Manage everything in Azure AD
Control what data is sent to Adobe
No need for another service or API setup
Customize Azure AD user attribute mapping
Applies to enterprise.
Azure Sync automates the user management for your Admin Console directory. You can easily add Azure Sync to any federated directory in the Admin Console regardless of its identity provider (IdP). To use Azure Sync, you must have your organization's users and groups data stored in the Microsoft Azure Active Directory (Azure AD).
You can add Azure Sync to any directory in the Adobe Admin Console to automate its user management process. Azure Sync uses SCIM-protocol for user management and offers you control over user and group being sent to Adobe. Azure AD users synchronized with the Adobe Admin Console are unique and can be assigned to one or more product profiles.
After you've set up Azure Sync, Azure AD starts to send data to the Adobe Admin Console as per the Azure AD directory's user and group provisioning. All the details associated with the directory are displayed in the Settings section of the Adobe Admin Console.
The key advantages of the Azure Sync with your directory in the Adobe Admin Console are:
Manage everything in Azure AD
Control what data is sent to Adobe
No need for another service or API setup
Customize Azure AD user attribute mapping
Add sync to previously configured directories
Add Azure sync to directories set up for any IdP
Onboard and offboard users easily using Azure AD
To integrate Adobe Admin Console User management with Azure AD, you need the following:
Directory setup scenario |
Method to add sync |
---|---|
Single federated directory with one or more domains in the same Azure AD tenant. |
Follow Add Sync steps to establish Azure Sync. |
Multiple federated directories with one or more domains that belong to the same Azure AD tenant. |
|
Multiple federated directories with one or more domains that belong to different Azure AD tenants. |
|
Follow the points below to see the best practices and Adobe Recommendations before you set up Azure Sync:
You can add Azure Sync to an Adobe Admin Console federated directory with the required domains linked to it. To add sync to an established federated directory, follow the process below:
On the Settings tab of the Adobe Admin Console, navigate to Directory Details > Sync. Click Add Sync.
Select Sync users from Microsoft Azure card and click Next.
Steps in Microsoft Azure Portal:
Leave the Admin Console window open for reference, and open Microsoft Azure Portal in a separate browser. Then, follow the steps mentioned in the Microsoft doc to configure automatic user provisioning.
You can sync nested groups from Azure AD through the Azure Sync integration, though nested groups are not automatically synced when the parent node of the group is added to the sync scope. You should also add Nested groups to the scope to include them in the automated sync.
Organizations must have a Premium (P1 or P2) or Microsoft 365 (E3 or A3) subscription with Azure Active Directory to use group-based assignment capabilities which allows an administrator to choose specific groups and users as the only objects to be synced to the Adobe Admin Console.
Organizations without these subscription levels can only sync individual users (not groups) or all users and groups in the Azure AD to the Adobe Admin Console. Check your Microsoft Azure subscription to confirm your organization's level and get in touch with your Microsoft representative if required.
After set up, Azure starts to process and send data for provisioning in Adobe. You can review other instruction via Microsoft Application Management tutorials.
In the Adobe Admin Console window, check the box to confirm the Authorization of Adobe access and completed setup in Azure AD. Then choose Done.
Go back to directory details > Sync. Sync Source is displayed.
Azure Sync is integrated with your directory but it hasn't yet started. To initiate sync, you have to click Go to Settings and edit sync settings.
A System Administrator can update settings for the Sync Source once the setup is complete by choosing Go to Settings from the Directory settings > Sync tab. Setting options include:
Allow editing synced data in Admin Console: Once Azure Sync is established, all users and sync-created groups in a directory automatically go under sync management. After you enable editing, you can edit synced data in the Admin Console for a brief period. Any edits during this time do not affect user information in the Azure AD, but are overwritten by change requests from your identity provider.
By default, you must edit synced data from the identity provider and allow the changes to propagate through sync. We do not recommend you to manually change data in Admin Console unless absolutely necessary.
Sync status: Instructs Azure Sync to reject change requests from Azure AD. Once the User Sync Status is Off, changes in Azure AD (user information source) are not pushed to the Adobe Admin Console.
Edit user sync configuration: Redirects you to the configuration instructions to edit user sync. Use this if the modal is closed before completing the sync setup or if you must change things in Azure AD after the initial configuration.
Administrators can choose to remove sync from a federated directory within the Admin Console. Removing sync leaves the directory and its associated domains, user groups, and users intact, and removes read-only mode from the directory and its users and groups.
To remove sync from a directory, choose Go to Settings from the Directory settings> Sync tab, then Remove Sync. This action will permanently remove the sync setup from the Admin Console. If needed, you can reestablish sync with the same or different directory.
Domains cannot be moved to or from a directory managed by Azure Sync within the same organization. Once Azure Sync is removed from the source and/or target directory, a domain from that directory can be moved to another target directory, and domains from other source directories can be moved into the directory that is no longer managed by Azure Sync.
Implementing Azure Sync creates new federated user accounts and syncs users to the Adobe Admin Console. Administrators can also deprovision users and groups added through Azure Sync via the below three methods (in the Microsoft Azure Portal):
Remove user from all synced groups in Azure AD
Soft delete user from Azure AD
Remove all groups that the user is part of from the provisioning scope in Azure AD
These three operations disable users in the Adobe Admin Console. A disabled user is no longer able to log in and shows as Disabled in the Directory Users list. Azure Sync will keep managing a user deprovisioned by one of these methods. Neither the user’s account nor cloud-stored assets are removed from the organization.
Remove a user and associated data from the Admin Console: Choose Go to Settings from the Directory settings > Sync tab and click Enable editing. Then navigate to Users > Directory Users and choose the user from the list to permanently delete the account.
Once editing is enabled, it allows edits in the synced data for one hour before getting automatically disabled. We recommend you to click Disable editing immediately after user removal to ensure that the Admin Console reflects Azure AD changes.
If you permanently delete a user, the user is deleted along with all the cloud-stored assets belonging to that user. The user and the assets cannot be recovered once this action is taken.
Adobe and Microsoft have a quarantine policy to handle numerous error calls during sync operations.
The Azure AD provisioning service monitors the health of your configuration and places unhealthy apps in a "quarantine" state. If most or all of the calls made against the target system consistently fail because of an error, for example, invalid admin credentials, the provisioning job is marked as in quarantine. While in quarantine, the frequency of incremental cycles is gradually reduced to once per day. The provisioning job is removed from quarantine after all errors are fixed and the next sync cycle starts. If the provisioning job stays in quarantine for more than four weeks, the provisioning job is disabled (stops running). Learn more about applications provisioning in quarantine status within Azure AD.
Adobe’s service independently monitors sync health to verify when the error rate surpasses a certain threshold in a set amount of time. A minimum number of requests resulting in an error that meets the threshold will enact temporary quarantine, resulting in rejecting all calls and update requests from Azure AD for a time period, after which calls will be accepted again for sync retry. If error calls persist, the sync will be placed on temporary probation for an extended time period in quarantine. If Adobe initiates the quarantine, it may also lead to a subsequent quarantine with Azure due to the rejected calls, which will count toward error rates in Azure. Note that Adobe reserves the right to update the quarantine parameters based on ongoing data analytics.
There is a set of common error messages displayed to be aware of when managing Azure Sync from Azure AD. Understanding the cause of the various error messages will aid in troubleshooting when errors occur.
Learn more about monitoring your deployment within Azure AD.
As the Adobe Admin Console uses Microsoft’s Azure sync service, all sync issues are troubleshot within Azure AD. You can refer to Microsoft’s configuration instructions to solve some common issues. If you are unable to find a solution, we recommend you to contact Microsoft Support for further assistance.
Follow the instructions below to diagnose a sync issue:
Confirm your user and group setup:
Make sure you have configured the users and groups as per the setup instructions:
Confirm mapping of the user details: Microsoft documentation.
Monitor your provisioning application to uncover issues that may affect sync:
If the users don't appear in the provisioning logs, they may be out of scope. If the provisioning logs show an issue, fix it to allow the user to sync. Microsoft documentation
Powershell extensions:
Use the Azure Powershell extensions to identify any issues with the user’s Azure AD record.
Confirm the user data with the following Powershell commands. If you need time to accomplish these steps, enable editing mode in the admin console to make the temporary changes:
Additional steps are required to convert all existing non-Federated ID users to Federated ID type.
DO NOT assign any products to the synced federated users when doing the edit identity switch. It should be done right after syncing but before any product assignment.
Users that have an existing non-Federated ID account in the Admin Console can be migrated to a Federated ID account once Azure Sync has been established. Once converted, Azure AD pushes these accounts to Adobe Admin Console successfully.
To ensure that any cloud-stored assets are migrated to the user’s new identity type, follow the process below:
Set up Azure Sync for users who already have a non-Federated ID on the Adobe Admin Console. Any users with an existing non-Federated ID now have both a non-Federated ID and a Federated ID in the Adobe Admin Console.
Follow the steps in Edit Identity Type by CSV to change non-Federated ID users to Federated ID type. Ensure to match the following details:
Upon login with the new Federated ID, the user will be prompted with an option to automatically migrate cloud-stored assets to the new account.
Once you've added Azure Sync to your directory, all users and user groups are imported to the Adobe Admin Console and updated at regular intervals. Next, you've to enable these users to access their designated Adobe apps:
If you're the admin of an institution, after setting up Azure sync, we recommend that you enable role sync. Learn about Role sync for Education.