User Guide Cancel

Assign user roles for granular access control

Last updated on Mar 9, 2026

Adobe Enterprise & Teams: Administration guide
Plan your deployment
1. Basic concepts
2. Deployment Guides
3. Deploy Creative Cloud for education
Set up your organization
1. Identity types | Overview
2. Set up identity | Overview
3. Set up organization with Enterprise ID
4. Setup Azure AD federation and sync
5. Set up Google Federation and sync
6. Set up organization with Microsoft ADFS
7. Set up organization for District Portals and LMS
8. Set up organization with other Identity providers
9. SSO common questions and troubleshooting
10. Set up Frame.io for enterprise
Manage your organization setup
Manage users
Manage products and entitlements
1. Manage products and product profiles
2. Manage Shared Device licenses
Get started with Global Admin Console
Manage storage and assets
1. Storage
2. Manage projects
3. Asset migration
4. Reclaim assets from a user
5. Student asset migration | EDU only
  1. Student File Transfer admin guide
  2. Student File Transfer FAQ
Manage services
1. Adobe Stock
2. Custom fonts
3. Adobe Asset Link
4. Adobe Acrobat Sign
Deploy apps and updates
1. Overview
2. Create packages
  1. Package apps via the Admin Console
  2. Create Named User Licensing Packages
  3. Manage pre-generated packages
    1. Manage Adobe templates
    2. Manage Single-app packages
  4. Manage packages
  5. Manage device licenses
  6. Serial number licensing
3. Customize packages
  1. Customize the Creative Cloud desktop app
  2. Include extensions in your package
4. Deploy Packages
5. Manage updates
  1. Change management for Adobe enterprise and teams customers
  2. Deploy updates
6. Adobe Update Server Setup Tool (AUSST)
7. Adobe Remote Update Manager (RUM)
  1. Release notes
  2. Use Adobe Remote Update Manager
8. Troubleshoot
  1. Troubleshoot Creative Cloud apps installation and uninstallation errors
  2. Query client machines to check if a package is deployed
Manage your Teams account
Renewals
1. Teams membership: Renewals
2. Enterprise in VIP: Renewals and compliance
Manage contracts
Reports & logs
Get help

Applies to enterprise.

Learn how user roles work in the Admin Console and how to assign and manage them to support secure and appropriate access.

Go to Users > Roles to assign roles. For easier management, assign roles to user groups instead of individual users.

Go to Adobe Admin Console

What are user roles and how they help

User roles define what users and user groups can access and do in their assigned Adobe apps. System admins can assign roles to control access to features and workflows based on a user’s responsibilities. User roles help you to:

Grant the right level of access without over-permissioning
Delegate tasks safely without sharing full admin rights
Simplify user management through role-based user groups

Types of user roles

The Admin Console allows system admins to set the right level of access across the organization through two types of user roles.

Predefined roles: Built‑in roles that cover common access needs. Most are fixed, but some allow certain permissions to be turned on or off.
Custom roles: Created by system admins to fit specific team needs. You choose the capabilities the role includes. Learn more about custom roles and how to create them.

Predefined roles

Predefined roles help you apply consistent, built‑in access levels across users and groups. The set of roles shown in the Admin Console depends on whether you have an enterprise organization or an education institution.

Note

You’ll only see roles for applications that are available to your organization.

For enterprise ETLA organizations

Roles	Capabilities
Member (default for everyone)	Defines organization-wide permissions, such as creating and editing Adobe Express templates, publishing to social media, and accessing Firefly and partner generative AI models. Assigned to all users except those with specific roles.
Adobe Express application manager	Allows assignees to customize the Adobe Express user interface for all members of your organization.
Adobe Express template manager	Allows assignees to create and edit templates for your organization and to override template lock restrictions.
Adobe Express social publishing manager	Allows publishing and scheduling content from Adobe Express to social media (Facebook, Instagram, TikTok, LinkedIn, Pinterest, and X).
Firefly user	Allows access to commercially safe Adobe Firefly generative AI models.
Partner model user	Allows access to all partner generative AI models.

For education K-12 institutions

Roles	Capabilities
Member (default for everyone)	Assigned automatically to all users in your organization. Assignees can control commenting on shared projects and collaborative workflows.
Educator	Allows assigees to manage Classrooms and student work in Adobe Express for education and to comment on shared projects and collaborative workflows.
Student	Allows assignees to participate in classroom workflows in Adobe Express with the same permissions as the Member role, and can be assigned only through roster sync.

Assign roles to users

You can view and manage your users' roles based on their required level of access.

Tip: Creating role-based user groups

Before assigning roles, consider creating or modifying users and groups based on your role assignments. Start with planning your user management strategy.

For example, if you want to assign the Adobe Express template manager role to users A, B, and C, then create a user group with users A, B, and C to simplify the assignment.

Go to the Adobe Admin Console Users section using your system admin credentials.
Select Roles.

Use the Roles page to view and filter roles by type to audit specific role categories.
Select the Assign users icon next to the role you want to assign to the user or user group.
Add users or user groups in the Add users to this role screen.

Note

You can only assign roles to existing users and user groups. To add new users, use your preferred user management technique.
Select Save.

You can review your users and their assigned roles in the Roles or Product Profile section of the Admin Console.

Remove users or groups from a role

You can update or remove a user’s role assignments at any time.

In the Adobe Admin Console, go to Users > Roles.
Select the role you want to update.
Select the checkbox next to the users or user groups you want to remove and select Remove users.
In the confirmation dialog, select Remove users again to finalize the change.

The selected users or groups are unassigned from the role, and the changes are recorded in the audit log.

Note

Users don't receive email notifications when roles are updated. You must communicate any role changes directly.

Manage permissions for a predefined role

Some predefined roles expose permissions you can toggle on or off. For example, Member and Educator.

In the Adobe Admin Console, go to Users > Roles.
Select the Quick view icon for the relevant role, then choose Edit.
In Permissions, turn the required toggles on or off.
Note
You only see permission sets and permissions that are available to your organization.

To grant access to Partner models, you must also grant Firefly access.
Select Save.

Changes apply immediately to all users and groups assigned to this role and are recorded in the audit log.

Common questions

Yes, users or user groups can be assigned multiple roles. Permissions on roles are additive, so users will have access if they inherit the same roles from one or more user groups.

User groups can have one or more roles assigned to them. Assign roles and products to user groups so that all users within the group have similar access.

Yes, Adobe Express roles are optional and provide additional access when assigned.

The member role settings apply to everyone in your organization. When you want more control over specific features, you can turn off the setting on the member role and use the predefined roles, such as Adobe Express template manager or Adobe Express social publishing manager, to provide access to these specific workflows.

Product roles are removed when the product license is removed, and users can no longer exercise the role capabilities. However, user roles such as Educator are not associated with any product and remain assigned to the users regardless of their license.

No. Partner generative AI models require Firefly access.
If Firefly access is turned off for your organization, partner model access is automatically unavailable. To enable partner models, Firefly access must be turned on first.

Join the conversation

Use our Enterprise and Teams Community to ask questions, collaborate with other admins, and stay informed about new features.

Get help faster and easier

New user?