Roles
Last updated on
Apr 13, 2026
Applies to enterprise.
Learn how user roles work in the Admin Console and how system and product admins can assign and manage them to support secure and appropriate access.
As a system admin, go to Users > Roles to assign roles. For easier management, assign roles to user groups instead of individual users.
User roles define what users and user groups can access and do in their assigned Adobe apps. System and product admins can assign roles to control access to features and workflows based on a user’s responsibilities. User roles help you to:
- Grant the right level of access without over-permissioning
- Delegate tasks safely without sharing full admin rights
- Simplify user management through role-based user groups
The Admin Console allows setting the right level of access across the organization through two types of user roles.
- Predefined roles: Built-in roles that address common access needs. Most roles are fixed, while some allow specific permissions to be turned on or off. Use predefined roles to quickly assign standard access. For example, admins can provide baseline access with the Member role or allow access to Firefly or partner models with the Firefly and Partner model user roles. Learn more about predefined roles and how to manage their permissions.
- Custom roles: Roles created by System Admins to meet specific access requirements. Admins select the exact capabilities each role includes. Use custom roles when teams need more granular control than predefined roles provide.
For example, admins can grant access to specific partner models instead of all models, limit access to selected Adobe Express capabilities, or assign access to specific Adobe Express add-ons rather than the full add-on collection. Learn more about custom roles.
Predefined roles help you apply consistent, built‑in access levels across users and groups. The set of roles shown in the Admin Console depends on whether you have an enterprise organization or an education institution.
Note
You’ll only see roles that are available to your organization.
Organization-wide role
|
|
Capabilities |
|
Member (default for everyone) |
Defines organization-wide permissions and is assigned to all users by default. Assign additional roles to grant extra capabilities. |
Adobe Express roles
|
Roles |
Capabilities |
|
Adobe Express add-on user |
Allows assignees to access all Adobe Express add-ons. |
|
Adobe Express application manager |
Allows assignees to customize the Adobe Express user interface for all members of your organization. |
|
Adobe Express template manager |
Allows assignees to create and edit templates for your organization and to override template lock restrictions. |
|
Adobe Express social publishing manager |
Allows publishing and scheduling content from Adobe Express to social media (Facebook, Instagram, TikTok, LinkedIn, Pinterest, and X). |
Adobe Firefly roles
|
Roles |
Capabilities |
|
Firefly user |
Allows access to commercially safe Adobe Firefly generative AI models. |
|
Partner model user |
Allows access to all partner generative AI models. |
|
Roles |
Capabilities |
|
Member (default for everyone) |
Defines organization-wide permissions and is assigned to all users by default. Additional roles grant extra capabilities. |
|
Educator |
Allows assigees to manage Classrooms and student work in Adobe Express for education, view the Adobe Express add-on marketplace, and access all Adobe Express add-ons. |
|
Student |
Allows assignees to participate in classroom workflows in Adobe Express with the same permissions as the Member role, and can be assigned only through roster sync. |
|
Adobe Express add-ons for K-12 |
Allows assignees to access the Adobe Express K-12 add-on collection. Available only for organizations created before April 2026. |
System admins can manage and assign all roles and capabilities across the organization, while product admins can manage and assign roles and capabilities specific to product-level roles. Users can be assigned multiple roles, and their permissions are combined across all assigned roles.
Tip: Creating role-based user groups
Before assigning roles, plan your user management strategy and create or update users and user groups accordingly. Roles can only be assigned to existing users or groups, so ensure they’re set up first using your preferred user management strategy.
For example, if you want to assign the Adobe Express Template Manager role to users A, B, and C, create a user group with those users to simplify the assignment.
Go to the Adobe Admin Console Users section using your system admin credentials.
Select Roles.
Use the Roles page to view and filter roles by type to audit specific role categories.
Select the Assign users icon next to the role.
Note
System Admins with access to Adobe Express automatically have access to all Adobe Express add-ons, regardless of any specific role or group settings.
Use the Add users to this role screen to add existing users or user groups.
Note
Admins in K-12 institutions can assign the Adobe Express add-ons for K-12 role to everyone in the organization by entering everyone in the Add users to this role screen.
Select Save.
You can review your users and their assigned roles in the Roles or Product Profile section of the Admin Console.
You can update or remove a user’s role assignments at any time.
In the Adobe Admin Console, go to Users > Roles.
Select the role you want to update.
Select the checkbox next to the users or user groups you want to remove and select Remove users.
In the confirmation dialog, select Remove users again to finalize the change.
The selected users or groups are unassigned from the role, and the changes are recorded in the audit log.
Note
Users don't receive email notifications when roles are updated. You must communicate any role changes directly.
Some predefined roles expose permissions you can toggle on or off. For example, Member and Educator.
In the Adobe Admin Console, go to Users > Roles.
Select the Quick view icon for the relevant role, then choose Edit.
In Permissions, turn the required toggles on or off.
Note
- You only see permission sets and permissions that are available to your organization.
- To grant access to Partner models, you must also grant Firefly access.
Select Save.
Changes apply immediately to all users and groups assigned to this role and are recorded in the audit log.
Yes, users or user groups can be assigned multiple roles. Permissions on roles are additive, so users will have access if they inherit the same roles from one or more user groups.
User groups can have one or more roles assigned to them. Assign roles and products to user groups so that all users within the group have similar access.
Yes, Adobe Express roles are optional and provide additional access when assigned.
The member role settings apply to everyone in your organization. When you want more control over specific features, you can turn off the setting on the member role and use the predefined roles, such as Adobe Express template manager or Adobe Express social publishing manager, to provide access to these specific workflows.
Product roles are removed when the product license is removed, and users can no longer exercise the role capabilities. However, user roles such as Educator are not associated with any product and remain assigned to the users regardless of their license.
No. Partner generative AI models require Firefly access.
If Firefly access is turned off for your organization, partner model access is automatically unavailable. To enable partner models, Firefly access must be turned on first.
More like this
Join the conversation
Use our Enterprise and Teams Community to ask questions, collaborate with other admins, and stay informed about new features.
