How do I automatically assign products to users in Adobe Control panel?

[Jaan]

I've managed get SSO setup with Google and this syncs in the Google panel via SAML to the adobe panel. I can see the user accounts being populated in Adobe, but i need to assign them a product.... can this be done automatically?

 

It's all as clear as MUD!

[Koldov]

Don't have anything in front of me at the moment and it's a looooong time since I set it up (or does it just feel that way?)... I seem to remember feeling it wasn't very intuitive...

 

But IIRC in the console, go to Products and there should be an 'Assign Users' button on the relevant set of apps (we have 'Adobe Spark for K-12' and 'All Apps for K-12' in ours).

 

If you have set-up user groups (which I think you should have), just type the user group name it in the box that comes up.

[Jaan]

Don't have anything in front of me at the moment and it's a looooong time since I set it up (or does it just feel that way?)... I seem to remember feeling it wasn't very intuitive...

 

But IIRC in the console, go to Products and there should be an 'Assign Users' button on the relevant set of apps (we have 'Adobe Spark for K-12' and 'All Apps for K-12' in ours).

 

If you have set-up user groups (which I think you should have), just type the user group name it in the box that comes up.

 

Thanks for the reply. But my user groups are empty, i guess my question should have been, how do i automatically add new users to a user group in adobe admin panel?

[Koldov]

I'm sorry but I don't want to steer you wrong...

 

As far as i remember there are some funky ways to do it (Federated ID or Enterprise ID type users can automate the user management process using the User Sync tool, or the User Management API).

 

From here:

 

https://helpx.adobe.com/si/enterprise/admin-guide.html/si/enterprise/using/bulk-upload-users.ug.html

 

But I think we were 'old school' and went the .csv upload route (about a quarter of the way down that page)...

 

Basically I think download a csv with all the users > create groups in the console > upload csv with the correct groups.

 

Obviously double check all this info!

 

But actually it has brought up a question of my own... How do I see users that must have been added by Google since I set this up? I haven't added anyone manually as I have the same set-up as the OP and Google wouldn't know what group I wanted them in... Is there a 'default' group I can't see?

[Jaan]

How do I see users that must have been added by Google since I set this up? I haven't added anyone manually as I have the same set-up as the OP and Google wouldn't know what group I wanted them in... Is there a 'default' group I can't see?

 

My users have a two way arrow which i assume is because they have been synced from the Google admin panel.

 

[DalekSec]

We have similar but with Azure,

 

Adobe Syncs all our pupils by syncing our populated 'Adobe Pupils' group in Azure AD to Adobe. Then that group is assigned to the relevant plan in the Adobe admin panel. The Azure AD group is populated by having all the relevant teams in (Art teams in this case)

[Jaan]

We have similar but with Azure,

 

Adobe Syncs all our pupils by syncing our populated 'Adobe Pupils' group in Azure AD to Adobe. Then that group is assigned to the relevant plan in the Adobe admin panel. The Azure AD group is populated by having all the relevant teams in (Art teams in this case)

 

Interesting.... i'm syncing a OU in our Google admin panel not user groups. This was to get SSO to work. It does work.... if i assign a product to a user (in adobe) that has synced, they can access it........ but i seem to need to manually add all of the users.

 

EDIT: i've not actually installed anything to sync users/ user groups

Edited February 9, 2021 by Jaan

[Koldov]

Sorry to hijack the thread, but well... that's annoying (opened a can of worms)... and hopefully the OP can learn something from my mistakes...

 

Back when I set it up I used 'Groups' for syncing to Adobe (not OUs), no idea why and not sure if I read it was best practise or followed some guide or other.

 

It seems to have been justified though as my Business Manager is in charge of adding users to GSuite and at some point has decided to add all the TAs and SEN staff as teachers (which would exceed our Adobe license count).

 

Now, can anyone tell me what the CLASSROOM TEACHERS group is for (before you say classroom teachers, read on)... I originally set up a 'Teachers' group manually and much later on saw what must have been a system generated group called 'Classroom Teachers'. I also saw somewhere in something I read that this group should not be deleted and it started to be populated with teachers who were created after the original lot I created (by teachers logging on and selecting I am a teacher?). I hadn't ever checked this 'group' and apart from a few children (nice try), I saw some recently added teachers in the 'pending' section.

 

So I thought I would clean this all up and move the old teachers to this new 'Classroom Teachers' group and delete the old 'Teachers' group...

 

Ok, so hands up... I forgot that Adobe was being synced by Google groups... and now I have a sync error and new teachers not being added to Adobe....

 

That's fine I thought, I would just add the 'Classroom Teachers' group to Google SAML apps where the Adobe app is. But I can neither delete the 'Teachers' group (which doesn't actually exist anymore - but it still shows 3 groups syncing), or add the 'Classroom Teachers' group, as the SAML app refuses to see it as a group (possibly as it was system generated?)....

 

Failing any of this being able to be solved in a proper manner, should I just recreate the 'Teachers' group and add only the teachers I want to have Adobe to it (and do I have to change all sorts of other settings that a group may override any OU settings)?

Edited February 9, 2021 by Koldov

[adobe_macildowie]

I have recorded some videos on the Sync options for Azure and Google on this page

https://www.adobe.com/uk/education/schools/deployment.html

You can also request Spark for your school for free or a 1:1 deployment support call.

 

Options

Office 365 for SSO - Synced via Azure AD SCIM

Office 365 for SSO - Users synced via Active Directory using Adobe User Sync Tool

 

Google for SSO - Users are synced but as a flat group

Options -

CSV download add to a group and upload from the Adobe Admin Console

User Sync Tool - connected to AD and sync users and groups from AD but SSO is via Google, useful if AD is your source of truth and using GCDS

Just assigning Spark and want to provide to all users - User sync tool querying Adobe Admin Console from Google Sync and then moving all users into a default group.

 

You can use and SAML 2.0 SSO platform

https://helpx.adobe.com/ca/sign/using/enable-saml-single-sign-on.html

 

True passthrough SSO is not currently supported if using Creative Cloud when building a package you can select to use browser based authentication they will have to trigger the login by entering their email address.

[Jaan]

We use Google here. When had (In the past) managed to get our users in from Google via SAML. But the whole downloading a csv everytime i new student/staff member left or joined us was a deal breaker.

 

i just watched the video, so am i right in thinking i can use the user sync tool (instead of the csv download) to populate the groups and assign licenses automictically. or have i misunderstood that?

 

if so do you have a video on setting up that?

 

i think its "Google connector" and the "user sync tool" i get confused with.

 

The box at the top of these page suggest a better method is coming? https://helpx.adobe.com/enterprise/using/setup-sso-google.html

 

And at the top of this page, it says SAML is the older method https://helpx.adobe.com/enterprise/kb/configure-google-with-adobe-sso.html

 

i just don't know which method i should be using that will sync users from Google, allow the to SSO with their google account, and automictically assign them the spark/CC product licenses

[adobe_macildowie]

Hi Jaan

There was an update released today to separate the SSO for Google and the Sync.

On the deployment page you can book a 1:1 session and I will take you through.

https://www.adobe.com/uk/education/schools/deployment.html

[Jaan]

Hi Jaan

There was an update released today to separate the SSO for Google and the Sync.

On the deployment page you can book a 1:1 session and I will take you through.

https://www.adobe.com/uk/education/schools/deployment.html

 

but does this method allow the automatic allocation of licenses?

[pete_edgegain]

Hi Jaan

 

Please book a 1:1 session here: https://www.adobe.com/uk/education/schools/deployment.html

Where we can show you exactly how to automate the assigning of licences to groups.

[Jaan]

Hi Jaan

 

Please book a 1:1 session here: https://www.adobe.com/uk/education/schools/deployment.html

Where we can show you exactly how to automate the assigning of licences to groups.

 

Thread Zombie,

 

I know how to assign licences to groups....... i don't know how to assign users that have sync'd from Google Admin panel to a user group (which has an attached product to it).

 

Having to add them one by one or via a csv everytime a student comes and goes isn't an option.

 

Booking a 1:1 session is no good for me (or others that might have the same question and just want the answer). Surprisingly, we're all quite technically minded on here. So following instructions you should have on your website is something we find surprisingly easy. (Assuming we can find it)

 

It should be easier than this.......

 

Hi Jaan

There was an update released today to separate the SSO for Google and the Sync.

On the deployment page you can book a 1:1 session and I will take you through.

https://www.adobe.com/uk/education/schools/deployment.html

 

Can you provide the link to this update please?

 

thanks

Edited September 24, 2021 by Jaan

[Koldov]

I found this again quite recently... although it seems like a lifetime ago already.

 

Not being very familiar with the 'Adobe' way of doings things, but I couldn't find a real answer and there was nothing in the Admin console that seemed to intuitively suggest it could be done.

 

All our Year 6 leavers left... which was good (synced with our GSui... Google Workspace) and I think I remember all our new Year 3 students appeared, so again all good.

 

The thing it doesn't do is replicate the OU structure in Google Workspace (we don't have it set up with Groups there, I wonder if that would make a difference?) and even though I have a 'Students' OU in Google and a 'Students' group in Adobe it doesn't follow.

 

All the users are synced into Adobe from Google into the 'Users' section with nothing assigned, then I seem to remember having to download a .csv, sort them all out and upload the .csv into the correct group - but there seems to be nothing that suggest I can have the user sync from Google to Adobe based in their Google 'OU' into the correct Adobe 'Group' and automatically have the correct apps assigned to them with the appropriate license...

 

Not too bad as we are only 3 form entry (90 new students), but for a big school it would be a pain, there must be a way to do this for larger schools and enterprise...

 

EDIT: It's all coming back to me... Actually I think I had to download a 'Users' .csv and then one from my 'Students' group in Adobe then compare the two (with a quick VLOOKUP) and remove one from the other (removing new teachers and such) and voila! I'm left with all the 'new' students to then upload them into the 'Students' group... really not a good way to be dealing with it though...

Edited September 24, 2021 by Koldov

[Koldov]

Google for SSO - Users are synced but as a flat group

Options -

CSV download add to a group and upload from the Adobe Admin Console

User Sync Tool - connected to AD and sync users and groups from AD but SSO is via Google, useful if AD is your source of truth and using GCDS

Just assigning Spark and want to provide to all users - User sync tool querying Adobe Admin Console from Google Sync and then moving all users into a default group.

 

If this still holds true, that will prohibit us using this method as we don't have AD accounts for the students.

[Jaan]

Being able to highlight all users in the Adobe panel and assigning to a group would be fine...... but you can't "select all" on sync'd users

[Jaan]

Managed to have time to look at this again.

 

So we have our Google Admin panel syncing users to Adobe via SAML. Thats working fine and users are still being added/disabled even today.

 

I have 3 groups I created in Adobe. IT Admin, Students and Staff. Each of these user groups have products already assigned to them.

 

The issue i have is adding the users already in Adobe (From Google) into these User groups (Where they will get licences assigned to them). CSV isn't an option for us.

 

It seems we need BOTH Google SAML syncing users into Adobe for SSO. AND the AD SYNC TOOL to assign users into groups and then licences.

 

Here's the online documentation for that..........

 

https://adobe-apiplatform.github.io/user-sync.py/en/

 

My head is just mush lol I don't know why this has to be this complex. I've had to request support from adobe to see if they have had a look for me as i can't get it working......

 

i there was a tick box in the adobe panel to add SAML synced users to groups....... it would be sorted

[PrimaryNetMan]

As someone who has just finished setting up Google > Adobe via SAML I thought it was just me missing something regarding assigning licences (Spark) In my mind it kind of defeats the object of syncing users if I then have to manually assign products either individually or csv. Workspace is our source of truth for all our users both pupil & staff so just want away to assign spark to all users who have synced.

[Jaan]

As someone who has just finished setting up Google > Adobe via SAML I thought it was just me missing something regarding assigning licences (Spark) In my mind it kind of defeats the object of syncing users if I then have to manually assign products either individually or csv. Workspace is our source of truth for all our users both pupil & staff so just want away to assign spark to all users who have synced.

 

My thoughts exactly!