use these IDs to sign in to Adobe apps. If you do not want to set up single sign-on, use Enterprise IDs.

Navigate to Admin Console > Settings, and click Start Identity Setup.

Click Create Directory, enter a name for the directory, select an identity type, and click Create Directory.

Close the confirmation screen.

Click Add Domains. Enter your domains and click Next.

Ensure that you claim the domains that your users have for their login ID. For example, if a user signs in with joestudent@schoolabc.edu, then claim schoolabc.edu.

If users sign in using several domains (For example, if you have separate domains for teachers and students), claim all of them here. You can claim more than one domain at a time by adding comma-separated values. (For Example, schoolabc.edu, abcteachers.edu, abc staff.edu)

Verify the list of domains and click Add Domains.

On the Setup Identity screen that appears, click Get DNS token and then click Copy Record Value.

Visit your Domain management dashboard (For example, Google Domains or GoDaddy)

Under My Domains, click Configure DNS for your domain.

Add a TXT record and enter the token copied earlier from the Adobe Admin Console.

Enter the values for Name, Type, and TTL as shown in the screenshot below.

Return to the Adobe Admin Console. If your domain has not been automatically validated, click Validate. Then, click Validate Now.

You receive an email notification when your domain is validated.

• If you have created an Enterprise ID identity type directory, you are done. You can test your setup and proceed further.
• If you have created a Federated ID identity type directory, configure SSO after you receive an email from Adobe confirming that your directory is provisioned.

Visit your Identity Provider’s admin console (For example, G-Suite)

Navigate to Apps > SAML apps > Enable SSO for a SAML application.

On the Enable SSO for SAML Application screen, click Setup My Own Custom App.

The Google IdP Information screen displays. Note the SSO URL, Entity ID, download the certificate, and click Next.

Change the .pem extension of the certificate file to .cer by renaming the file.

Go back to the Adobe Admin Console. Navigate to Settings > Identity > Directories, and click Configure for the relevant directory.

On the Configure Directory screen, do the following:

• Upload the certificate.
• Paste the Entity ID and SSO URL.
• Select HTTP - Post as the IdP Binding.
• Select Email as the User Login Setting.
• Click Complete Configuration.

In the Adobe Admin Console, click Download Metadata. To complete the configuration, upload this metadata XML file to the Google Admin Console.

To show that you understand the need to complete the configuration with your identity provider, select the check-box, and click Complete.

Open the XML file in a plain text editor (For example, Notepad on Windows, or TextEdit on Mac). And, locate the strings entityId and Location in the Metadata file.

Go back to G-Suite screen and complete the basic Information for your Custom App and click Next.

Paste the entityId and Location on the Service Provider Details screen and click Next.

Add a new mapping on the Attribute Mapping screen as shown below, and click Finish.

On the Setting up SSO for Adobe screen that displays, click Ok.

Change the settings for Adobe Creative Cloud to On For Everyone.

Now, in the Adobe Admin Console, on the Configure Directory screen. To confirm that you have completed the configuration with your Identity Provider, select the check-box and click Complete.

Your directory is now configured for Single Sign-On, you can start adding users to your directory.

In the Admin Console, navigate to Users > Users, and click Add User.

Enter the email address of the user. Select Add as Federated ID User or Add as Enterprise ID User.

Select the Country, and enter the First Name and Last Name of the user.

To assign products to the user, navigate to Assign Products. Click a product, select a profile for the product, and save the changes.

The list of products that displays, is based on the purchase plan of your organization. For details on products and profiles, see Manage products and profiles.

Once you've successfully created the user and assigned a product, you receive an email on the associated email account. Follow the instructions in the email.

In the Admin Console, navigate to Products.

A list is displayed of all Adobe product plans for which you are an administrator.

Select the desired product plan, and click New Profile.

The Create a New Profile wizard displays.

On the Details screen, enter a profile name, display name, description, and click Next.

To automatically notify users by email when they are added or removed from this profile, enable User Notifications.

On the Quota screen, choose the target number of licenses allotted for this profile, and click Next.

On the Services screen, you can choose to enable or disable individual services for the Product Profile.

Click Done to save the new profile.

In the Admin Console, navigate to Users > User Groups, and click New User Group.

Enter a name and description for the user group and click Save.

The description does not play any role in the setup and is for information purposes only. However, enter a name and description that indicates the purpose of the group.

Also, you can add an admin specific to a user group, called the User Group Administrator.

To add a User Group Administrator, click the group name. Navigate to Admins, and click Add Admin.

Enter the email address for the admin. You can search for existing users or add new users by specifying a valid email address, and filling the information on the screen.

Click Save.

To manage the entitlements given to users, assign Product Profiles to the user group.

Click the group name, navigate to Assigned Product Profiles, and click Assign Product Profile.

Add the desired Product Profiles to the user group, and click Save.

In the Admin Console, navigate to Users > Users, click , and Choose Add Users by CSV from the drop-down list.

In the Add Users by CSV dialog box, click Download CSV Template, and choose Standard template.

Open the downloaded CSV template in a spreadsheet editor like Microsoft Excel, and paste your users into the template like the screenshot below.

For a description of the fields in the downloaded file, see CSV File format.

For Enterprise IDs and Federated IDs, columns A to G are mandatory. 

If you are using user groups to manage access to products, assign users to the appropriate groups using columns K and L. In this case, you can leave the other cells empty.

Drag the updated CSV on to the Add Users by CSV dialog box and click Upload.

For more information on bulk operations, see Manage Users and Bulk Operations.

Install SAML trace add-on in user browser.

Ensure that the user is signed out of Adobe account.

Locate and click the SAML Trace window from the SAML icon in the toolbar.

A separate window displays. Move it out of the way and leave it open.

Navigate to www.adobe.com, and click Sign In and proceed as far as possible through login.

When the issue occurs, navigate to the SAML trace window as shown in the below screenshot.

Locate and click the POST line in Orange with SAML tag that ends in ‘accauthlinktest’.

Click SAML (next to HTML and Parameters).

Copy all contents to text file and include with new support case.

To perform SSO triage, locate the 4 mandatory SAML 2.0 assertions:

1. NameID
2. FirstName
3. LastName
4. Email

• Case must exactly match that shown in the list above.
• Check the values next to each and validate that each is populated.
• Check Email matches NameID and conversely.
• Check Email and NameID format are both correct and complete.

A mismatch between the network user account and the Adobe user account name causes SSO to fail.

Another good place to check when problems arise is the Adobe Admin Console under Settings - Identity - <click domain> - Event Logs. These logs are provided from the SP (Okta) syslog. There can be a few minutes delay for the log to update.