User Guide Cancel

Domain Enforcement for restricted authentication

Search
Enterprise

Enterprise

Admin Console
  1. Adobe Enterprise & Teams: Administration guide
  2. Plan your deployment
    1. Basic concepts
      1. Licensing
      2. Identity
      3. User management
      4. App deployment
      5. Admin Console overview
      6. Admin roles
    2. Deployment Guides
      1. Named User deployment guide
      2. SDL deployment guide
      3. Deploy Adobe Acrobat 
    3. Deploy Creative Cloud for education
      1. Deployment home
      2. K-12 Onboarding Wizard
      3. Simple setup
      4. Syncing Users
      5. Roster Sync K-12 (US)
      6. Key licensing concepts
      7. Deployment options
      8. Quick tips
      9. Approve Adobe apps in Google Admin Console
      10. Enable Adobe Express in Google Classroom
      11. Integration with Canvas LMS
      12. Integration with Blackboard Learn
      13. Configuring SSO for District Portals and LMSs
      14. Add users through Roster Sync
      15. Kivuto FAQ
      16. Primary and Secondary institution eligibility guidelines
  3. Set up your organization
    1. Identity types | Overview
    2. Set up identity | Overview
    3. Set up organization with Enterprise ID
    4. Setup Azure AD federation and sync
      1. Set up SSO with Microsoft via Azure OIDC
      2. Add Azure Sync to your directory
      3. Role sync for Education
      4. Azure Connector FAQ
    5. Set up Google Federation and sync
      1. Set up SSO with Google Federation
      2. Add Google Sync to your directory
      3. Google federation FAQ
    6. Set up organization with Microsoft ADFS
    7. Set up organization for District Portals and LMS
    8. Set up organization with other Identity providers
      1. Create a directory
      2. Verify ownership of a domain
      3. Add domains to directories
    9. SSO common questions and troubleshooting
      1. SSO Common questions
      2. SSO Troubleshooting
      3. Education common questions
    10. Set up Frame.io for enterprise
      1. Adobe Admin Console for Frame.io enterprise users
      2. Automate your setup using Frame.io server-to-server support
  4. Manage your organization setup
    1. Manage existing domains and directories
    2. Enable automatic account creation
    3. Domain Enforcement for restricted authentication
    4. Set up organization via directory trust
    5. Migrate to a new authentication provider 
    6. Asset settings
    7. Authentication settings
    8. Privacy and security contacts
    9. Console settings
    10. Manage encryption  
  5. Manage users
    1. Overview
    2. Manage administrative roles
    3. Manage user roles
    4. User management strategies
      1. Manage users individually   
      2. Manage multiple users (Bulk CSV)
      3. User Sync tool (UST)
      4. Microsoft Azure Sync
      5. Google Federation Sync
    5. Assign licenses to a Teams user
    6. In-app user management for teams
      1. Manage your team in Adobe Express
      2. Manage your team in Adobe Acrobat
    7. Add users with matching email domains
    8. Change user's identity type
    9. Manage user groups
    10. Manage directory users
    11. Manage exception list for domain enforcement
    12. Manage developers
    13. Migrate existing users to the Adobe Admin Console
    14. Migrate user management to the Adobe Admin Console
  6. Manage products and entitlements
    1. Manage products and product profiles
      1. Manage products
      2. Buy products and licenses
      3. Manage product profiles for enterprise users
      4. Manage automatic assignment rules
      5. Entitle users to train Firefly custom models
      6. Review product requests
      7. Manage self-service policies
      8. Manage app integrations
      9. Manage product permissions in the Admin Console  
      10. Enable/disable services for a product profile
      11. Single App | Creative Cloud for enterprise
      12. Optional services
    2. Manage Shared Device licenses
      1. What's new
      2. Deployment guide
      3. Create packages
      4. Recover licenses
      5. Manage profiles
      6. Licensing toolkit
      7. Shared Device Licensing FAQ
  7. Get started with Global Admin Console
    1. Adopt global administration
    2. Select your organization
    3. Manage organization hierarchy
    4. Manage product profiles
    5. Manage administrators
    6. Manage user groups
    7. Create license assignment reports
    8. Update organization policies
    9. Manage policy templates
    10. Allocate products to child organizations
    11. Execute pending jobs
    12. Download audit logs and export reports
    13. Export or import organization structure
  8. Manage storage and assets
    1. Storage
      1. Manage enterprise storage
      2. Adobe Creative Cloud: Update to storage
      3. Manage Adobe storage
    2. Manage projects
    3. Asset migration
      1. Automated Asset Migration
      2. Automated Asset Migration FAQ  
      3. Manage transferred assets
    4. Reclaim assets from a user
    5. Student asset migration | EDU only
      1. Automatic student asset migration
      2. Migrate your assets
  9. Manage services
    1. Adobe Stock
      1. Adobe Stock credit packs for teams
      2. Adobe Stock for enterprise
      3. Use Adobe Stock for enterprise
      4. Adobe Stock License Approval
    2. Custom fonts
    3. Adobe Asset Link
      1. Overview
      2. Create user group
      3. Configure Adobe Experience Manager Assets
      4. Configure and install Adobe Asset Link
      5. Manage assets
      6. Adobe Asset Link for XD
    4. Adobe Acrobat Sign
      1. Set up Adobe Acrobat Sign for enterprise or teams
      2. Adobe Acrobat Sign - Team feature Administrator
      3. Manage Adobe Acrobat Sign on the Admin Console
    5. Creative Cloud for enterprise - free membership
      1. Overview
  10. Deploy apps and updates
    1. Overview
      1. Deploy and deliver apps and updates
      2. Plan to deploy
      3. Prepare to deploy
    2. Create packages
      1. Package apps via the Admin Console
      2. Create Named User Licensing Packages
      3. Manage pre-generated packages
        1. Manage Adobe templates
        2. Manage Single-app packages
      4. Manage packages
      5. Manage device licenses
      6. Serial number licensing
    3. Customize packages
      1. Customize the Creative Cloud desktop app
      2. Include extensions in your package
    4. Deploy Packages 
      1. Deploy packages
      2. Deploy Adobe packages using Microsoft Intune
      3. Deploy Adobe packages with SCCM
      4. Deploy Adobe packages with ARD
      5. Install products in the Exceptions folder
      6. Uninstall Creative Cloud products
      7. Use Adobe provisioning toolkit enterprise edition
    5. Manage updates
      1. Change management for Adobe enterprise and teams customers
      2. Deploy updates
    6. Adobe Update Server Setup Tool (AUSST)
      1. AUSST Overview
      2. Set up the internal update server
      3. Maintain the internal update server
      4. Common use cases of AUSST   
      5. Troubleshoot the internal update server
    7. Adobe Remote Update Manager (RUM)
      1. Release notes
      2. Use Adobe Remote Update Manager
    8. Troubleshoot
      1. Troubleshoot Creative Cloud apps installation and uninstallation errors
      2. Query client machines to check if a package is deployed
  11. Manage your Teams account
    1. Overview
    2. Update payment details
    3. Manage invoices
    4. Change contract owner
    5. Change your plan
    6. Change reseller
    7. Cancel your plan
    8. Purchase Request compliance
  12. Renewals
    1. Teams membership: Renewals
    2. Enterprise in VIP: Renewals and compliance
  13. Manage contracts
    1. Automated expiration stages for ETLA contracts
    2. Switching contract types within an existing Adobe Admin Console
    3. Value Incentive Plan (VIP) in China
    4. VIP Select help
  14. Reports & logs
    1. Audit Log
    2. Assignment reports
    3. Content Logs
  15. Get help
    1. Contact Adobe Customer Care
    2. Support options for teams accounts
    3. Support options for enterprise accounts
    4. Support options for Experience Cloud

Applies to enterprise.

System administrators can restrict organization-owned domains to prevent users from creating and using personal Adobe ID accounts. This limits personal data usage, enhances security, and allows asset-sharing only between organization users.

Before you begin

You should ensure your organization meets the following prerequisites to use domain enforcement:

  • Your organization must have one or more Enterprise or Federated directories with claimed domains established in the Adobe Admin Console.
  • You must have system administrator permissions to view and manage domain enforcement in your Admin Console.

Benefits of restricting domains

 Block creation of new Adobe ID accounts with an organization-owned domain

 Facilitate uniform federated sign-in workflow for all users on an organization-owned domain

 Control the number of user accounts and profiles on an organization-owned domain

 Promote better collaboration between end users on Enterprise Storage

 Block purchase of software for personal use under an organization-owned domain

Domain enforcement settings

Domain enforcement is enabled by default on all newly created Enterprise and Federated directories. ​All domains within the domain enforcement policy-enabled directories will have restricted authentication. Users can't create new accounts using restricted domains linked to policy-enabled directories.

You can manage your users and directories in the following ways with domain enforcement:

  • Restrict the creation of Adobe ID accounts with organization-owned domains
  • Transition existing users with Adobe ID accounts in your organization to Enterprise ID or Federated ID accounts, requiring secure login for license and storage access
  • Generate a report indicating which users have Adobe ID accounts with enforced domains
  • Require existing Adobe ID accounts using organization-owned domains to change the email associated with the account to a personal address

Go to the Adobe Admin Console Settings to view your directories and their Domain enforcement statuses in the Adobe Admin Console. Then, select a directory with Domain enforcement status set to On to view the Domain enforcement settings section.

Admin Console Directories
An image of Adobe Admin Console "Identity settings" section. Displays the Domain enforcement settings in a directory MB_DE_ENFORCED..

Turn off Domain enforcement

Caution:

Adobe strongly recommends that you keep domain enforcement ON for your directories. Turning domain enforcement on or off frequently may result in users facing disruptions while signing in.

You can turn off domain enforcement for any directory by following the steps:

  1. Select Identity settings > Directory.

  2. Deselect Domain enforcement toggle.

Visit the Admin Console Insights section and select Logs to view the changes related to domain enforcement policy at any time.

Domain enforcement best practices

You can best use the domain enforcement feature by setting up your domains and directories to align with your organization's needs:

  • Link domains to directories: To stop users associated with a particular domain from creating new accounts or using organization email for personal use, you must link the domains with domain enforcement-enabled directories.
  • Transfer domains to a different directory: If you want to allow personal use of their organization email for users associated with one or more domains, you must transfer these domains to one target directory. Then, turn off domain enforcement for this target directory.
  • Allow automatic account creation: If you want users to create a Federated ID only with their organization-owned email address, you must enable both domain enforcement and automatic account creation.

Enable sign-in requirements for existing users

Enforce secure authorization

Adobe recommends that you Edit users' identity type to transfer existing Adobe ID users to Enterprise ID or Federated ID before you enable the Require email change policy. This ensures all users in a directory have a consistent sign-in experience and prevents unintended change requests from organization users.

Select Admin Console Users, and then navigate to Edit identity type by CSV from the three-dot menu.

Admin Console Users section

Require email change

This feature allows you to force existing Adobe ID accounts in an enforced directory to change their associated email addresses. When the email change feature is enabled, an Adobe ID user has 30 days from the first sign-in attempt to change their email address. After 30 days, they must change their email address to access their account and data.

When enabled, a user affected by the policy views a message on their next sign-in: Update Your Email. To avoid confusion, inform your users about this change before enabling the Require email change setting.

Learn more about end user experience when require email change is on
Note:
  • If the required email change policy is enabled, any email address on the exception list is exempt and can remain as an Adobe ID using an enforced domain. If the email address is removed from the exception list at any time and require email change is enabled, the user will be subject to the policy.
  • Any data associated with the users remains unaffected, and they can still change their email to start using their apps and data at any time.
  • If you turned off the feature after using it initially, users who have not yet changed their email address will stop seeing Update Your Email message. However, a user who completed the email change can neither revert the change nor make a new Adobe ID with the old email address unless domain enforcement is removed from the affected directory.

Download personal Adobe ID users' report

This user report allows you to view a list of Adobe IDs using a claimed domain for the email address associated with their account. You can download the report for any directory every hour in each organization.

The report provides a list of email addresses for users who have accepted the latest Adobe Terms of Use with their personal accounts. To download the list of Adobe ID users, go to Adobe Admin Console, and then select Insights > Reports. 

Admin Console Insights

Exception list

The exception list allows defined users to bypass domain enforcement policy and use a personal Adobe ID account with their managed email.

System admins can use the exception list to add service accounts, troubleshoot SSO issues, and strategically exclude users from the require email change setting.

Learn more about the exception list

Related resources

Get help faster and easier

New user?

Quick links

View all your plans Manage your plans
View quick links
Hide quick links

Legal Notices    |    Online Privacy Policy