Frequently asked questions | Azure Active Directory authentication and sync

  1. Adobe Enterprise & Teams: Administration guide
  2. Plan your deployment
    1. Basic concepts
      1. Licensing
      2. Identity
      3. User management
      4. App deployment
      5. Admin roles
    2. Deployment Guides
      1. Named User deployment guide
      2. SDL deployment guide
    3. Deploy Creative Cloud for education
      1. Deployment guide
      2. Integration with Canvas LMS
      3. Integration with Blackboard Learn
      4. Configuring SSO for District Portals and LMSs
      5. Kivuto FAQ
      6. Primary and Secondary institution eligibility guidelines
  3. Set up your organization
    1. Set up identity
      1. Identity types | overview
      2. Set up organization with Enterprise ID
      3. Set up organization with Federated ID
        1. SSO overview
        2. Setup Azure Connector and sync
          1. Set up SSO with Microsoft via Azure OIDC
          2. Add Azure Sync to your directory
          3. Azure Connector FAQ
        3. Set up Google Federation and sync
          1. Set up SSO with Google Federation
          2. Add Google Sync to your directory
          3. Google federation FAQ
        4. Generic SAML
          1. Set up SSO with other SAML providers
          2. Set up SSO with Microsoft Azure ADFS
          3. SSO Common questions
          4. SSO Troubleshooting
        5. Education SSO
          1. Configure SSO for District Portals and LMS
          2. Common questions
          3. Dovetail
      4. Verify ownership of a domain
      5. Add and manage domains
      6. Link domains to directories
      7. Use directory trust to add pre-claimed domains
      8. Migrate to new authentication provider
    2. Asset settings
    3. Authentication settings
    4. Privacy and security contacts
    5. Console settings
    6. Manage encryption
  4. Manage products and entitlements
    1. Manage users
      1. Overview
      2. Administrative roles
      3. User management techniques
        1. Manage users individually   
        2. Manage multiple users (Bulk CSV)
        3. User Sync tool (UST)
        4. User management API (UMAPI)
        5. Microsoft Azure Sync
        6. Google Federation Sync
      4. Change user's identity type
      5. Manage user groups
      6. Manage directory users
      7. Manage developers
      8. Migrate existing users to the Adobe Admin Console
      9. Migrate user management to the Adobe Admin Console
    2. Manage products and product profiles
      1. Manage products
      2. Manage product profiles for enterprise users
      3. Manage self-service policies
      4. Manage app integrations
      5. Manage product permissions in the Admin Console  
      6. Enable/disable services for a product profile
      7. Single App | Creative Cloud for enterprise
      8. Optional services
    3. Manage Shared Device licenses
      1. What's new
      2. Deployment guide
      3. Create packages
      4. Recover licenses
      5. Migrate from Device Licensing
      6. Manage profiles
      7. Licensing toolkit
      8. Shared Device Licensing FAQ
  5. Manage storage and assets
    1. Storage
      1. Manage enterprise storage
      2. Adobe Creative Cloud: Update to storage
      3. Manage Adobe storage
    2. Asset migration
      1. Automated Asset Migration
      2. Automated Asset Migration FAQ  
      3. Manage transferred assets
    3. Reclaim assets from a user
    4. Student asset migration | EDU only
      1. Automatic student asset migration
      2. Migrate your assets
  6. Manage services
    1. Adobe Stock
      1. Adobe Stock credit packs for teams
      2. Adobe Stock for enterprise
      3. Use Adobe Stock for enterprise
      4. Adobe Stock License Approval
    2. Custom fonts
    3. Adobe Asset Link
      1. Overview
      2. Create user group
      3. Configure Adobe Experience Manager 6.x Assets
      4. Configure and install Adobe Asset Link
      5. Manage assets
      6. Adobe Asset Link for XD
    4. Adobe Sign
      1. Set up Adobe Sign for enterprise or Teams
      2. Adobe Sign - Team feature Administrator
      3. Manage Adobe Sign on the Admin Console
    5. Creative Cloud for enterprise - free membership
      1. Overview
      2. Getting started
  7. Deploy apps and updates
    1. Overview
      1. Deploy and deliver apps and updates
      2. Plan to deploy
      3. Prepare to deploy
    2. Create packages
      1. Package apps via the Admin Console
      2. Create Named User Licensing Packages
      3. Adobe templates for packages
      4. Manage packages
      5. Manage device licenses
      6. Serial number licensing
    3. Customize packages
      1. Customize the Creative Cloud desktop app
      2. Include extensions in your package
    4. Deploy Packages 
      1. Deploy packages
      2. Deploy Adobe packages with SCCM
      3. Deploy Adobe packages with ARD
      4. Install products in the Exceptions folder
      5. Uninstall Creative Cloud products
      6. Use Adobe provisioning toolkit enterprise edition
      7. Adobe Creative Cloud licensing identifiers
    5. Manage updates
      1. Change management for Adobe enterprise and teams customers
      2. Deploy updates
    6. Adobe Update Server Setup Tool (AUSST)
      1. AUSST Overview
      2. Set up the internal update server
      3. Maintain the internal update server
      4. Common use cases of AUSST   
      5. Troubleshoot the internal update server
    7. Adobe Remote Update Manager (RUM)
      1. Use Adobe Remote Update Manager
      2. Channel IDs for use with Adobe Remote Update Manager
      3. Resolve RUM errors
    8. Troubleshoot
      1. Troubleshoot Creative Cloud apps installation and uninstallation errors
      2. Query client machines to check if a package is deployed
      3. Creative Cloud package "Installation Failed" error message
    9. Create packages using Creative Cloud Packager (CC 2018 or earlier apps)
      1. About Creative Cloud Packager
      2. Creative Cloud Packager release notes
      3. Application packaging
      4. Create packages using Creative Cloud Packager
      5. Create named license packages
      6. Create packages with device licenses
      7. Create a license package
      8. Create packages with serial number licenses
      9. Packager automation
      10. Package non-Creative Cloud products
      11. Edit and save configurations
      12. Set locale at system level
  8. Manage your account
    1. Manage your Teams account
      1. Overview
      2. Update payment details
      3. Manage invoices
      4. Change contract owner
    2. Assign licenses to a Teams user
    3. Add products and licenses
    4. Renewals
      1. Teams membership: Renewals
      2. Enterprise in VIP: Renewals and compliance
    5. Purchase Request compliance
    6. Value Incentive Plan (VIP) in China
    7. VIP Select help
  9. Reports & logs
    1. Audit Log
    2. Assignment reports
    3. Content Logs
  10. Get help
    1. Contact Adobe Customer Care
    2. Support options for teams accounts
    3. Support options for enterprise accounts
    4. Support options for Experience Cloud

This document covers common questions encountered while configuring authentication between Microsoft Azure Active Directory (Azure AD) and Azure Sync with a federated directory. Additional information regarding the deprecated Azure Sync is also available for reference.

Azure Sync | Frequently asked questions

You can find answers to some of the frequently asked questions and important considerations below:

You can only create Federated ID user accounts through Azure Sync. Learn more about the identity type options here.

Yes. Refer to Provisioning logs in Azure Active Directory to learn more.

Adobe has upgraded the Azure Sync experience to provide enhanced security and other privacy controls to partner organizations. The updated Azure Sync does not require any permissions into your organization’s Azure Directory to sync users to the Adobe Admin Console.

As we no longer support the previous version, you must update to the enhanced version: Azure Sync with SCIM.

The SCIM protocol allows you and your Identity Provider to control the data flow. If Azure Sync doesn't sync data over to Adobe, check Provisioning logs for the Adobe Identity Management application inside your Azure AD Portal.

Yes. This allows users to use a differing email and username value to validate sign-in and access Adobe products/services, collaborate, share files, and so on.​

The Azure Sync can only provide user management for the primary Admin Console in a primary-trustee Admin Console relationship. Any trustee Admin Consoles can take advantage of single sign-on with the federated directory but must use a separate form of user management (such as CSV manual upload, User Sync Tool, or User Management API.)

Your organization must have a Premium (P1 or P2) or Microsoft 365 (E3 or A3) subscription with Azure AD to use group-based assignment capabilities. It allows you to choose specific groups and users to be synced to the Adobe Admin Console.

Organizations without these subscription levels can only sync all the users and groups to the Adobe Admin Console at once. The system will sync all users and groups automatically and generate an Adobe Federated ID for the synced users. Read more about Azure AD subscription plans and options for updating.

Yes. You can sync nested groups from Azure AD through the Azure Sync integration.

However, nested groups are not automatically synced when the parent node of the group is added to sync scope. You must add nested groups to scope to be included in the automated sync.

Yes. Any update in Azure AD reflects in the Adobe Admin Console directory. This includes attributes like, FirstName, LastName, Email, etc.

Yes. To use Azure Sync with such a directory, you must have your users managed within an Azure AD instance.

Sync cycles are controlled by Azure AD, it runs once every 40 minutes. The amount of time to add and update users in the Adobe Admin Console depends on the number of users within the sync scope.

 

The Account Status column appears in both the Users and Directory Users list to inform administrators of the status of a specific user.

For federated users synced with Azure Active Directory, users are managed in a read-only mode via Azure Sync, and the status depends on their status within the organization’s directory:.

  • Active = User account available for SSO login and license access. If sync is configured, an ‘Active’ user is in-scope for the automated sync.

  • Disabled = User account not available for SSO login or license access. If sync is configured, a ‘Disabled’ user is removed from sync scope in the organization’s Azure Active Directory, causing the user to no longer have login access to their account, but their cloud-stored assets are still available.

Note:

You cannot run Azure Sync alongside any other form of user management tool.

If your organization is using the User Sync Tool or a UMAPI integration, you must first pause the alternate form of sync, then follow the steps to set up Azure Sync to automate user management from the Azure Portal.

The User Sync Tool or UMAPI integration can be removed completely once the Azure Sync is configured and running.

Follow these instructions to edit identity type to Federated IDs.

There is a set of common error messages displayed to be aware of when managing Azure Sync by Microsoft Azure. Understanding the cause of the various error messages will aid in troubleshooting when errors occur.

Learn more about monitoring your deployment within Azure AD. Follow troubleshooting sync for more methods.

Yes. You can choose to disable or even remove Azure Sync from a federated directory. This removes the automated sync but leaves the directory, domains, and users of the directory intact.

When removing sync, User Provisioning should also be turned off for the former sync in Azure AD to prevent quarantine of the directory by Azure AD.

By default, when users are no longer managed through Azure Sync, they only get disabled to avoid accidental data loss.

To remove the users permanently, you must enable editing of synced users from the Sync tab and remove the users manually in the Admin Console.

Upon the deprecation date, the deprecated Azure Sync will automatically be removed from all directories. Associated directories will still have synced users, provisioned licenses, and cloud-stored assets intact but will require enhanced Azure Sync or another form of user management.

Deprecated Azure Sync | Common questions

Adobe has upgraded the Azure Sync experience to provide enhanced security and other privacy controls to partner organizations. The updated Azure Sync does not require any permissions into your organization’s Azure Directory to sync users to the Adobe Admin Console.

As we no longer support the previous version, you must update to the enhanced version: Azure Sync with SCIMIf you have not yet updated to the latest version, you may find resolutions to your query in this section.

You can only create Federated ID user accounts through Azure Sync. Learn more about the identity type options here.

The Azure Sync can only provide user management for the primary Admin Console in a primary-trustee Admin Console relationship. Any trustee Admin Consoles can take advantage of single sign-on with the federated directory but must use a separate form of user management (such as CSV manual upload, User Sync Tool, or User Management API.)

You can only run UST for the domains that are not managed by the Azure AD. There will be a conflict if you run UST on an Azure AD-managed domain.

Yes, it does, and no additional configuration is needed.

FirstName, LastName, Username, Email, and Country Code.

The sync runs every hour, making updates to the Admin Console based on the changes identified in the aligned Azure AD security groups. Azure Sync landing page has a Trigger Sync feature available in the Admin Console, that allows a System Admin to force a sync at any time between the 15-minute intervals. However, you may experience a slight delay when you force Trigger Sync if you use on-premise Active Directory.

Follow these instructions to edit identity type to Federated IDs.

Yes, as long as the SAML directory links to separate claimed domains.

Yes. If the user's email is updated in Microsoft Azure or Microsoft Office 365, then Admin Console email and username fields update accordingly.

If the user is a part of the group sync and the Federated ID username matches an Azure AD-synced username, then Azure Sync takes over and manages the profile. If the user is not a part of the group sync, the user is able to authenticate as long as the profile matches the Azure AD profile.

Adobe logo

Sign in to your account