Enable automatic account creation

  To enable automatic account creation for an existing directory, sign in to the Adobe Admin Console, navigate to Settings, select a directory, and then select Authentication > Edit.

Overview

Automatic account creation allows users without a federated account to automatically create one with their organization based on a verified email domain. When enabled for a federated directory, new users with a valid email domain of that directory will be able to create a federated account. Learn more about federated accounts.

Adobe strongly recommends you enable automatic account creation for the following benefits:

• Federated users can participate in sharing and collaboration flows with their org-owned account versus a personal account using an org-owned domain.
  
• Federated users can sign in securely via single sign-on.
• Automation speeds up the process of setting up users in your directory with little or no involvement from the administrator.
  
• Administrators can control the federated users' product licenses, cloud-stored assets, and sharing restrictions.

You can set up automatic assignment rules that assign products automatically to eligible users in your organization (or specified domains and directories) and enable product requests that allow end users to request access to products for administrator review.

User experience

When a user enters their email address to create an account, they are given a choice to create an account with their organization if the email address entered meets the following criteria:

• Has a valid email domain from the federated directory
• Is not associated with an existing Adobe account

The user should select Sign in under the Email address field and successfully authenticate with their organization’s single sign-on to complete the account creation. This triggers the flow of information from the identity provider to the Admin Console so that federated Adobe accounts are created automatically within the identified federated directory based on the user’s domain.

User accounts created through automatic account creation indicate the creation source in the User Details. Administrators can manage the accounts of any users added through automatic account creation, including removing them from the Users and Directory Users lists as needed. Administrators' actions are captured in the Audit Log report.

Enable or disable automatic account creation

System Administrators can enable or disable automatic account creation per identity provider within each federated directory, allowing eligible users to get a federated account without any other action from an administrator.

The feature must be enabled by an administrator for an existing federated directory, while it is enabled by default for all new federated directories created in your Admin Console. Here's how you can edit existing directories to enable automatic account creation:

Frequently asked questions

Where can users find the option to automatically create a federated account with my organization?

Users who don't already have an Adobe account will get the option to sign in with their SSO and auto-create a federated account when creating an account on the Adobe sign-in screen. 

What benefits are available to users who automatically create an account with my organization?

Once a user has an account with their organization, that user can participate in collaboration and share workflows with other team members, as well as request access to products from their organization based on how the administrators have configured the automatic assignment rule and product request features.

What if I want to allow users to create other types of Adobe accounts automatically with my organization? 

Currently, only federated accounts can be created automatically. A future phase of Zero Touch Administration will allow users to create other types of Adobe accounts with their organizations. 

Can users who are not using a domain that my organization has claimed still have an account automatically created?

Only users who have an organization-provided account whose domain falls within the federated directory enabled for automatic account creation can create a federated account on-demand. The user must be able to successfully authenticate via single sign-on for account creation to be completed.

Does account creation automatically provide any product licenses to the user?

Automatic account creation only creates a new federated account for a user and does not automatically assign product licenses. A user can request access to Adobe products from their organization once they are a member based on how the administrators have configured the automatic assignment rule and product request features.

How do I remove a user from my Admin Console who automatically created their account?

Users who created a federated account on-demand can be removed from the organization by a System or User Administrator via the User List. Removing the user from the Directory User List will permanently delete their account and all license access.

Can users automatically create an account in a federated directory that has Azure or Google Sync configured?

A user can create an on-demand federated account in a directory where Azure or Google Sync has been configured. Once created, the user is under sync management, meaning their account cannot be edited via the Admin Console unless the sync is temporarily paused. If the user is added to the automated sync scope, their user information will be updated in their Adobe profile via the directory attribute mapping.

Will a user who already has a personal Adobe account under a domain my organization owns be presented with the option to create a new federated account under the same email address at sign-in?

Only users who are creating an account with their organization-owned domain will be offered the option to create a federated account on-demand. If a user is already using their org-owned email domain for personal use, they can choose to change the email address associated with the account, allowing them to create a federated account on-demand with their org-owned email domain.