User Guide Cancel

Manage user groups

Applies to enterprise.

Create, manage, and share user groups in the Global Admin Console to streamline user management by grouping users with the same permissions, saving time, and ensuring consistency. 

In the Global Admin Console, select an organization, and navigate to User Groups. Share groups across multiple organizations using a single user management source to sync users and groups.

Create user groups

You can either create these user groups individually, in bulk, or directly sync them from an established Azure AD to a federated directory in the Adobe Admin Console. In the Global Admin Console, you can define user groups with relevant product profiles assigned, to which the user group admins can later add users using the Admin Console.

  1. Sign in to the Global Admin Console, select an organization to edit, and then navigate to the User Groups tab.

  2. Select Add User Group.

    Organizations tab in the Global Admin Console with the user Groups tab selected.
    Add user groups to an organization to streamline user management.

  3. Enter the following in the Add User Group dialog box that appears:

    • Name: specify a name for the user group
    • Product Profiles: if you want to grant product access to the current or future members in the user group, click the drop-down arrow to select a Product Profile from the list, or enter the Product Profile name and select it from the drop-down list that displays. If you want to add a product profile that hasn't already been created, you must first do that using the Product Profiles tab.
    • Admins: click the drop-down arrow to select an admin from the list, or enter the admin's email address and select it from the drop-down list that displays. If you want to add a new admin that hasn't already been created, you must first do that using the Admins tab.

    The product profiles you specify are assigned to the User Group, and the admins you specify become the user group admins for the group. The user group admins can use the Adobe Admin Console for the relevant organization to manage the group.

  4. Select Save.

  5. Select Review pending changes to review the updates. Then, select Submit changes to execute them.

Global admins can assign product profiles and user group admins to the user groups using the Global Admin Console. Using the Adobe Admin Console, system admins, and user group admins can add users and assign admins and product profiles to the user group.

Share user groups

Group projection allows you to sync user groups and their associated users from a single management source to multiple Admin Consoles. Global administrators can share user groups with hierarchical descendants of the source organization, working downward, not upward or side-to-side.

  1. Sign in to the Global Admin Console, select an organization, and navigate to the User Groups tab.

  2. Select the checkboxes for the user groups you want to share.

    Groups might be disabled for sharing in the following cases:

    • The user group is shared from another organization. To share or edit the group, select the organization that owns it from the organization hierarchy.
    • The organization isn't using Adobe storage for business, which is being rolled out globally in phases.
    • The organization policy is disabled. Go to the Policies tab to turn on the Manage shared user groups policy.
    • The organization doesn't have any child organizations to share user groups with. 
  3. Select Share user group.

  4. Review the user groups to share with other organizations. If you are also a system admin in the selected organization, select the Open in Admin Console   icon to review the list of the user group members in the Adobe Admin Console.

    Note:

    To prevent conflicts, ensure that the organizations with which you plan to share user groups don't already have groups with the same name.

  5. Select Next.

  6. Select the organizations to share user groups with and select Next.

  7. If there are no conflicts, select Share User Groups.

    If there are conflicts, where user groups with the same name exist in the target organization, choose one of the following options and then select Share User Groups:

    • Ignore (default): Skip the groups in the target orgs with the same name.
    • Add only: Merge the user groups by adding new users to the existing user groups without removing any users.
    • Mirror group: Adjust the target organization's groups to match the shared group by adding or removing users.
  8. Select Review pending changes to review the updates. Then, select Submit changes to execute them.

    Group projection events are logged for your reference. Learn to view and download audit logs.

When you share a user group, the group and its users are added to the target organization. However, the source user group controls the shared user groups and their users. Admin and product profile assignments are not synchronized between organizations.

Changes in the projected user group's name or associated users in the source user group are automatically updated in the target organization. While the shared user group cannot be managed directly, an admin within the target organization can assign product profiles to a shared group giving license access to the group's users.

Revoke access to shared groups

  1. Sign in to the Global Admin Console, select an organization, and navigate to the User Groups tab.

  2. Select Manage shared access for the relevant user group.

  3. Select the organizations you want to revoke access from.

  4. Select Revoke access.

  5. While revoking access, you can choose to either delete the user group and users or leave a copy in the target organizations.

    • On deleting, the user group is removed from the target organizations. Users who are not members of other shared groups are also removed, losing access to all products, services, and assets.
    • On leaving a copy, the user group and users remain in the target organizations keeping all assignments intact. However, the user group will no longer be synced and can be managed by the administrators of the target organizations.
  6. Select Revoke access.

  7. Select Review pending changes to review the updates. Then, select Submit changes to execute them.

Edit user groups

  1. Sign in to the Global Admin Console, select an organization, and navigate to the User Groups tab.

  2. Select the More Options  icon for the relevant user group, and select Edit User Group.

    You can't edit user groups that the selected organization doesn't own.

    An organization selected with the edit user group option highlighted under user groups tab.
    Edit the user groups to update the user group name, product profiles, or admins.

  3. Update the user group name, product profiles, or admins. Then, select Save.

    In the Edit User Group wizard, you can assign the admin roles only to users who already have an admin role assigned in this organization. Learn how to add new administrators.

  4. Select Review pending changes to review the updates. Then, select Submit changes to execute them.

If you change the name of a shared user group, the changes are automatically updated in the target organization.

Delete user groups

  1. Sign in to the Global Admin Console, select an organization, and navigate to the User Groups tab.

  2. Select the More Options  icon for the relevant user group, and select Delete User Group.

    You can't delete user groups that the selected organization doesn't own.

  3. Select Ok in the dialog box that appears.

    Caution:

    Deleting a user group can impact your users. Ensure that there is no access or information that will be lost when the user group is deleted.

  4. After you have edited the organizations, select Review pending changes to review them. Then, select Submit changes to execute them.

Get help faster and easier

New user?