Add Microsoft Azure Sync to your directory

You can add Azure Sync to any directory in the Adobe Admin Console to automate its user management process. Azure Sync uses SCIM-protocol for user management and offers you control over user and group being sent to Adobe. Azure AD users synchronized with the Adobe Admin Console are unique and can be assigned to one or more product profiles.

After you've set up Azure Sync, Azure AD starts to send data to the Adobe Admin Console as per the Azure AD directory's user and group provisioning. All the details associated with the directory are displayed in the Settings section of the Adobe Admin Console.

Benefits of Azure Sync

The key advantages of the Azure Sync with your directory in the Adobe Admin Console are:

Prerequisites

To integrate Adobe Admin Console User management with Azure AD, you need the following:

• Microsoft Azure AD account with user- and group-data
  
• Adobe products that belong to any of the following: Creative Cloud for enterprise, Document Cloud for enterprise, or Experience Cloud 
• A federated directory in the Adobe Admin Console with verified domains

Supported integration scenarios

Directory setup may differ and Azure Sync supports varying scenarios, which requires extra steps to set up Azure Sync. Use the table to follow steps based on your directory setup:

Notes prior to sync configuration

Follow the points below to see the best practices and Adobe Recommendations before you set up Azure Sync:

• Export the list of existing users before adding Azure Sync to keep a record of all user accounts and provisioned licenses when you set up.
• If you've set up Azure AD SSO with Open ID Connect (OIDC), you must add a new Adobe Identity Management application in Microsoft Azure Portal to set up directory sync.
• If you've set up Azure AD SSO with SAML, use the existing Adobe Identity Management application to configure directory sync. Follow the steps mentioned in the Microsoft document to configure automatic user provisioning with the Adobe Identity Management application.
• Azure Sync decouples email from username, allowing users to use a differing email and username value to validate sign-in and access Adobe products and services, collaborate in projects, share files, etc.​ Follow the steps in the Microsoft document to customize the user provisioning attribute mapping.
• If you are integrating Azure Sync to a directory having Federated ID users, verify that their username field format matches the user principal name (UPN) in Azure AD before you run the initial sync.
  If these values do not match, the Admin Console perceives this as a net-new user account and creates duplicate records for a single user. You can update the attribute mapping to ensure that the values passed by sync match the values in the user profiles in the Admin Console, which will automatically update their accounts upon the next sync.
• Azure Sync can be established only in an Admin Console with at least one federated directory and domain set up. If the Admin Console with Azure Sync (owning Console) is in a trust relationship with other Admin Consoles (trustee Consoles), the trustees must use another form of user management, such as User Sync Tool, User Management API, or bulk CSV upload, to create, manage, and license Federated ID users.
  To add users to a trustee Console for license provisioning, you must first add the user to the owning Console.
• If your organization uses the User Sync Tool or a UMAPI integration, you must first pause the integration. Then, add Azure Sync to automate user management from Azure AD. Once Azure Sync is configured and running, you can completely remove the User Sync Tool or UMAPI integration.
• Your organization must have a Premium (P1 or P2) or Microsoft 365 (E3 or A3) subscription with Azure AD to use group-based assignment capabilities. It allows you to choose specific groups and users to be synced to the Adobe Admin Console.
  Organizations without these subscription levels can only sync all the users and groups to the Adobe Admin Console at once. The system will sync all users and groups automatically and generate an Adobe Federated ID for the synced users. Read more about Azure AD subscription plans and options for updating.
• To move a domain to or from a directory established with Azure Sync, you must first enable editing for the directory temporarily. Once enabled, move the desired domain to or from the Azure AD-synced directory before disabling edit capabilities for the directory.
• Azure sync does not sync users from groups with the HiddenMembership attribute in the Azure AD. To sync specific users, create a group on Azure AD and copy the respective users to the new group.

Add Azure Sync to a federated directory

You can add Azure Sync to an Adobe Admin Console federated directory with the required domains linked to it. To add sync to an established federated directory, follow the process below:

Edit Sync settings

A System Administrator can update settings for the Sync Source once the setup is complete by choosing Go to Settings from the Directory settings > Sync tab. Setting options include:

Remove sync

Administrators can choose to remove sync from a federated directory within the Admin Console. Removing sync leaves the directory and its associated domains, user groups, and users intact, and removes read-only mode from the directory and its users and groups.

To remove sync from a directory, choose Go to Settings from the Directory settings> Sync tab, then Remove Sync. This action will permanently remove the sync setup from the Admin Console. If needed, you can reestablish sync with the same or different directory.

Disable users and groups

Implementing Azure Sync creates new federated user accounts and syncs users to the Adobe Admin Console. Administrators can also deprovision users and groups added through Azure Sync via the below three methods (in the Microsoft Azure Portal):

• Remove user from all synced groups in Azure AD

• Soft delete user from Azure AD

• Remove all groups that the user is part of from the provisioning scope in Azure AD

These three operations disable users in the Adobe Admin Console. A disabled user is no longer able to log in and shows as Disabled in the Directory Users list. Azure Sync will keep managing a user deprovisioned by one of these methods. Neither the user’s account nor cloud-stored assets are removed from the organization. 

Remove a user and associated data from the Admin Console: Choose Go to Settings from the Directory settings > Sync tab and click Enable editing. Then navigate to Users > Directory Users and choose the user from the list to permanently delete the account.

Once editing is enabled, it allows edits in the synced data for one hour before getting automatically disabled. We recommend you to click Disable editing immediately after user removal to ensure that the Admin Console reflects Azure AD changes.

Quarantine policy

Adobe and Microsoft have a quarantine policy to handle numerous error calls during sync operations. 

The Azure AD provisioning service monitors the health of your configuration and places unhealthy apps in a "quarantine" state. If most or all of the calls made against the target system consistently fail because of an error, for example, invalid admin credentials, the provisioning job is marked as in quarantine. While in quarantine, the frequency of incremental cycles is gradually reduced to once per day. The provisioning job is removed from quarantine after all errors are fixed and the next sync cycle starts. If the provisioning job stays in quarantine for more than four weeks, the provisioning job is disabled (stops running). Learn more about applications provisioning in quarantine status within Azure AD.

Adobe’s service independently monitors sync health to verify when the error rate surpasses a certain threshold in a set amount of time. A minimum number of requests resulting in an error that meets the threshold will enact temporary quarantine, resulting in rejecting all calls and update requests from Azure AD for a time period, after which calls will be accepted again for sync retry. If error calls persist, the sync will be placed on temporary probation for an extended time period in quarantine. If Adobe initiates the quarantine, it may also lead to a subsequent quarantine with Azure due to the rejected calls, which will count toward error rates in Azure. Note that Adobe reserves the right to update the quarantine parameters based on ongoing data analytics. 

Common error messages

There is a set of common error messages displayed to be aware of when managing Azure Sync from Azure AD. Understanding the cause of the various error messages will aid in troubleshooting when errors occur.

Learn more about monitoring your deployment within Azure AD.

Troubleshoot sync issue

As the Adobe Admin Console uses Microsoft’s Azure sync service, all sync issues are troubleshot within Azure AD. You can refer to Microsoft’s configuration instructions to solve some common issues. If you are unable to find a solution, we recommend you to contact Microsoft Support for further assistance.

Follow the instructions below to diagnose a sync issue:

Manage existing user accounts

Additional steps are required to convert all existing non-Federated ID users to Federated ID type.

Users that have an existing non-Federated ID account in the Admin Console can be migrated to a Federated ID account once Azure Sync has been established. Once converted, Azure AD pushes these accounts to Adobe Admin Console successfully.

To ensure that any cloud-stored assets are migrated to the user’s new identity type, follow the process below:

Next steps

Once you've added Azure Sync to your directory, all users and user groups are imported to the Adobe Admin Console and updated at regular intervals. Next, you've to enable these users to access their designated Adobe apps:

1. Create and manage product profiles: Create appropriate product profiles and associate them with users and user groups to fine-tune who gets to use which Adobe apps and services. See how to manage products and product profiles.
2. When users are assigned the designated products, they receive an email notification. Users can directly download and install the Creative Cloud Desktop App.
   If your users don't have admin permissions, you must create and deploy appropriate packages.
3. Create and deploy packages: To provide access to the apps to your users, create and deploy the app packages on their computers. Users must sign in using their SSO credentials to start using the apps and services. For more information, see Create Named User Licensing Packages.

If you're the admin of an institution, after setting up Azure sync, we recommend that you enable role sync. Learn about Role sync for Education.