Applies to enterprise & teams.
Entitlement profiles keep track of authorization information; that is, who is allowed to access any given product or service. When an admin provisions a user with access to an offering, that information is recorded in the user's entitlement profile.
When your organization is updated to the new cloud storage model, every user has both an authenticating account (Adobe ID, Enterprise ID, or Federated ID) and a profile-only account (Business ID). Authentication accounts contain the user's login credentials and personal information (name, email, group memberships). There are no credentials in a Business ID, only provisioning status. The Business ID is associated with one and only one authenticating account.
- Adobe IDs are individual accounts. Users manage their own login credentials through account.adobe.com. These are listed in the User Directory, and are the only type used by teams customers who do not claim domains.
- Enterprise IDs and Federated IDs (SSO) are managed accounts. This means that the admin controls the login credentials and group memberships through a User Directory in the Admin Console. A business that creates or trusts a claimed domain can add users to their Enterprise ID or Federated ID User Directories. Having a Federated ID directory lets you enable SSO.
- An email address in a federated domain (such as adobe.com) can be used for both an Adobe ID and a Federated ID in the same organization. When this happens, the user sees an account picker to choose which account to sign in with. Once they have chosen the account, they could see the profile picker to choose from profiles associated with that account.
Types of Adobe profiles
Each user has one or more entitlement profiles. The profile associates the user's authenticating ID with a set of apps and services that user is entitled to use.
Business profiles: Managed IDs and Business IDs can both contain business profiles. A business profile consists of a single authentication account and one or more Business IDs linked to it. All of the seats delegated to a user by your organization are part of a business profile in their Business ID account. If a user is provisioned through more than one Console, they must choose which organization's profile to use when they sign in.
Personal profiles: An Adobe ID contains a personal profile along with the user's authentication credentials. A personal profile authorizes access to the products that come free from Adobe, and any products or services the user has purchased individually. When the primary admin for an organization uses an Adobe ID, their administrative access is part of their personal profile.
Choosing profiles
When a user signs in to use Adobe products, they always have to authenticate using the credentials in their authentication account. If they have more than one authenticating account that uses the same email, they will have to choose which account to sign in with. After authenticating, they might also need to choose a profile.
If a user has only one Business ID account on one Console, they won't have to choose a profile. If they have more than one profile that could provide access to the same product or service, they have to choose which profile to use. This can happen when the same authentication account is linked to Business IDs in more than one organization in a cluster.
- See Update Experience for Admins and End-users for how this works.
Once the user signs in using the business profile for your organization, they have access to assets in your organization's cloud storage, according to the group memberships and access rights you have assigned. Any work they do is saved to your organization's cloud storage. They do not have access to their own personal assets, or assets in any other organization's cloud storage during that session. To get to, say, their personal photos, they would have to sign out, then sign in again and choose their Personal Profile. Similarly, once they have chosen their Personal Profile, they cannot access their work assets in the same session.