Set up identity with SSO

Single Sign-On (SSO) allows your users to access Adobe products using the same credentials they use for other organizational applications. Rather than managing separate Adobe passwords, users authenticate through your organization's existing identity provider (IdP), streamlining access and strengthening security.

Setting up SSO for Adobe products requires configuring Federated ID accounts that link your enterprise directory to Adobe via federation. This integration gives your organization control over authentication while Adobe continues to host the identity records.

The role of Federated ID in SSO

Federated ID is the only identity type that supports SSO with Adobe products. Unlike Adobe ID (user-managed) or Enterprise ID (Adobe-authenticated), Federated ID routes all authentication requests through your organization's identity provider using the SAML 2.0 protocol.

This architecture is valuable for:

• Enterprise directory provisioning based on Active Directory or Azure AD
• Centralized control over authentication policies, including multi-factor authentication requirements
• Strict governance over app and service access
• Regulatory or security requirements that mandate organizational authentication management

When users with Federated IDs sign in to Adobe applications, they're redirected to your IdP, authenticate there, and are passed back to Adobe with a secure token confirming their identity.

SSO integration approaches

Adobe Admin Console supports three primary integration paths, each suited to different infrastructure environments.

Azure AD integration is the recommended approach for organizations that use Microsoft's cloud identity platform. The Azure AD connector simplifies configuration and automates user synchronization between Azure AD and the Admin Console, reducing ongoing administrative overhead.

SAML-based IdP integration provides flexibility for organizations that use identity providers other than Azure AD or Google. Any SAML 2.0–compliant IdP, including Okta, Ping Identity, Shibboleth, or AD FS, can federate with Adobe through this path. You configure the integration by exchanging SAML metadata between your IdP and the Admin Console.

Google Workspace integration mirrors the Azure AD approach for organizations standardized on Google's identity infrastructure. Like Azure AD, the Google connector supports both SSO setup and ongoing user synchronization.

Each integration requires you first to create a directory in the Admin Console (Settings > Identity > Directories), claim and verify your email domains, and then configure the connection to your IdP. The specific configuration steps vary by provider, but the conceptual model remains consistent: Adobe delegates authentication to your IdP while maintaining user and entitlement records in the Admin Console.

Post-setup identity infrastructure

Once SSO is operational, ongoing identity management centers on directories, domains, and directory trusts.

Directories serve as containers for SSO configuration and users. Each directory connects to a single IdP configuration, though you can create multiple directories if your organization uses multiple identity providers or needs to segment authentication policies by business unit.

Domains determine which users authenticate through which directory. When you link a domain—such as example.com—to a directory, any user with an email address at that domain is routed to that directory's IdP for authentication. Domain management also includes managing directory trusts when multiple Adobe organizations claim the same domain.

Changing identity providers requires coordination to avoid disrupting user access. The Admin Console supports migrating authentication providers by allowing you to configure a new directory, move domains, and transition users between directories. You can also move domains across directories or remove legacy directory users as your infrastructure evolves.

Understanding these management concepts helps you maintain stable authentication as organizational needs change, whether that means consolidating multiple IdPs, migrating from one vendor to another, or restructuring how business units map to directories.