Manage user provisioning via the Google Admin Console
Control what data is sent to Adobe
Assign products to multiple users based on Google Organizational Units
Applies to enterprise.
Google Sync automates user management for your Admin Console directory. Add Google Sync to any existing federated directory in the Adobe Admin Console regardless of its identity provider (IdP). To use Google Sync, you must store your organization’s user data within the Google Admin Console.
You can add Google Sync to any directory in the Adobe Admin Console to automate its user management process. Google Sync uses SCIM-protocol for user management and offers you control over user information shared with Adobe. Specified users in the Google Admin Console synchronized with the Adobe Admin Console can be assigned to one or more product profiles.
After you've set up Google Sync, Google starts to send data to the Adobe Admin Console as per the Google Admin Console directory's user provisioning configuration. You can see the directory's details in the Settings section of the Adobe Admin Console.
The key advantages of the Google Sync with your directory in the Adobe Admin Console are:
Manage user provisioning via the Google Admin Console
Control what data is sent to Adobe
Assign products to multiple users based on Google Organizational Units
Add sync to previously configured directories
Add Google sync to other IdP directories
Onboard and offboard users easily using Google Admin Console
No need for another service or API setup
To integrate Adobe Admin Console user management with Google Admin Console, you need the following:
Directory setup scenario |
Method to add sync |
---|---|
Single Google Admin Console tenant to a single Adobe Admin Console |
Follow Add Sync steps to establish Google Sync. |
Multiple federated directories with one or more domains that belong to the same Google Admin Console tenant. |
|
Multiple federated directories with one or more domains that belong to different Google Admin Console tenants. |
|
Follow the points below to see the best practices and Adobe Recommendations before you set up Google Sync:
In the Adobe Admin Console, navigate to Settings > Directory Details > Sync. Click Add Sync.
Select Go to Google Admin Console and log in with an administrator account. Then, follow the steps on the instruction page in the Adobe Admin Console to configure automatic user provisioning.
You can sync Google Organizational units (OUs) to your Google sync-enabled directory in the Admin Console. Each OU (including the root OU) in the Google Admin console is synced as a separate group along with the associated users.
For example, you've three users in the Google Admin console (User A, User B, and User C) in separate OUs. The following table shows how these users will be added to corresponding groups in the Adobe Admin Console (User B and User C are added to more than groups):
User |
Google Admin Console OU |
Adobe Admin Console user group |
---|---|---|
User A |
Root Organizational Unit |
OU-/ |
User B |
"/Sales" |
1. OU-/ 2. OU-/Sales |
User C |
"/Sales/Germany" |
1. OU-/ 2. OU-/Sales 3. OU-/Sales/Germany |
You must set up your Google OUs based on your licensing requirements before syncing them to the Adobe Admin Console.
Then, sign in to your Google Admin console and go to Apps > Web and mobile apps > select Adobe SAML app > go to Autoprovisioning > select Edit Attribute mapping.
In the Attributes window, select the Organizational unit path from the dropdown against the app attribute urn:ietf:params:scim:schemas:extension:Adobe:2.0:User.organizationalUnit.
A System Administrator can update settings for the Sync Source once the setup is complete by choosing Go to Settings from the Directory settings > Sync tab. Setting options include:
Allow editing synced data in Admin Console: Once Google Sync is established, all the users in a directory automatically go under sync management. After you enable editing, you can edit synced data in the Admin Console for a brief period. Any edits during this time do not affect user information in the Google Admin Console but are overwritten by change requests from your identity provider.
By default, you must edit synced data from the identity provider and allow the changes to propagate through sync. We do not recommend you to change data in Adobe Admin Console unless necessary manually.
Administrators can choose to remove sync from a federated directory within the Admin Console. Removing sync leaves the directory and its associated domains, user groups, and users intact and removes read-only mode from the directory and its users and groups.
To remove sync from a directory, choose Go to Settings from the Directory settings> Sync tab, then Remove Sync. Please also turn off autoprovisioning for the Adobe SAML app from Google Admin Console to prevent being quarantined. This action will permanently remove the sync setup from the Adobe Admin Console. If needed, you can reestablish sync with the same or different directory.
You cannot move domains to or from a directory managed by Google Sync. Once Google Sync is removed from the source and/or target directory, a domain from that directory can be moved to another target directory, and domains from other source directories can be moved into the directory that is no longer managed by Google Sync.
Implementing Google Sync creates new federated user accounts and syncs users to the Adobe Admin Console. Administrators can also deprovision users added through Google Sync via the below three methods (in the Google Admin Console):
These three operations disable users in the Adobe Admin Console. A disabled user can no longer log in and shows as Disabled in the Directory Users list. Google Sync continues to manage a user deprovisioned by one of these methods. Neither the user’s account nor cloud-stored assets are removed from the organization.
Remove a user and associated data from the Admin Console: Choose Go to Settings from the Directory settings > Sync tab and click Enable editing. Then navigate to Users > Directory Users and choose the user from the list to permanently delete the account.
Once editing is enabled, it allows edits in the synced data for one hour before getting automatically disabled. We recommend you to click Disable editing immediately after user removal to ensure that the Admin Console reflects Google Admin Console changes.
If you permanently delete a user, the user is deleted along with all the cloud-stored assets belonging to that user. The user and the assets cannot be recovered once this action is taken.
Adobe has a quarantine policy to handle numerous error calls during sync operations.
Adobe’s service independently monitors sync health to verify when the error rate surpasses a certain threshold in a set amount of time. A minimum number of requests resulting in an error that meets the threshold will enact temporary quarantine, resulting in rejecting all calls and update requests from the Google Admin Console for a time period, after which calls will be accepted again for sync retry. If error calls persist, the sync will be placed on temporary probation for an extended time period in quarantine. If Adobe initiates the quarantine, it may also lead to a subsequent quarantine with Google due to the rejected calls, which will count toward error rates in Google. Note that Adobe reserves the right to update the quarantine parameters based on ongoing data analytics.
Google may quarantine sync based on error rate.
A set of common error messages is displayed to be aware of when managing Google Sync from the Google Admin Console. Understanding the cause of the various error messages will aid in troubleshooting when errors occur.
You can find sync logs and error logs under the Auto-provisioning section of the Adobe SAML app within the Google Admin Console. Learn more about monitoring your deployment within the Google Admin Console.
Google OU sync errors
You might face syncing errors while syncing Google Organizational Units to Adobe Admin Console. Google logs display the following errors:
As the Adobe Admin Console uses the Google sync service, all sync issues are troubleshot within the Google Admin Console. You can refer to Google's configuration instructions to solve some common issues. If you are unable to find a solution, we recommend you to contact Google customer support for further assistance.
Follow the instructions below to diagnose a sync issue:
Confirm your setup:
Make sure you've configured the users and groups as per the setup instructions:
Confirm mapping of the user details.
If you want to sync Google Organizational Units, make sure that your User Provisioning attribute mapping includes the Organizational unit path as urn:ietf:params:scim:schemas:extension:Adobe:2.0:User.organizationalUnit .
Allow editing synced data in Adobe Admin Console:
After you enable editing, you can edit synced data in the Adobe Admin Console for a brief period. Any edits during this time do not affect user information in the Google Admin Console. Later, your identity provider's change requests automatically overwrite these brief changes.