User Guide Cancel

Frequently asked questions | Azure Active Directory authentication and sync

  1. Adobe Enterprise & Teams: Administration guide
  2. Plan your deployment
    1. Basic concepts
      1. Licensing
      2. Identity
      3. User management
      4. App deployment
      5. Admin Console overview
      6. Admin roles
    2. Deployment Guides
      1. Named User deployment guide
      2. SDL deployment guide
      3. Deploy Adobe Acrobat 
    3. Deploy Creative Cloud for education
      1. Deployment guide
      2. Approve Adobe apps in Google Admin Console
      3. Enable Adobe Express in Google Classroom
      4. Integration with Canvas LMS
      5. Integration with Blackboard Learn
      6. Configuring SSO for District Portals and LMSs
      7. Deploy Adobe Express through Google App Licensing
      8. Add users through Roster Sync
      9. Kivuto FAQ
      10. Primary and Secondary institution eligibility guidelines
  3. Set up your organization
    1. Identity types | Overview
    2. Set up identity | Overview
    3. Set up organization with Enterprise ID
    4. Setup Azure AD federation and sync
      1. Set up SSO with Microsoft via Azure OIDC
      2. Add Azure Sync to your directory
      3. Role sync for Education
      4. Azure Connector FAQ
    5. Set up Google Federation and sync
      1. Set up SSO with Google Federation
      2. Add Google Sync to your directory
      3. Google federation FAQ
    6. Set up organization with Microsoft ADFS
    7. Set up organization for District Portals and LMS
    8. Set up organization with other Identity providers
      1. Create a directory
      2. Verify ownership of a domain
      3. Add domains to directories
    9. SSO common questions and troubleshooting
      1. SSO Common questions
      2. SSO Troubleshooting
      3. Education common questions
  4. Manage your organization setup
    1. Manage existing domains and directories
    2. Enable automatic account creation
    3. Set up organization via directory trust
    4. Migrate to a new authentication provider 
    5. Asset settings
    6. Authentication settings
    7. Privacy and security contacts
    8. Console settings
    9. Manage encryption  
  5. Manage users
    1. Overview
    2. Administrative roles
    3. User management techniques
      1. Manage users individually   
      2. Manage multiple users (Bulk CSV)
      3. User Sync tool (UST)
      4. Microsoft Azure Sync
      5. Google Federation Sync
    4. Change user's identity type
    5. Manage user groups
    6. Manage directory users
    7. Manage developers
    8. Migrate existing users to the Adobe Admin Console
    9. Migrate user management to the Adobe Admin Console
  6. Manage products and entitlements
    1. Manage products and product profiles
      1. Manage products
      2. Manage product profiles for enterprise users
      3. Manage automatic assignment rules
      4. Review product requests
      5. Manage self-service policies
      6. Manage app integrations
      7. Manage product permissions in the Admin Console  
      8. Enable/disable services for a product profile
      9. Single App | Creative Cloud for enterprise
      10. Optional services
    2. Manage Shared Device licenses
      1. What's new
      2. Deployment guide
      3. Create packages
      4. Recover licenses
      5. Manage profiles
      6. Licensing toolkit
      7. Shared Device Licensing FAQ
  7. Get started with Global Admin Console
    1. Adopt global administration
    2. Select your organization
    3. Manage organization hierarchy
    4. Manage product profiles
    5. Manage administrators
    6. Manage user groups
    7. Update organization policies
    8. Manage policy templates
    9. Allocate products to child organizations
    10. Execute pending jobs
    11. Explore insights
    12. Export or import organization structure
  8. Manage storage and assets
    1. Storage
      1. Manage enterprise storage
      2. Adobe Creative Cloud: Update to storage
      3. Manage Adobe storage
    2. Asset migration
      1. Automated Asset Migration
      2. Automated Asset Migration FAQ  
      3. Manage transferred assets
    3. Reclaim assets from a user
    4. Student asset migration | EDU only
      1. Automatic student asset migration
      2. Migrate your assets
  9. Manage services
    1. Adobe Stock
      1. Adobe Stock credit packs for teams
      2. Adobe Stock for enterprise
      3. Use Adobe Stock for enterprise
      4. Adobe Stock License Approval
    2. Custom fonts
    3. Adobe Asset Link
      1. Overview
      2. Create user group
      3. Configure Adobe Experience Manager Assets
      4. Configure and install Adobe Asset Link
      5. Manage assets
      6. Adobe Asset Link for XD
    4. Adobe Acrobat Sign
      1. Set up Adobe Acrobat Sign for enterprise or teams
      2. Adobe Acrobat Sign - Team feature Administrator
      3. Manage Adobe Acrobat Sign on the Admin Console
    5. Creative Cloud for enterprise - free membership
      1. Overview
  10. Deploy apps and updates
    1. Overview
      1. Deploy and deliver apps and updates
      2. Plan to deploy
      3. Prepare to deploy
    2. Create packages
      1. Package apps via the Admin Console
      2. Create Named User Licensing Packages
      3. Adobe templates for packages
      4. Manage packages
      5. Manage device licenses
      6. Serial number licensing
    3. Customize packages
      1. Customize the Creative Cloud desktop app
      2. Include extensions in your package
    4. Deploy Packages 
      1. Deploy packages
      2. Deploy Adobe packages using Microsoft Intune
      3. Deploy Adobe packages with SCCM
      4. Deploy Adobe packages with ARD
      5. Install products in the Exceptions folder
      6. Uninstall Creative Cloud products
      7. Use Adobe provisioning toolkit enterprise edition
      8. Adobe Creative Cloud licensing identifiers
    5. Manage updates
      1. Change management for Adobe enterprise and teams customers
      2. Deploy updates
    6. Adobe Update Server Setup Tool (AUSST)
      1. AUSST Overview
      2. Set up the internal update server
      3. Maintain the internal update server
      4. Common use cases of AUSST   
      5. Troubleshoot the internal update server
    7. Adobe Remote Update Manager (RUM)
      1. Use Adobe Remote Update Manager
      2. Resolve RUM errors
    8. Troubleshoot
      1. Troubleshoot Creative Cloud apps installation and uninstallation errors
      2. Query client machines to check if a package is deployed
      3. Creative Cloud package "Installation Failed" error message
    9. Create packages using Creative Cloud Packager (CC 2018 or earlier apps)
      1. About Creative Cloud Packager
      2. Creative Cloud Packager release notes
      3. Application packaging
      4. Create packages using Creative Cloud Packager
      5. Create named license packages
      6. Create packages with device licenses
      7. Create a license package
      8. Create packages with serial number licenses
      9. Packager automation
      10. Package non-Creative Cloud products
      11. Edit and save configurations
      12. Set locale at system level
  11. Manage your account
    1. Manage your Teams account
      1. Overview
      2. Update payment details
      3. Manage invoices
      4. Change contract owner
      5. Change reseller
    2. Assign licenses to a Teams user
    3. Add products and licenses
    4. Manage your team in Adobe Express
    5. Renewals
      1. Teams membership: Renewals
      2. Enterprise in VIP: Renewals and compliance
    6. Automated expiration stages for ETLA contracts
    7. Switching contract types within an existing Adobe Admin Console
    8. Purchase Request compliance
    9. Value Incentive Plan (VIP) in China
    10. VIP Select help
  12. Reports & logs
    1. Audit Log
    2. Assignment reports
    3. Content Logs
  13. Get help
    1. Contact Adobe Customer Care
    2. Support options for teams accounts
    3. Support options for enterprise accounts
    4. Support options for Experience Cloud

This document covers common questions encountered while configuring authentication between Microsoft Azure Active Directory (Azure AD) and Azure Sync with a federated directory. Additional information regarding the deprecated Azure Sync is also available for reference.

Azure Sync | Frequently asked questions

You can find answers to some of the frequently asked questions and important considerations below:

You can only create Federated ID user accounts through Azure Sync. Learn more about the identity type options here.

No. The Adobe Admin Console does not offer provisioning logs.

However, you can look for provisioning logs in the Azure Active Directory for diagnostic information. Refer to Provisioning logs in Azure Active Directory to learn more.

Adobe has upgraded the Azure Sync experience to provide enhanced security and other privacy controls to partner organizations. The updated Azure Sync does not require any permissions into your organization’s Azure Directory to sync users to the Adobe Admin Console.

The Azure Sync can only provide user management for the primary Admin Console in a primary-trustee Admin Console relationship. Any trustee Admin Consoles can take advantage of single sign-on with the federated directory but must use a separate form of user management (such as CSV manual upload, User Sync Tool, or User Management API.)

The SCIM protocol allows you and your Identity Provider to control the data flow. If Azure Sync doesn't sync data over to Adobe, check Provisioning logs for the Adobe Identity Management application inside your Azure AD Portal.

Ensure that the values passed to the user attributes by sync match the values in the user profiles in the Admin Console. Check the provisioning logs in Azure to find the attributes passed from Azure.

Yes. This allows users to use a differing email and username value to validate sign-in and access Adobe products/services, collaborate, share files, and so on.​

Your organization must have a Premium (P1 or P2) or Microsoft 365 (E3 or A3) subscription with Azure AD to use group-based assignment capabilities. It allows you to choose specific groups and users to be synced to the Adobe Admin Console.

Organizations without these subscription levels can only sync all the users and groups to the Adobe Admin Console at once. The system will sync all users and groups automatically and generate an Adobe Federated ID for the synced users. Read more about Azure AD subscription plans and options for updating.

Yes. You can sync nested groups from Azure AD through the Azure Sync integration.

However, nested groups are not automatically synced when the parent node of the group is added to sync scope. You must add nested groups to scope to be included in the automated sync.

Yes. Any update in Azure AD reflects in the Adobe Admin Console directory. This includes attributes like, FirstName, LastName, Email, etc.

Yes. To use Azure Sync with such a directory, you must have your users managed within an Azure AD instance.

Azure AD controls the sync cycles. The initial cycle takes longer to sync all users and groups defined in Scope. Then, subsequent cycles occur approximately every 40 minutes as long as the Azure AD provisioning service is running.

You cannot speed up the automated sync cycle from the Adobe Admin Console.


The Account Status column appears in both the Users and Directory Users list to inform administrators of the status of a specific user.

For federated users synced with Azure Active Directory, users are managed in a read-only mode via Azure Sync, and the status depends on their status within the organization’s directory:

  • Active = User account available for SSO login and license access. If sync is configured, an ‘Active’ user is in-scope for the automated sync.

  • Disabled = User account not available for SSO login or license access. If sync is configured, a ‘Disabled’ user is removed from sync scope in the organization’s Azure Active Directory, causing the user to no longer have login access to their account, but their cloud-stored assets are still available.


You cannot run Azure Sync alongside any other form of user management tool.

If your organization is using the User Sync Tool or a UMAPI integration, you must first pause the alternate form of sync, then follow the steps to set up Azure Sync to automate user management from the Azure Portal.

The User Sync Tool or UMAPI integration can be removed completely once the Azure Sync is configured and running.

Follow these instructions to edit identity type to Federated IDs.

There is a set of common error messages displayed to be aware of when managing Azure Sync by Microsoft Azure. Understanding the cause of the various error messages will aid in troubleshooting when errors occur.

Learn more about monitoring your deployment within Azure AD. Follow troubleshooting sync for more methods.

Yes. You can choose to disable or even remove Azure Sync from a federated directory. This removes the automated sync but leaves the directory, domains, and users of the directory intact.

When removing sync, User Provisioning should also be turned off for the former sync in Azure AD to prevent quarantine of the directory by Azure AD.

By default, when users are no longer managed through Azure Sync, they only get disabled to avoid accidental data loss.

To remove the users permanently, you must enable editing of synced users from the Sync tab and remove the users manually in the Admin Console.


Get help faster and easier

New user?

Adobe MAX 2024

Adobe MAX
The Creativity Conference

Oct 14–16 Miami Beach and online

Adobe MAX

The Creativity Conference

Oct 14–16 Miami Beach and online

Adobe MAX 2024

Adobe MAX
The Creativity Conference

Oct 14–16 Miami Beach and online

Adobe MAX

The Creativity Conference

Oct 14–16 Miami Beach and online