What are Administrative Roles?
Administrative Roles allow the System Administrator to create "sub-administrators" that can administer software access to end users and access deployment capabilities. By utilizing these roles, the System Administrator can simultaneously delegate management to others without providing more capability than they need.
I'm not familiar with the System Administrator (formerly IT Admin) role. Can you explain it?
The System Administrator is the primary user of the Admin Console today. You are a System Administrator and are the "super user" that has the right to change anything managed in the Admin Console – identity configuration, provisioning users, creating groups, deploying software, creating support tickets, etc.
What roles are available with Administrative Roles?
The roles include:
System Administrator – formerly called the IT Admin, this role has control over the entire Console and can assign the sub-administrators.
Product Administrator – has control over only assigned products and can grant users access to those products.
Deployment Administrator – has control over managing deployment packages for Creative Cloud and Document Cloud.
Support Delegate – Non-administrative role that has access to support-related information, such as customer-reported issue reports.
What else is changing as a result of this feature?
The "Group" function is changing. Our data shows that 90% of all groups in all Admin Consoles contain one or zero products and the vast majority of user-defined group names match their associated product name. This data, combined with the need to enable each product to be able to be administrated individually has driven us to remove 'Group' management from the Admin Console. Now, instead of seeing and managing via groups, you will be presented with a product view. Instead of granting access to users through a group, you will now grant access to products directly.
Will System Administrators have any new or different responsibilities once this feature is released?
Once this feature is released, you may choose to run things as you do today, that is, without delegating any roles to other Admin Console users. However, should you wish or need to control access to Admin Console functionality, you will need to identify and assign people to take these roles. Further, should your organization wish to segregate software access by product, you will need to determine how to segregate the software and then setup the structure accordingly. Online documentation is available to help you with this task. See Administrative Roles.
As an existing admin, will I lose my access to the Admin Console or have my access changed when this feature is released?
As the system admin, will I be able to segregate product management across all products (Marketing Cloud, Creative Cloud, and Document Cloud)?
Yes, you will be able to setup product segregation as you see fit. For example, it will be possible to assign one user to administer Creative Cloud software and a different user to administer Marketing Cloud software and yet another to administer Document Cloud software. These administrators will have no knowledge of each other or what software the enterprise has purchased apart from what you have assigned them to administer. Software management may be delegated at a very fine-grained level, down to an individual configuration of a particular product. For example, one user can be assigned to administer Creative Cloud All Apps that has Typekit turned off while another user can be assigned to administer Creative Cloud All Apps with Typekit turned on and Behance turned off. Similarly for Marketing Cloud, for example, one use can administer Analytics and another user can be assigned to administer Assets on Demand.
My enterprise wants to manage software access functionally or geographically. Does Administrative Roles allow this?
What does the Deployment Administrator do?
The Deployment Administrator has access to the deployment and packaging capabilities of Creative Cloud or Document Cloud. This role manages all product packages, but does not manage software access to end-users. Administrative Roles enables administrative separation, so that an expert in deployment and packaging can do their job without having the ability to grant rights to software.
Will this feature have any impact to an end-user's access to Adobe software, services, or solutions?
When will this feature be available in my Admin Console?
How will this feature be made available in my Admin Console?
How does the upgrade process work?
Prior to the upgrade, you will receive a notification in the Admin Console indicating that the upgrade is coming and when to expect it. During the upgrade, you will be unable to access the Admin Console. A system-generated maintenance screen will inform you that the Admin Console experience is being improved. Once the upgrade is complete, you will be able to login as before.
Will my end user's access to software be affected during the upgrade?
My Admin Console had multiple products associated to groups. What will happen to that information?
As mentioned above, with Administrative Roles, we are replacing the notion of "Groups" for product access. Instead, product access will be managed via a product configuration. Each configuration is like a group, but will have one and only one product associated to it. It will also have any product specific options necessary to establish access. For example, if you have purchased Creative Cloud with managed services, the configuration includes the name of the private cloud the users will have access to as well as any services to which they have access. During the upgrade, we will ensure that all the original group data, as it pertains to end user access will be transformed to product configurations.
My Admin Console had groups with users but not associated products. What will happen to those groups?
With Administrative Roles, there will be no Group function. Any of your groups that have no products associated will have no inherent meaning to the new Admin Console and will no longer be able to be accessed within the Admin Console. However, we are not deleting these groups permanently, they will simply have no user interface to expose them. If you need access to these groups, you may utilize the new User Management API functions to obtain a list of groups as well as all users within a group. For more information on the User Management API, please visit https://usersdk.adobe.io