Domain enforcement for restricted authentication

Domain enforcement ensures company email addresses are used only with your organization’s identity system. It prevents users from creating personal Adobe accounts with work emails, giving your organization control and visibility while reducing risks.

Benefits of restricting domains

Domain enforcement provides several advantages:

• Block creation of new Adobe ID accounts: Restrict personal accounts with company emails.
• Create a consistent sign‑in workflow: Direct all sign-ins through the organization’s identity provider.
• Limit user accounts and profiles: Eliminate shadow accounts and duplicates.
• Improve collaboration among end users: Ensure asset sharing within the managed environment.
• Block purchase of software for personal use: Prevent unauthorized purchases with company emails.

Managing domain enforcement

Domain enforcement is enabled by default on all newly created Enterprise and Federated directories. Use it to control domain use in the following ways:

• Restrict the creation of Adobe ID accounts with organization-owned domains.
• Transition existing users with Adobe ID accounts to Enterprise ID or Federated ID accounts that require secure login for license and storage access.
• Generate reports indicating which users have Adobe ID accounts with enforced domains.
• Require existing Adobe ID accounts to change the email associated with the account to a personal address.

Domain enforcement best practices

Configure domains and directories strategically to align with your organization's authentication and security requirements.

Link domains to directories: To stop users associated with a particular domain from creating new accounts or using organization email for personal use, you must link the domains with domain-enforcement-enabled directories.

Transfer domains to a different directory: If you want to allow personal use of organization email for users associated with one or more domains, you must transfer these domains to one target directory. Then turn off domain enforcement for this target directory.

Allow automatic account creation: If you want users to create a Federated ID only with their email address, you must enable both domain enforcement and automatic account creation.