User Guide Cancel

Migrate to a new authentication provider

Search
Enterprise

Enterprise

Admin Console
  1. Adobe Enterprise & Teams: Administration guide
  2. Plan your deployment
    1. Basic concepts
      1. Licensing
      2. Identity
      3. User management
      4. App deployment
      5. Admin Console overview
      6. Admin roles
    2. Deployment Guides
      1. Named User deployment guide
      2. SDL deployment guide
      3. Deploy Adobe Acrobat 
    3. Deploy Creative Cloud for education
      1. Deployment home
      2. K-12 Onboarding Wizard
      3. Simple setup
      4. Syncing Users
      5. Roster Sync K-12 (US)
      6. Key licensing concepts
      7. Deployment options
      8. Quick tips
      9. Approve Adobe apps in Google Admin Console
      10. Enable Adobe Express in Google Classroom
      11. Integration with Canvas LMS
      12. Integration with Blackboard Learn
      13. Configuring SSO for District Portals and LMSs
      14. Add users through Roster Sync
      15. Kivuto FAQ
      16. Primary and Secondary institution eligibility guidelines
  3. Set up your organization
    1. Identity types | Overview
    2. Set up identity | Overview
    3. Set up organization with Enterprise ID
    4. Setup Azure AD federation and sync
      1. Set up SSO with Microsoft via Azure OIDC
      2. Add Azure Sync to your directory
      3. Role sync for Education
      4. Azure Connector FAQ
    5. Set up Google Federation and sync
      1. Set up SSO with Google Federation
      2. Add Google Sync to your directory
      3. Google federation FAQ
    6. Set up organization with Microsoft ADFS
    7. Set up organization for District Portals and LMS
    8. Set up organization with other Identity providers
      1. Create a directory
      2. Verify ownership of a domain
      3. Add domains to directories
    9. SSO common questions and troubleshooting
      1. SSO Common questions
      2. SSO Troubleshooting
      3. Education common questions
  4. Manage your organization setup
    1. Manage existing domains and directories
    2. Enable automatic account creation
    3. Set up organization via directory trust
    4. Migrate to a new authentication provider 
    5. Asset settings
    6. Authentication settings
    7. Privacy and security contacts
    8. Console settings
    9. Manage encryption  
  5. Manage users
    1. Overview
    2. Administrative roles
    3. User management strategies
      1. Manage users individually   
      2. Manage multiple users (Bulk CSV)
      3. User Sync tool (UST)
      4. Microsoft Azure Sync
      5. Google Federation Sync
    4. Assign licenses to a Teams user
    5. Add users with matching email domains
    6. Change user's identity type
    7. Manage user groups
    8. Manage directory users
    9. Manage developers
    10. Migrate existing users to the Adobe Admin Console
    11. Migrate user management to the Adobe Admin Console
  6. Manage products and entitlements
    1. Manage products and product profiles
      1. Manage products
      2. Buy products and licenses
      3. Manage product profiles for enterprise users
      4. Manage automatic assignment rules
      5. Entitle users to train Firefly custom models
      6. Review product requests
      7. Manage self-service policies
      8. Manage app integrations
      9. Manage product permissions in the Admin Console  
      10. Enable/disable services for a product profile
      11. Single App | Creative Cloud for enterprise
      12. Optional services
    2. Manage Shared Device licenses
      1. What's new
      2. Deployment guide
      3. Create packages
      4. Recover licenses
      5. Manage profiles
      6. Licensing toolkit
      7. Shared Device Licensing FAQ
  7. Get started with Global Admin Console
    1. Adopt global administration
    2. Select your organization
    3. Manage organization hierarchy
    4. Manage product profiles
    5. Manage administrators
    6. Manage user groups
    7. Update organization policies
    8. Manage policy templates
    9. Allocate products to child organizations
    10. Execute pending jobs
    11. Explore insights
    12. Export or import organization structure
  8. Manage storage and assets
    1. Storage
      1. Manage enterprise storage
      2. Adobe Creative Cloud: Update to storage
      3. Manage Adobe storage
    2. Asset migration
      1. Automated Asset Migration
      2. Automated Asset Migration FAQ  
      3. Manage transferred assets
    3. Reclaim assets from a user
    4. Student asset migration | EDU only
      1. Automatic student asset migration
      2. Migrate your assets
  9. Manage services
    1. Adobe Stock
      1. Adobe Stock credit packs for teams
      2. Adobe Stock for enterprise
      3. Use Adobe Stock for enterprise
      4. Adobe Stock License Approval
    2. Custom fonts
    3. Adobe Asset Link
      1. Overview
      2. Create user group
      3. Configure Adobe Experience Manager Assets
      4. Configure and install Adobe Asset Link
      5. Manage assets
      6. Adobe Asset Link for XD
    4. Adobe Acrobat Sign
      1. Set up Adobe Acrobat Sign for enterprise or teams
      2. Adobe Acrobat Sign - Team feature Administrator
      3. Manage Adobe Acrobat Sign on the Admin Console
    5. Creative Cloud for enterprise - free membership
      1. Overview
  10. Deploy apps and updates
    1. Overview
      1. Deploy and deliver apps and updates
      2. Plan to deploy
      3. Prepare to deploy
    2. Create packages
      1. Package apps via the Admin Console
      2. Create Named User Licensing Packages
      3. Adobe templates for packages
      4. Manage packages
      5. Manage device licenses
      6. Serial number licensing
    3. Customize packages
      1. Customize the Creative Cloud desktop app
      2. Include extensions in your package
    4. Deploy Packages 
      1. Deploy packages
      2. Deploy Adobe packages using Microsoft Intune
      3. Deploy Adobe packages with SCCM
      4. Deploy Adobe packages with ARD
      5. Install products in the Exceptions folder
      6. Uninstall Creative Cloud products
      7. Use Adobe provisioning toolkit enterprise edition
      8. Adobe Creative Cloud licensing identifiers
    5. Manage updates
      1. Change management for Adobe enterprise and teams customers
      2. Deploy updates
    6. Adobe Update Server Setup Tool (AUSST)
      1. AUSST Overview
      2. Set up the internal update server
      3. Maintain the internal update server
      4. Common use cases of AUSST   
      5. Troubleshoot the internal update server
    7. Adobe Remote Update Manager (RUM)
      1. Use Adobe Remote Update Manager
      2. Resolve RUM errors
    8. Troubleshoot
      1. Troubleshoot Creative Cloud apps installation and uninstallation errors
      2. Query client machines to check if a package is deployed
      3. Creative Cloud package "Installation Failed" error message
  11. Manage your Teams account
    1. Overview
    2. Update payment details
    3. Manage invoices
    4. Change contract owner
    5. Change your plan
    6. Change reseller
    7. Cancel your plan
    8. Purchase Request compliance
    9. Manage your team in Adobe Express
  12. Renewals
    1. Teams membership: Renewals
    2. Enterprise in VIP: Renewals and compliance
  13. Manage contracts
    1. Automated expiration stages for ETLA contracts
    2. Switching contract types within an existing Adobe Admin Console
    3. Value Incentive Plan (VIP) in China
    4. VIP Select help
  14. Reports & logs
    1. Audit Log
    2. Assignment reports
    3. Content Logs
  15. Get help
    1. Contact Adobe Customer Care
    2. Support options for teams accounts
    3. Support options for enterprise accounts
    4. Support options for Experience Cloud

You can migrate your existing directory to a new authentication provider within the Adobe Admin Console. This allows you to choose an authentication provider based on your needs and seamlessly migrate your users along with their apps and assets.

Before you begin

To migrate to a new authentication provider, you must have the following:

  • Access to your organization's Adobe Admin Console with System Administrator credentials
  • An existing directory configured for federation in Admin Console
  • Access to your organization's identity provider portal (for example, Microsoft Azure Portal, Google Admin console, etc.)

You can find detailed information in Implementation Considerations.

Change your directory's identity provider

If you meet the access requirements and implementation considerations, follow the procedure below to edit your authentication profile and migrate your directory:

  1. In your Adobe Admin Console, go to Settings > Directories > Edit the directory. Then, select Add new IdP in the directory Details.

  2. Select the identity provider to set up the new authentication profile. Choose the identity provider (IdP) that your organization uses to authenticate users. Click Next.

  3. Based on your choice of Identity provider, follow the steps below:

    Log In to Azure with your Microsoft Azure Active Directory Global Admin credentials and Accept the permission prompt. You're taken back to the Directory details in the Admin Console.

    Note:
    • The Microsoft Global Admin login is only required to create an application in the organization's Azure Portal. The Global Admin's login information is not stored, and only used for the one-time permission to create the application.
    • When selecting the identity provider for Step 3 above, the Microsoft Azure option should not be used if the Username field in the Adobe Admin Console does not match the UPN field in Azure Portal.
      If the existing directory is configured to pass Username as the User Login Setting, the new IdP should be established under the Other SAML Providers' option. The login setting can be confirmed by selecting Edit option in the current directory under User Login Setting.
    • Choosing the Microsoft Azure' option in Step 3 only configures the identity provider and does not include directory sync services at this time.
    1. Copy the ACS URL and Entity Id from the Edit SAML Configuration screen displays.
    2. In a separate window, log in to the Google Admin Console with Google Admin credentials and navigate to Apps > SAML Apps.
    3. Use the + sign to add new App and select Adobe app. Then, download the IDP metadata under Option 2 and upload it to the Edit SAML Configuration in the Adobe Admin Console. Then, click Save.
    4. Confirm the Basic Information for Adobe. Enter the previously copied ACS URL and Entity ID in the Service Provider Details to finish. There is no need to set up User Provisioning as this is not currently supported for existing directories.
    5. Last, go to Apps > SAML apps > Settings for Adobe > Service Status. Turn Service Status as ON for everyone and Save.
    Sevice status

    For Other SAML Providers:

    1. Log in to your identity provider's application in a different window and create a new SAML app. (Do not edit the existing SAML app to prevent down-time for migration).
    2. Based on your identity provider's settings, copy the Metadata file or ACS URL and Entity ID from the Adobe Admin Console to the identity provider's settings.
    3. Upload metadata file from the identity provider setup to the Adobe Admin Console. Then, click Save.

  4. In the Adobe Admin Console > Directory details, the new authentication profile is created. Use Test to verify whether the configuration functions correctly to ensure that all end users have access to SAML apps.

    The Test feature ensures that the username format for the new authentication profile in their IdP matches the user information for the existing profile for user login.

  5. Go to Directory users in the Adobe Admin Console > check that the identity provider usernames match Admin Console usernames.

    For SAML, make sure that Subject field in the assertion from the new configuration matches the existing users' username format in the Admin Console.

    Click Activate to migrate to the new authentication profile. Once done, the new profile displays In use.

After you've updated your directory setup, you can move domains from existing directories to the new directory using domain migration. Note that users of the migrated domains must be in the identity provider that is configured to work with the new target directory.

To know more about limitations and avoid errors that you might encounter while configuring, see Common questions.

Common questions: Directory migration

Find answers to your questions related to directory migration to a new authentication provider and updating a deprecated SAML setup.

Before you start, ensure you meet the access requirements to be able to follow the procedure for migrating to a different identity provider. Also, consider the following points to ensure a seamless and error-free migration for your organization's directories:

  • Admins must create a new SAML app on their IdP setup to configure. If they edit the existing app, it will rewrite any active existing configuration, incur downtime, and nullify the ability to switch between available IdP’s in the Adobe Admin Console.
  • Admins must ensure that all required users are assigned to, or can use, the newly-created SAML app.
  • Admins must ensure the username format for the new authentication profile in their IdP matches what is used by the existing profile for user login. They can use the Test feature provided on the authentication profile to verify. This Test link can be copied to clipboard and share it with others to validate from their machines.
  • Admins should test the newly-added IdP before activation with 2 to 3 active accounts of the directory.

Error logs will not be available for these features. However, the Test workflow allows the Admin to validate relevant errors before activation. Limitations to consider include: 

  • One directory can have up to two authentication profiles, and both the profiles should be for different authentication types. This means Microsoft Azure AD (which uses Open ID Connect) can stay with Other SAML providers, but Google (which itself uses SAML) cannot stay with Other SAML providers in the same directory. 
  • This feature does not allow admins to migrate their identity provider to enable directory sync functionality (Azure AD Connector and Google Connector). Although customers migrating to Microsoft Azure or Google as their IdP can use a different form of user management strategy. To learn more, see Adobe Admin Console users.

 Adobe

Get help faster and easier

New user?

Quick links

View all your plans Manage your plans
View quick links
Hide quick links

Legal Notices    |    Online Privacy Policy