Shared Device Licensing overview

If you manage labs or classrooms where students rotate through shared workstations, you need a licensing model that ties software to machines rather than individuals. Shared Device Licensing addresses this challenge by assigning Creative Cloud apps to devices rather than to user accounts. Anyone who accesses the machines can launch the installed apps.

What is Shared Device Licensing

Shared Device Licensing is device-based licensing for shared computers. Rather than associating licenses with individual users, Shared Device Licensing ties them to the machine. Users see a sign-in prompt when they launch an app. A banner indicates the machine uses shared device licensing and reminds users to sign out when finished and to avoid storing files locally.

Shared Device Licensing isn't designed for use on machines used by dedicated users. For dedicated users, we recommend you deploy named-user licenses.

Shared Device Licensing versus Named User Licensing

Named User Licensing ties the license to a user's identity. When the user signs in, they can activate Adobe apps on any computer they have access to. The license travels with the user across devices and provides full access to cloud services like Adobe Fonts, cloud storage, and Creative Cloud Libraries.

Shared Device Licensing ties the license to a specific computer. Apps activate only on machines where you've installed the license package, regardless of who signs in. Users must still authenticate with valid credentials to launch apps, but the license itself resides on the device. This means a single shared device license supports unlimited users on a particular machine.

Here are the key differences between the two licensing types:

• License location: Named licenses follow the user, shared device licenses stay with the machine
• Service access: Named licenses include cloud storage and libraries by default. Shared device licenses don’t provide these entitlements, but users with individual service access can still use them.
• Deployment scope: Named licenses activate on any device the user accesses. However, shared device licenses work only on specifically configured machines

You can read more about the Adobe licensing methods if you're deciding between the two models.

End user experience

When a user launches an app on a shared device, they see a prompt to sign in with their Adobe credentials. The app displays a banner indicating the machine is configured for shared device licensing. It reminds users to sign out when finished and not to store files locally on the shared computer.

The credentials users need depend on how you've set up identity for your organization: Enterprise ID, Federated ID, or Adobe ID, depending on your access policies. Successful sign-in grants access to the installed applications.

If the user's account includes additional entitlements, such as Adobe Fonts or cloud storage, the services remain available during the session.

Controlling access to shared devices

Use the Admin Console to restrict who can use apps on shared devices and where devices can operate. Layer these controls to match your security needs.

Identity types

You configure identity requirements through product profiles in the Admin Console. Your choices determine what kind of accounts can access the apps:

• Enterprise ID or Federated ID: Organization-owned identities you manage directly. K-12 schools must use these identity types. They provide complete control over account creation, lifecycle, and data ownership.
• Adobe ID: Personal accounts owned by individual users. Higher education institutions may allow Adobe IDs for open-access scenarios, though the individual or organization may legally own the data depending on the account configuration.

Learn more about the identity types supported on the Admin Console.

Access policies

Access policies define which types of users can launch apps on your shared devices:

• Open Access: Anyone with a valid Adobe account can sign in and use the apps, including users with personal Adobe IDs who aren't part of your organization. Use it for public computer labs where visitors, students, and staff all need access.
• Organization users only: Limits access to accounts you've added to your Admin Console, regardless of identity type. It prevents unauthorized external users from accessing apps while still supporting any identity configuration you've implemented.
• Enterprise/Federated users only: Restricts access exclusively to Enterprise ID and Federated ID accounts. Personal Adobe IDs cannot launch apps even if the user is affiliated with your organization. Use it for K-12 environments to ensure only verified students access the software.

Egress IP address restrictions

Egress IP controls prevent shared device apps from activating when devices connect from outside your approved networks. You specify public IP address ranges that your lab networks use when connecting to the internet. If someone moves a portable shared device to a different network, the apps won't activate even though the license is installed.

This control applies to lab machines and laptops. Update IP ranges in the Admin Console when your provider changes them if you don't use static IPs.

Machine associations

Organize shared devices into product profiles based on infrastructure attributes to simplify management across many devices:

• Microsoft Active Directory organizational units: Machines belonging to specific OUs automatically associate with designated product profiles. If your IT structure organizes computers by department, you can create product profiles that mirror those divisions.
• LAN IP address ranges: Machines with addresses in specified local network ranges associate with product profiles. Use it when your labs or library computers occupy defined network segments.
• Installed packages: Machines with specific license packages installed automatically belong to the corresponding product profiles. Use this approach when building different packages for different computer types or locations.

When a machine matches multiple product profiles, the Admin Console applies them in order of priority. Organizational unit takes precedence, then LAN IP range, then package assignment.

Once you've decided on your identity approach and access policies, see Deploy Shared Device Licensing for the full setup process, including creating deployment packages, assigning product profiles, and distributing packages to shared devices.

Migrating to Shared Device Licensing

Organizations can transition from older licensing models to Shared Device Licensing:

From Device Licensing: Adobe provided complimentary upgrades from the legacy Device Licensing program to Shared Device Licensing. The older Device Licensing program doesn't provide access to the latest version of Creative Cloud apps. After migration, previously licensed apps continue working for 30 days while you create and deploy new shared device license packages.

From Serial Number Licensing: You can deploy shared device license packages alongside serial number packages. Both licensing methods coexist on the same machine. Continue using serial-number–licensed apps until their licenses expire. Alternatively, uninstall them and deploy only shared device packages for newer app versions.

Migration to Shared Device Licensing is permanent and cannot be reversed.