Sign in to the Admin Console and navigate to Settings > Identity.
Last updated on
Aug 3, 2026
Use SAML integration to enable single sign-on between your AD FS server and Adobe Admin Console.
Follow the steps outlined in the article to set up federated authentication with Microsoft Active Directory Federation Services (AD FS). Users sign in to Adobe apps with their corporate credentials through your AD FS server. AD FS versions 2.0 and 3.0 are supported. To modify an existing SSO configuration, repeat all steps in the procedure after making changes in the Admin Console.
Before configuring AD FS integration, ensure you have:
- Microsoft Windows Server with AD FS installed and updated
- Server accessible from user workstations via HTTPS
- Security certificate obtained from the AD FS server
- TLS 1.2 and forward secrecy enabled for macOS access
- Email addresses configured for all Active Directory accounts
- System Admin role assigned in the Adobe Admin Console
Create a Federated ID directory
Select Create Directory and choose Federated ID as the identity type.
Enter a directory name and select Other SAML Providers as the identity provider.
Select Download Metadata File and save the Adobe metadata file to your local system.
Keep the Create directory wizard open. You'll return to upload the IdP metadata file later.
Configure the AD FS server
Caution
Repeat all subsequent steps after any change to the values in the Adobe Admin Console for a given domain.
Open the AD FS Management application and navigate to AD FS > Trust Relationships > Relying Party Trusts.
Select Add Relying Party Trust to launch the wizard.
Select Start, choose Import data from a relying party from a file, and browse to the Adobe metadata file you downloaded.
Enter a name for the relying party trust and add notes if needed, then select Next.
Choose whether multi-factor authentication is required and select Next.
Confirm that all users can sign in via AD FS, then select Next.
Review your settings and select Next.
Leave Open the Edit Claim Rules dialog checked and select Close.
Configure claim rules
Note
Use the email address as the primary identifier for Claim Rules. We don't recommend mapping the User Principal Name (UPN) to the email field. UPNs often differ from actual email addresses, which can break notifications and asset sharing in Creative Cloud.
In the Edit Claim Rules dialog, select Add Rule.
Choose Send LDAP attributes as Claims as the template and select Next.
Enter a claim rule name and select Active Directory as the attribute store.
Map the LDAP Attribute E-Mail-Addresses to Outgoing Claim Type E-Mail Address, then select Finish.
Select Add Rule again and choose Transform an incoming claim.
Set Incoming Claim Type to E-Mail Address, Outgoing Claim Type to Name ID, and Outgoing Name ID Format to Email.
Select Pass through all claim values and choose Finish.
Select Add Rule once more and choose Send Claims Using a Custom Rule.
Enter the following rule in the custom rule field: c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname", Issuer == "AD AUTHORITY"] => issue(store = "Active Directory", types = ("Email", "FirstName", "LastName"), query = ";mail,givenName,sn;{0}", param = c.Value);
Select Finish, then select OK to close the Edit Claim Rules dialog.
Note
Claim rules must appear in the order shown. The email address is the recommended primary identifier. You can use User Principal Name (UPN) as the LDAP attribute, but UPN often differs from email addresses, which can cause issues with notifications and asset sharing.
Set time skew tolerance
In the AD FS Management application, select AD FS > Service.
Right-click AD FS and select Edit Federation Service Properties.
Set the time skew value to 2 minutes to avoid connectivity problems when system clocks differ slightly.
Select Ok to save the change.
Download the AD FS metadata file
In the AD FS Management application, navigate to AD FS > Service > Endpoints.
Locate the Federation Metadata endpoint and copy its URL path.
Open a web browser and navigate to https://your-adfs-hostname/FederationMetadata/2007-06/FederationMetadata.xml. Replace your-adfs-hostname with your actual AD FS server hostname.
Accept any security warnings if prompted, then save the XML file to your local system.
Tip
To find your AD FS hostname on Windows, open Windows PowerShell as Administrator, type Get-AdfsProperties, press Enter, and locate the Hostname value.
Upload the IdP metadata file
Return to the Adobe Admin Console Create directory wizard.
In the Add SAML Profile screen, select Upload Metadata File.
Browse to the AD FS metadata XML file and select Open.
Select Next and configure automatic account creation settings if desired.
Select Done to complete directory creation.
