Accounts in applications
Workday to Adobe integration: Creative Cloud licences per job profile and country from Workday
With an integration between Workday and Adobe Creative Cloud, a worker with a creative job profile in Workday automatically gets a Federated ID in the Adobe Admin Console, with the country of their Workday location and in the user group that belongs to their job profile. On a job change or termination the integration revokes the licence on the effective date, while their files remain for handover.
What the integration does
Organisations with Workday as their global HR system buy Adobe licences for marketing, design and communications, sometimes per region in a separate Admin Console. Licences are assigned by hand, stay put after a job change, and a user created in the wrong country cannot be changed afterwards.
- You record which job profiles get which Adobe user group, and which companies belong to which Adobe organisation.
- KoppelHet reads completed business processes from Workday with an Integration System User with read-only rights.
- A worker with such a job profile becomes a Federated ID on their hire date, with the country of their location, in the group of their job profile.
- On a job change KoppelHet switches the user group on the effective date.
- After the termination or contract end KoppelHet removes all groups; the account remains for the handover of files.
What to watch for with Workday and Adobe Creative Cloud
- Adobe requires a country for a Federated ID, and that country cannot be changed through the API afterwards. Workday holds a location with a country per worker. KoppelHet uses that country on creation; a later transfer to another country changes nothing in Adobe and goes as a notice to the Adobe admin.
- Large organisations sometimes have more than one Adobe organisation, for example per region. The User Management API works per organisation ID. KoppelHet decides per Workday company which Adobe organisation a worker goes into, so a designer in Germany does not end up in the Dutch Admin Console.
- A job change can be scheduled weeks ahead in Workday. Adobe links licences directly to user group membership, without an effective date. KoppelHet keeps the change and only switches the group on the effective date, so someone does not lose Photoshop while still working in their old job.
- Freelance designers and agency staff are in Workday as contingent workers with a contract end. If they have a work email on your domain, they get a Federated ID in the group of their job profile, and on the contract end KoppelHet removes the groups, even if the contract has not been formally closed in Workday.
- Workday supplies many workers, while Adobe processes ten calls per minute per client with ten users per call. KoppelHet therefore only sends workers with a job profile from the table, in batches, and waits the time in the Retry-After header on HTTP 429. The initial load runs over several runs.
- After a termination KoppelHet does not remove the user from the Adobe organisation and does not delete the account, because with deleteAccount Adobe also deletes the files. All groups are removed and the licence becomes free; the files remain until the Adobe admin has handed them over.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
We already use Entra ID or the User Sync Tool for Adobe. What then?
Then we choose one source. If Entra ID already fills Adobe, the job profile can land as a group in Entra ID and Microsoft's app stays the connection to Adobe.
What if someone moves to another country?
The country in Adobe stays as it was, because the API cannot change it. The Adobe admin gets a notice and decides whether a new account is needed.
When does an account disappear completely?
Not automatically. After the handover the Adobe admin deletes the account; automatically after a set period can be added later as an extension.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Workday is read with Get_Workers (Human_Resources) or a RaaS report on change date, with Include_Personal_Information, Include_Employment_Information (job profile, location) and Include_Organizations (company), under an Integration System User with read-only rights.
- Adobe through the User Management API: POST to https://usermanagement.adobe.io/v2/usermanagement/action/{orgId} with createFederatedID (country required), update, add and remove with group, and remove with all on leaving. At most ten users per call, ten calls per minute per client and a hundred per application; testOnly=true for a trial run.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Workday | Field in Adobe Creative Cloud | Notes |
|---|---|---|
Werk-e-mail | user (e-mail) en email | |
Preferred name (first) | firstname | |
Preferred name (last) | lastname | |
Land van de Location | country | ISO code, once on creation |
Job_Profile | add group (gebruikersgroep) | Through a table |
Company | orgId van de Adobe-organisatie | |
Termination_Date of contracteinde | remove group all |
Related
Ashby → Workday
Ashby to Workday integration: hires to Workday, with a check on outcome and phone number
Bullhorn → Workday
Bullhorn to Workday integration: a consultant's first placement as a hire in Workday
Carerix → Workday
Carerix to Workday integration: a placed candidate becomes a pre-hire and starts the hire
Greenhouse → Workday
Greenhouse to Workday integration: hires as pre-hires, interim staff and contractors included