Applies to enterprise.
Connected Enterprise unifies user profiles and individual user folders within a Global Admin Console hierarchy, allowing users to work across Adobe products without switching profiles.
Overview
Connected Enterprise consolidates multiple organization-specific profiles into a single unified profile per user. Users move freely across organizations without switching profiles or reauthenticating, and can collaborate across Adobe products provisioned in multiple organizations. Each organization within a Connected Enterprise continues to own and govern its directories, products, storage, and policies, while users gain uninterrupted access to assets and workflows across the entire hierarchy.
A unified profile replaces all organization-specific profiles for a user in a Global Admin Console. It retains combined roles, group memberships, and entitlements across organizations and provides users with seamless access to Adobe products without switching profiles. The profile name is derived from the root organization's display name and includes a system-managed (unified) suffix that cannot be edited.
Prerequisites
Enterprise organizations must meet the following criteria to enable Connected Enterprise:
- All organizations are configured under a Global Admin Console hierarchy.
- The encryption key is not revoked.
Connected Enterprise is currently available to select enterprise customers; education organizations are not supported, and enablement is managed by Adobe. Contact your Adobe Account Manager to get started.
Before proceeding, review the Limitations, including unavailable admin flows and unsupported products.
Benefits
For end users
- One unified profile across all organizations instead of multiple profiles.
- Consistent access to products and assets across organizations.
- No profile picker or reauthentication required for consolidated users when moving across Adobe solutions.
- Smoother workflows across Adobe Express, GenStudio, Workfront, and other products.
For administrators
- Simplified user profile.
- Reduced overhead from fragmented identities and multiple individual folder management for each user.
- Organization structure can align with operating needs rather than contract boundaries.
- Pooled storage quota across the Global Admin Console hierarchy.
Consolidation models
Connected Enterprise supports three consolidation models. All models run in production and apply across all organizations in the Global Admin Console hierarchy.
Test mode is a mandatory first step before any consolidation. It allows you to validate Connected Enterprise behavior with a limited set of test users and supports rollback.
|
Test mode |
Incremental |
Full |
User scope |
Subset (test users only) |
Subset of users in the hierarchy |
All users in the hierarchy |
Account types consolidated |
Dummy accounts |
Real user accounts | |
New user behavior |
New users get a profile |
New users get a profile |
New users are automatically consolidated. No separate per-organization profiles are created. |
Max users |
99 |
No limit | |
Revert user consolidation |
Yes. Requires removing and re-adding users to orgs and reverting org settings like directory trust. |
Not allowed | |
Full consolidation cannot be reverted. To disable Connected Enterprise, consolidated users' accounts must be deleted from the directory.
Incremental consolidation
Incremental consolidation lets you consolidate a subset of users while others continue using separate profiles per organization. Use this model to pilot Connected Enterprise with selected users before expanding more broadly.
- Non-consolidated users, including newly added users, continue to receive and use separate profiles until they are consolidated.
- Users who are consolidated sign in directly to their unified profile.
Full consolidation
Full consolidation applies Connected Enterprise behavior to all eligible users across the Global Admin Console hierarchy.
- A unified profile is created or reused for each eligible user, and newly added users are consolidated by default.
- Users entitled to products that don't support consolidation are skipped and retain their existing separate profiles. Users who belong to organizations outside the Global Admin Console hierarchy retain their own profiles.
- Persistent state: Once Connected Enterprise is enabled, it cannot be reverted.
- All-org scope: Consolidation applies to every organization in the Global Admin Console hierarchy.
- Unavailable admin flows: The following actions are unavailable after enabling Connected Enterprise:
- Automatic product assignment
- Product request workflows
- Edit identity type
- Delete organizations
- Self-service org addition to the Global Admin Console hierarchy
- Org deletion from the hierarchy
- Global Admin Console org-mapping actions that affect hierarchy integrity
- Lightroom and Document Cloud assets: Users with Lightroom or Document Cloud assets across multiple profiles are skipped from consolidation.
- Group projection: Group projection may include consolidated users, but licenses for unsupported products are not provisioned for use.
Users entitled to an unsupported product are skipped during consolidation.
| Product group | Unsupported products |
|---|---|
| Document & Productivity | Adobe Sign |
| Customer Experience | AEM Foundation, AEM Assets, AEM Sites, AEM Forms, AEM Guides, Adobe Experience Platform, Adobe Experience Platform Unified Search, Adobe Experience Platform Real-Time CDP (includes Audience Manager), Adobe Journey Optimizer, Customer Journey Analytics, Content Analytics, Adobe Analytics, Commerce (App Builder for Adobe Commerce), Marketo Measure, Semrush |
| Creativity & Productivity | Extension Builder, Extension Manager, Unified Extension Platform, Web Extensibility Platform |
| Digital Media & Entertainment | Adobe Stock, Substance 3D Designer, Substance 3D Modeler, Substance 3D Painter, Substance 3D Sampler, Substance 3D Stager, Substance 3D Reviewer, Substance Assets Platform |
| Document & Digital Learning | Framemaker, Adobe Learning Manager, Captivate, ColdFusion, RoboHelp, Technical Communication Suite, Adobe Connect, Adobe Pass, Adobe Print, Digital Publishing Suite, Adobe Advertising, Adobe Designer, Adobe Presenter |
Impact
Visual indicators in the Admin Console help administrators identify organizations and users participating in Connected Enterprise.
Users consolidated into a unified profile are visually indicated in user lists, user groups, product profiles, and admin role assignments.
After consolidation, policies that were previously scoped to a single organization behave differently when users have a unified profile across the hierarchy.
Privacy and security
- 2FA verification and social login settings previously applied to organization-specific profiles that are deleted during consolidation are lost. If all organizations had the same settings before consolidation, there would be no impact. For Federated accounts, 2FA is typically managed at the identity provider.
- Max session idle time and max session life are governed by the identity-owning organization.
- Password policy is governed by the authentication-owning organization. The existing directory owner continues to own and manage authentication accounts in Connected Enterprise. This policy is applied at the account level and evaluated across all profiles, with the most restrictive policy being enforced.
- IP access restrictions are governed by the identity-owning organization. Organizations that don't own a user's directory cannot set IP access restrictions for that user. For external or invited users, the root organization governs IP access restrictions.
Asset settings
- Non-Adobe generative AI model settings are governed by the identity-owning organization. Users will lose access to third-party models if their entitlement-granting organization previously allowed use, or gain access if it previously blocked use.
- Content credentials are governed by the identity-owning organization. If content authenticity is disabled in the identity-owning organization, users can no longer add content credentials to new or existing assets. Previously applied content credentials are retained but remain invisible in apps and exports until re-enabled. Actions performed while content authenticity was disabled are not captured. If content authenticity was previously disabled but is enabled in the identity-owning organization, users can apply content credentials going forward.
- Sharing restrictions and authorized domains are governed by the storage-owning organization. During consolidation, each user’s individual folder is migrated to the Admin Console organization based on administrator inputs. After migration, the asset policies defined in the Admin Console are applied. Shared storage and its associated policies are not affected by this process.
GAC directory inheritance
- The "inherit users from directories managed by the parent organization" setting is no longer applicable after consolidation.
- This setting is permanently enabled and cannot be turned off in the GAC UI.
- Authentication settings: After consolidation, users sign in directly to their unified profile. Authentication enforcement is based on the identity-owning organization.
- The profile picker is removed for consolidated users. The profile picker appears only if the consolidated user has a profile outside the Global Admin Console hierarchy, or if the user could not be consolidated due to an unsupported product entitlement.
- Auto-account creation: A Federated ID account is created in the directory-owning organization. A business profile links to the authentication account.
- The unified profile retains the union of all roles and capabilities assigned across all prior profiles.
- Admin roles are preserved without consolidation or removal.
- Roles remain scoped to the organization where they originated.
- Administrators can view and manage roles only in organizations where they hold admin rights.
- If a user is entitled to at least one product that does not support consolidation, that user is skipped and continues with their existing profile behavior.
- Directories remain with their original owning organization.
- An implicit, read-only trust is automatically established across directories in all organizations in the Global Admin Console hierarchy. This allows users from one organization to be recognized in another without manual directory trust configuration. It does not grant write access. Creating new users in a directory still requires explicit trust with the directory owner.
- Trust relationships appear in the directory settings for both the owning and trustee organizations.
- Trustee organizations can add existing directory users as members.
- Creating new users in a directory still requires explicit trust with the directory owner.
- Trusts created by Connected Enterprise are locked and cannot be revoked manually.
- Existing external explicit trusts continue to function with their existing read and write permissions.
- Individual user folders: During consolidation, the admin can choose the destination Admin Console organization to consolidate the user's individual user folder. After consolidation, each user will have a single Individual user folder, making it easier to manage and organize content efficiently.
After consolidation, the storage policy from the Admin Console that manages the Individual User Folder will be applied automatically. Before starting consolidation, review and update the storage policy to ensure it aligns with your organization’s storage and business requirements. - Shared storage: Shared storage isn't consolidated. There are no changes to how admins manage shared storage.
- Storage quota: Storage quota is pooled at the root level of the Global Admin Console. Individual organizations operate under soft quotas. Administrators can view per-user storage usage consolidated across organizations and identify top storage consumers across the hierarchy.
- User removal and asset reassignment: Each user’s individual folder is managed by a single organization in the hierarchy. Asset reclamation can only be initiated from this organization. To reclaim assets, remove the user from all organizations, including the one that manages the user’s individual folder. Removing the user from other organizations does not trigger reclamation. Assets remain in the user’s folder until reclamation is initiated from the managing organization.
- Authorized domains: Domain restrictions are enforced by the organization that owns the storage where the asset resides.
- Project creation: After consolidation, users select the organization in which the project is created. Organizations where project creation is disabled can't be selected. The default organization is based on the app's product entitlement that starts project creation. For GenStudio and Content Supply Chain, projects are always created in the organization linked to the product instance.
- Content credentials: Enforced based on the organization's policy that owns the storage.
- Sharing options are enforced by the organization that owns the storage.
- If a user's individual user folder moves to an organization with more restrictive sharing settings, access to previously shared assets may be reduced.
- Shared storage continues to support organization-level sharing.
- Assets shared with everyone at org before consolidation will remain accessible post-consolidation, subject to storage policy.
- Post-consolidation, users can continue to share assets with everyone at the org for the org where the asset resides.
- Post-consolidation, users get autocomplete suggestions for users and groups across the Enterprise Mesh, simplifying the sharing experience.
- Existing sync integrations remain intact, including User Sync Tool (UST), UMAPI, Azure AD Sync, and Google Workspace Sync.
- Sync isn't paused during Connected Enterprise setup. Errors may occur if sync runs during consolidation. Monitor sync logs and take corrective action if needed.
After consolidation, changes to how enterprise user profiles are represented can affect add-ons built for Adobe Express and plugins built for Creative Cloud desktop applications, including UXP plugins and CEP extensions. Most users experience no disruption.
For enterprise users
- Some add-ons or desktop plugins may not work as expected. Reinstall the add-on or plugin. If the issue persists, contact the add-on or plugin developer. Learn more about Express add-ons.
- Previously installed desktop plugins may no longer appear as installed in the Creative Cloud Desktop Marketplace. Reinstall or reacquire the plugin from the Marketplace. Learn more about installing plugins using Creative Cloud Desktop.
- Paid add-ons or plugins may not recognize an existing license. Reinstall the add-on or plugin and contact the plugin developer before purchasing again.
For enterprise developers
- Add-ons or plugins that rely on User ID APIs may not recognize consolidated enterprise users. Review any use of User ID APIs for analytics, licensing, entitlements, payment tracking, subscription management, or account linking.
- Developer workflows such as organization selection during publishing, org-switcher behavior, and access across multiple organizations may change. When creating, managing, or publishing add-ons and plugins, verify the selected organization context.
The Global Admin Console displays a Connected Enterprise indicator when an organization is part of a Connected Enterprise.
- Self-service org addition to the hierarchy and org deletion from the hierarchy are unavailable once Connected Enterprise is enabled.
- Group projection may include consolidated users, but unsupported products are not provisioned.
- Global Admin Console org‑mapping actions affecting hierarchy integrity are unavailable.
End-user experience
End users will be signed out while consolidation is in progress, and active sessions may be interrupted. Sign-in access is restored once the user's consolidation is complete.
The first time users sign in after consolidation, they see a notification confirming that their profiles have been unified into a single Adobe profile, along with the unified profile name. Users can select Continue to proceed.
After consolidation, the system defaults to the unified profile associated with the organization that owns the user account. Users can see all active entitlements across the Global Admin Console hierarchy in one place, without having to select a profile.
The profile picker appears only if:
- The user has a profile in an organization outside the Global Admin Console hierarchy, or
- The user could not be consolidated because they have at least one product that does not support consolidation.
Consumables behavior
- Generative credits: Individual generative credits are pooled across organizations after consolidation. For example, 1,000 credits from Org A and 1,000 from Org B add up to 2,000 total. If a user exhausts their individual credits, usage draws from the Operations pool tied to that entitlement.
- Shared Credits: These are not merged. Credits are deducted from the organization associated with the entitlement being used. Operations cannot be drawn across organizations.
- Firefly custom models: Each organization retains its own quota for custom models. Custom models remain in the organization's shared storage where they were created. Firefly and other supported surfaces list models from all consolidated organizations together. No profile selection is required to access models.
Audit log
Audit log events are generated for the following actions and are logged in both the source and target organizations:
- Asset transfers
- Administrative consolidation actions
- Incremental and full consolidation
- Individual user folder destination selection
