Using the Adobe Admin Console, organizations can define a flexible administrative hierarchy that enables fine-grained management of Adobe product access and usage. One or more System admins, provisioned during the enterprise onboarding process, sit at the top of the hierarchy. These System admins can delegate responsibilities to other admins, while still retaining overall control.
Administrative Roles provide the following key benefits to enterprises:
- Controlled decentralization of administrative responsibilities
- Quick view of product assignments—by user and by product
- Functionality to assign quotas to Product admins
The administrative hierarchy can be used to suit the unique requirements of your enterprise. For example, an enterprise can appoint different admins to manage entitlements to Adobe Creative Cloud and Adobe Marketing Cloud offerings. Alternatively, an enterprise can have different admins to manage entitlements of users belonging to different business units.
The administrative roles hierarchy doesn't apply to teams customers. Teams customers have a single System admin role. The contract owner is the primary administrator or the system administrator with access to the contract details and the billing history. If you are the current contract owner, you can nominate an existing system administrator (secondary administrator) as the contract owner.
Super user for the organization; allowed to perform all administrative tasks in the Admin Console.
Also, has permissions to delegate the following administrative functionality to other users: Product admin, Product Profile admin, User Group admin, Deployment admin, and Support admin.
Administers the products assigned to that admin and all associated administrative functions, which include:
|Product Profile Admin||Administers the Product Profile descriptions assigned to that admin and all associated administrative functions, which include:
|User Group Admin||
Administers the user group descriptions assigned to that admin and all associated administrative functions, which include:
|Deployment Admin||Creates, manages, and deploys software packages and updates to end users.|
|Support Admin||Non-administrative role that has access to support-related information, such as customer-reported issue reports.|
|Storage Admin||Manages the storage administration of the organization. The administrator can view storage consumption of both active and inactive users, delete inactive user-folders and transfer contents to other recipients.|
For a detailed list of permissions and privileges for each admin role, see Permissions.
As an admin, you can assign an admin role to other users, giving them the same privileges as you have, or privileges for a role under your admin role in the hierarchy. For example, as a Product admin you can give Product admin privileges or Product Profile admin privileges to a user, but not Deployment admin privileges.
In the Basic Information screen, enter a name or email address. You can search for existing users or add new users by specifying a valid email address, and filling the information on the screen.
- If you've claimed a domain, and you're adding a user with the same domain, the admin is added as a Enterprised ID or Federated ID type user (depenending on the identity setup).
- If you've not claimed a domain, the admin is added as a Business ID type user.
If you choose to add a Federated ID user, you are prompted with the following message:
If you've set up your Admin Console with SSO (Federated ID type users), we recommend that you add at least one system admin as a non-Federated ID type user. This way, you will not be locked out of the Admin Console even if your organization's SSO goes down.
To do this, you'll need to add an admin using a different domain or subdomain from your SSO domain.
This admin is added as a Business ID type user to the Admin Console.
- The options on this screen depend on your account and admin role. You can either give the same privileges as you have, or privileges for a role under yours in the hierarchy.
- As the System Admin of a team, you can assign only one admin role: System Admin.
As an admin, you can assign the System admin role to other users, giving them the same privileges as you have. If you're the primary admin (contract owner) and you want to make another user the primary admin, follow these steps: Change the contract owner.
As an admin, you can edit the admin role to other admin that are below you in the Administrative hierarchy. For example, you can remove admin privileges of other admins. Or you can change the admin roles of a Product to a Product Profile admin.
Removing an admin does not delete the user from the Admin Console, but only removes the privileges associated with the admin role.
|Area||Permission||System admin||Product admin||Product Profile admin||User Group admin||Deployment admin||Support admin||Storage admin|
|Identity management||Add domain (request/claim a domain)||✔|
|View domain and domain listing||✔|
|Manage domain encryption keys||✔|
|Manage default org password policy||✔|
|View default org password policy||✔|
|User Management||Add user to org||✔||✔||✔|
|Remove user from org||✔|
|View user details and user listing||✔||✔||✔||✔||✔|
|Edit user profile||✔|
|Add Product Profile to user or group||✔||✔²||✔²|
|Remove Product Profile from user||✔||✔²||✔²|
|Add Product Profile to many users||✔||✔²||✔²|
|View product profiles for a user||✔||✔²||✔²|
|View product user listing||✔||✔²|
|Bulk add users to org||✔|
|Administrator Management||Grant Org Admin to a user/user group||✔|
|Revoke Org Admin from a user/user group||✔|
|Grant Product License Admin to a user/user group||✔||✔²||✔²|
|Revoke Product License Admin from a user/user group||✔||✔²||✔²|
|Grant Deployment Admin to a user/user group||✔||✔|
|Revoke Deployment Admin from a user/user group||✔||✔|
|Grant user group administration to a user/user group||✔||✔|
|Revoke user group administration from a user/user group||✔||✔|
|Grant product owner admin to a user||✔||✔²|
|Revoke product owner admin from a user||✔||✔²|
|Product License Configuration Management||Grant product entitlement to org|
|Remove product entitlement from org|
|View available products and product families||✔||✔²||✔²|
|Edit product license descriptions/data||✔||✔²||✔²|
|Provision product license to a user||✔||✔²||✔²|
|Deprovision product license from a user||✔||✔²||✔²|
|Add new product license configuration||✔||✔²|
|Edit product license service configuration||✔||✔²||✔²|
|Delete product license service configuration||✔||✔²|
|Remove product access from a user(strip from all configs)||✔||✔²|
|Storage Management||View Active and Inactive user folders||✔||✔|
|Delete Inactive user folders and transfer content||✔||✔|
|Create shared folders (for Adobe Campaign only)||✔||✔|
|Remove shared folders (for Adobe Campaign only)||✔||✔|
|Deployment||View/use deployment tab||✔||✔|
|Support||View support tab||✔||✔||✔||✔|
|Manage support cases||✔||✔|
|User Group Management||Create user group||✔||✔¹||✔¹|
|Remove user group||✔||✔²|
|Add user to user group||✔||✔²|
|Remove user from user group||✔||✔²|
|Assign user group to product license||✔||✔²||✔²|
|Remove user group from product license||✔||✔²||✔²|
|View member of user group||✔||✔||✔||✔²||✔|
|View list of user groups||✔||✔||✔||✔||✔||✔|