Accounts in applications
Entra ID to Adobe integration: Creative Cloud users and licences through groups in Microsoft Entra ID
With an integration between Microsoft Entra ID and Adobe Creative Cloud, everyone in an Adobe group in Entra ID automatically reaches the Adobe Admin Console, in the user group with the matching product profiles and therefore with the right licence. KoppelHet sets up provisioning in Entra ID, cleans up licences that are still assigned individually and lets the groups follow the work in HR.
What the integration does
Organisations that have Entra ID as their source and buy Adobe Creative Cloud or Acrobat often still manage licences with the User Sync Tool or by hand in the Admin Console. When moving to provisioning from Entra ID, licences that were once assigned individually simply remain, and the Adobe groups in Entra ID lag behind who holds which job.
- The Adobe admin pauses the User Sync Tool or the UMAPI integration and creates a sync with Microsoft in the Admin Console.
- KoppelHet sets up provisioning to Adobe in Entra ID, with a country for every user and the groups that grant licences.
- Where you want it, those groups get a dynamic rule on job title or department in Entra ID.
- The Adobe admin attaches the product profiles to the synced user groups once.
- Through the User Management API KoppelHet removes the individually assigned licences of people who now get them through a group, after which the User Sync Tool is switched off.
What to watch for with Microsoft Entra ID and Adobe Creative Cloud
- The User Sync Tool or a UMAPI integration has to be paused first and may only be removed after a working sync from Entra ID. Two sources for the same Adobe users reverse each other's changes. KoppelHet plans the switch so there is no day on which both are on.
- According to Adobe, someone who was given a licence individually in a product profile keeps it even when they leave the user group. After moving to groups from Entra ID, leavers and people changing jobs would therefore keep their licence. KoppelHet compares the profiles with the groups and removes the individual assignments.
- Adobe requires a country on creation and that country cannot be changed through the API afterwards. In Entra ID country is often empty. KoppelHet fills the country from usageLocation or a fixed value per site, so a user is not created with a wrong or empty country.
- In the Admin Console licences belong to product profiles, and a user group gives all its members the profiles attached to it. The groups from Entra ID arrive as user groups. The Adobe admin attaches the profiles to those groups once; after that, membership in Entra ID decides who holds which licence.
- With a dynamic group in Entra ID, the membership of an Adobe group follows job title or department by itself. A new designer from HR thus gets their licence without a ticket, and someone who moves to another department loses it again. Dynamic groups do require an Entra ID P1 licence.
- The clean-up runs through Adobe's User Management API, which allows ten users per call and ten calls per minute per client. KoppelHet first runs that one-off clean-up in test mode, so the Adobe admin sees which licences will disappear before it really happens.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Does anything from KoppelHet keep running after setup?
In the smallest form, no: the sync runs through Entra ID. A monthly check on individually assigned licences can be added later as an extension.
What happens to a leaver's files?
Removing the licence does not delete files. The Adobe admin deletes the account permanently after the handover.
Does this also work with Okta?
This page is about Entra ID. With Okta as the source the licence logic through user groups works the same way, but the technology differs.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Entra ID writes through provisioning with the tenant URL and secret token from Admin Console > Settings > Directory Details > Sync. User attributes userName (required, matching), active, emails work, addresses work country, name.givenName, name.familyName and the Adobe extension emailAliases; groups on displayName with members. Requires a federated directory with verified domains.
- The clean-up uses the User Management API: POST to https://usermanagement.adobe.io/v2/usermanagement/action/{orgId} with remove and productConfiguration, first with testOnly=true. At most ten users per call; HTTP 429 with Retry-After on too many calls. Entra ID is read through Microsoft Graph with read-only rights.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Microsoft Entra ID | Field in Adobe Creative Cloud | Notes |
|---|---|---|
userPrincipalName | userName | |
mail | emails[type eq "work"].value | |
givenName en surname | name.givenName en name.familyName | |
usageLocation of country | addresses[type eq "work"].country | Two-letter code, fixed after creation |
accountEnabled en toewijzing | active | |
Groep (displayName) | Gebruikersgroep in de Admin Console | |
Groepsleden | members |
Related
ADP GlobalView → Microsoft Entra ID
ADP GlobalView to Entra ID integration: accounts per country from international payroll
ADP iHCM → Microsoft Entra ID
ADP iHCM to Entra ID integration: accounts from ADP payroll, with the right licence in every European country
ADP Workforce Now → Microsoft Entra ID
ADP Workforce Now to Entra ID integration: Microsoft accounts from ADP, with the work address back in ADP
AFAS Profit → Microsoft Entra ID
Connect AFAS with Microsoft Entra ID