Navigate to the Products tab in the Adobe Admin Console.
In addition to the licenses purchased for Creative Cloud, the Products page shows an offer for Adobe Express for K12. Select Getting Started.
Last updated on
10 May 2024
This step-by-step guide shows IT administrators and other staff at K12 schools and districts how to deploy named-user licenses of Adobe Express for Education, Creative Cloud All Apps, and other Adobe apps to students and teachers.
Adobe offers the world’s best creative tools for K12 (primary and secondary) teachers and students, from industry-standard Creative Cloud applications to the new free Adobe Express offering.
Adobe Express for Education is designed for teachers and students to use across grade levels and content areas. Previously known as Adobe Spark for Education, Adobe Express for Education is free for K12 users and offers a rich set of web and mobile solutions designed to unlock student creativity and communication skills. It adds Adobe Photoshop Express and Adobe Premiere Rush to the existing Adobe Spark Video and Adobe Spark Page apps with premium features, and it also offers content guardrails and privacy protections made just for schools.
For more information about the Adobe Express offering, see the Frequently Asked Questions.
Note:
Adobe Express for Education is only free as a stand-alone offer for K12 institutions and includes 2GB of cloud storage per license. Higher education customers can access Adobe Express by making a Creative Cloud All Apps purchase. Learn more.
1. Getting Started
IT admins use the Admin Console to assign and provision Adobe product licenses to students and teachers. If your school or district has already purchased Creative Cloud licenses, you have an Admin Console. If you aren't yet an Adobe customer and would like to provide free Adobe Express licenses to your students and teachers, you can request an Admin Console by calling +1-800-685-3638 or by contacting your preferred district reseller partner. The person calling to request an Admin Console will be the first system administrator for that new org in the Adobe Admin Console.
Once you have an Admin Console, you’ll be able to access Adobe Express for Education edition on the Products page. Follow the steps below to get access for your students and teachers:
Note:
Adobe Express for K12 and Shared Device Access for HED offers are essentially equivalent, except the latter doesn’t include the Adobe Express entitlement. If you've both, Adobe recommends that you acquire Adobe Express for K12 instead of Shared Device Access.
-
-
On the Confirm Type of Organization screen, select the category that best fits your organization.
-
If you select K12, Primary & Secondary Education, agree to the terms and conditions.
Note:Only local education agencies (LEAs) qualify for the free Adobe Express offer. Review your organization’s eligibility.
-
Click Confirm and Continue.
The Products page shows the card for Adobe Express for K12. You can now start deploying it to your users.
-
Identify the domain administrator in your school/district.
Your school or district owns the named-user Adobe Express or Creative Cloud All Apps licenses given to your K12 students, so these licenses must be deployed using Enterprise or Federated IDs. As part of the setup, you must prove that you own the domain by updating the DNS records. If you don’t have access, be sure to let the domain admins know to make that update for you.
-
Plan the identity system for your organization. Use the following guide to decide if you want to set up Enterprise ID or Federated ID:
Enterprise ID
Your organization owns and manages the Enterprise IDs. End users sign in using the passwords they specify to sign in.
Federated ID
Federated IDs allow users to sign in using your organization's Single-Sign On (SSO). End users sign in using the same user name and password that they use for signing in to all other apps and services. For example, Google or Active Directory File System (ADFS).
Note:Adobe ID is not supported for K12 (primary and secondary). This helps protect minors’ data by ensuring that schools and districts are the data owners and Adobe is only the data processor.
-
If you want to set up single sign-on (SSO), identify the administrator for the school-provided IDs (login credentials).
If students have Google Workspace for Education IDs and you want them to use these IDs to sign in to Adobe apps, use Federated IDs and set up SSO. If you don’t want to set up SSO, use Enterprise IDs. With Enterprise IDs, your students will need to set an Adobe password.
The Adobe Admin Console allows a cloud-to-cloud integration with Google Federation ID and Azure Active Directory to turn the following into a simple authentication workflow:
- Domain claiming
- SSO setup
- Automated User Management
With Azure AD, you can even sync user groups.
Once you’re prepared to deploy Adobe Express for Education, you can set up your identity system to manage your users and configure SSO (if desired).
Approve Adobe apps within the Google Admin Console for users under 18. Learn more.
2. Set up Identity
-
Sign in to the Admin Console, navigate to Settings > Identity, and click Create Directory.
-
Enter a name for the directory and choose an identity type.
Choose Enterprise ID and click Create Directory, or choose Federated ID and click Next.
-
(Federated ID only)
On Who is your identity provider screen, do one of the following:
- Select Microsoft Azure Active Directory, click Next, and proceed with creating a directory as described in Set up Azure AD Connector.
- Select Google, click Next, and proceed with creating a directory as described in Set up Google federation.
- Select Other SAML Providers, click Create, and Configure Single-Sign On.
To use Federated ID authentication, you must have a SAML2-compatible Identity Provider.
- Select Microsoft Azure Active Directory, click Next, and proceed with creating a directory as described in Set up Azure AD Connector.
3. Test your setup
To test your setup, you can add a user, and sign in using the new user account. You can choose an existing email address that you have access to or create one for this test.
To add a user, do the following:
-
In the Admin Console, navigate to Users > Users, and click Add User.
-
Enter the email address of the user. The recommended ID Type is populated automatically.
Caution:Use an email address that belongs to one of the claimed domains. Do not change the ID Type to Adobe ID.
-
Enter the First Name and Last Name of the user.
For an Enterprise ID, select the Country of the user. For a Federated ID, enter an SSO Username and select the Country of the user.
Caution:First Name and Last Name are mandatory, even though erroneously indicated as optional.
-
Select the products or user groups to assign to the user. The list of products that displays, is based on the purchase plan of your organization.
Learn more on how to manage products and product profiles.
Once you've successfully created the user and assigned a product, you receive an email on the associated email account. Follow the instructions in the email.
To sign in as the user that you set up, open the Adobe Express website, and click Sign In > Log In With School Account. Then, sign in using your email address and password.
Note:
If the email address has both, a personal Adobe ID (created by the end user) and a school ID (Enterprise ID or Federated ID created in the Adobe Admin Console), you see the account chooser screen. To sign in with your new enterprise account, choose Enterprise ID.
If you are using Federated IDs, you are redirected to the sign-in screen of your IdP (For example, Google). Enter the email address for the user, click Next, and follow the instructions on the screen.
For SSO login to Adobe Express for your school or enterprise users, use this URL format
https://new.express.adobe.com/a/example.org
Replace example.org with a domain claimed in your Admin Console federated directory.
If you have multiple domains registered in your federated directory, you can use any one of the domains. If you have multiple directories, you must create a link for each directory using one of the domains owned by that directory.
This URL will trigger an SSO login to your authentication provider once authenticated directly into Adobe Express
format
https://new.express.adobe.com/a/example.org
This can be added to a portal, app launch pad, or shared users.
Google Workspace Admins Only
Pin Adobe Express SSO Launch URL to the taskbar of a Chromebook
In the Google Admin Console > Apps & Extensions https://admin.google.com/ac/chrome/apps/user, add the following as a URL:
https://new.express.adobe.com/chrome-tab/a/example.org
To pin to the taskbar, select Force install + Pin to ChromeOS taskbar.
Replace example.org with a domain claimed in your Admin Console federated directory.
If you have multiple domains registered in your federated directory, you can use any one of the domains. If you have multiple directories, you must create a link for each directory using one of the domains owned by that directory.
Prerequisites
- A configured and federated directory in the Adobe Admin Console
- Adobe Express or Creative Cloud license assigned to users
Learn more
4. Manage Users
Product Profiles let you enable all or a subset of Adobe services available in the plan you have purchased from Adobe. They let you customize settings associated with a given product and plan.
For a user to be entitled to use a product or a service, the user must be part of a Product Profile. You can assign licenses to a Product Profile by associating it with a plan that you have purchased. A user could belong to multiple product profiles, each conferring different licenses. The product profiles assigned to a specific user and the specific licenses conferred in each profile determine which Adobe products a given user is able to access. To learn more, see Manage product profiles.
-
In the Admin Console, navigate to Products.
A list is displayed of all Adobe product plans for which you are an administrator.
-
Select the desired product plan, and click New Profile.
The Create a New Profile wizard displays.
-
Enter a profile name, display name, and description.
To automatically notify users by email when they are added or removed from this profile, enable the Notification toggle, and click Next.
-
On the Services screen, you can choose to enable or disable individual services for the product profile.
-
Click Save to save the new profile.
Adobe recommends creating user groups to provide access to products and services. You can either create one group and add all users to it, or create separate groups for departments, programs, or roles like a student, teacher, staff.
Creating multiple user groups is useful if:
- You are planning to give different products to certain groups of users. For example, Creative Cloud- All Apps to high school students, and Adobe Express to all students.
- You want to give limited administrative rights. For example, the department head can add or remove users from their department so that central IT does not have to.
To create a user group, do the following:
-
In the Admin Console, navigate to Users > User Groups, and click New User Group.
-
Enter a name and description for the user group and click Save.
The description does not play any role in the setup and is for information purposes only.
-
Also, you can add an admin specific to a user group, called the User Group Administrator. To do so, click the group name. Navigate to Admins, and click Add Admin.
-
Enter the email address for the admin. You can search for existing users or add new users by specifying a valid email address and filling in the information on the screen.
Then, click Save.
-
To manage the entitlements given to users, assign product profiles to the user group. Click the group name, navigate to Assigned Product Profiles, and click Assign Product Profile.
-
Add the desired Product Profiles to the user group, and click Save.
The user group is now ready, you can now start adding users to the group.
When you assign an admin role or a Product Profile to users, they receive an email notification. Users must follow the link to complete their profile, if prompted.
To add multiple users to your organization and assign them to product profiles, you can upload a comma-separated value (CSV) file listing the details of all the users. You can import up to 5,000 users at a time with CSV.
If you want to automate the user management process, you can use the User Sync tool. This method requires additional software to be installed in your network to synchronize users between your Directory and Adobe. However, for large districts with sufficient IT resources, Adobe recommends using the User Sync tool. To learn more, see Set up the User Sync tool or enroll in our Self-paced User Automation course using a free Adobe Captivate Prime account.
To add multiple users in bulk via the Admin Console, do the following:
-
In the Admin Console, navigate to Users and click Add Users by CSV.
-
In the Add Users by CSV dialog box, click Download CSV Template, and choose Standard template.
-
Open the downloaded CSV template in a spreadsheet editor like Microsoft Excel, and paste your users into the template like the screenshot below.
For a description of the fields in the downloaded file, see CSV File format.
For Enterprise IDs and Federated IDs, columns A to G are mandatory.
If you are using user groups to manage access to products, assign users to the appropriate groups using columns K and L. In this case, you can leave the other cells empty.
Note:This feature does not support user names having special characters, such as the comma (,) and the semicolon (;).
-
Drag the updated CSV on to the Add Users by CSV dialog box and click Upload.
Note:You can upload a CSV file size of up to 10 MB.
For more information on bulk operations, see Manage Users and Bulk Operations.
After you have successfully assigned product profiles or administrative rights to the users, they receive a welcome email.
The users can click Get Started in the email, sign in, and start using the allocated services.
To sign in to Adobe Express with a Google Federated ID account, they can open Adobe Express and click Sign In > Continue With Google. Then, they can sign in using their email address and password.
Note:
If your primary identity provider in Admin Console is not Google SAML and you want teachers and students to be able to sign into their school account when they click Continue with Google on the Adobe Express page, you must add Google OIDC as an additional Education SSO provider.
If the users do not have Google accounts, follow the steps described in Sign in as the new user.
- After deploying Adobe Express, Creative Cloud Named User Licenses, or Shared Device Licenses in your district, check out our full page of shareable assets and choose the ones that work for your target audiences. The page includes one-pagers for parents and teachers, as well as getting started/sign-in guides for anyone in your district who is entitled to use the products.
- For more information on Adobe Express for Education, see Adobe Express tutorials and resources and frequently asked questions.
Get help with next steps and troubleshooting
If any issues arise, check the admin guide and search for articles on Enterprise Learn & Support page to find solutions.
If you run into errors with SSO, see Troubleshooting errors. And, for SSO issues related to your IdP, reach out to your identity provider’s support center.
If you run into issues related to bulk upload, see Troubleshoot bulk upload.
When contacting Adobe Customer Care to report a suspected SSO issue, provide the following to ensure fast and effective service:
- Number of affected user accounts
- Adobe domain name
- Affected login and email name (must be identical)
- The user’s full contact details
- Date and time or range of time when the issue occurred
- Screenshots or video of the user experience workflow — show a signed-out user state and then an attempt to sign in via www.adobe.com
- A SAML trace output captured during the demonstration workflow. SAML trace requires no special skills or permission to use — you don’t need to be an admin — and it’s available on many browsers, such as Firefox and Chrome.
Here’s how to use the SAML trace add-on:
-
Install SAML trace add-on in the user's browser.
-
Ensure that the user is signed out of Adobe account.
-
Locate and click the SAML Trace window from the SAML icon in the toolbar.
A separate window displays. Move it out of the way and leave it open.
-
Navigate to www.adobe.com, and click Sign In and proceed as far as possible through login.
-
When the issue occurs, navigate to the SAML trace window as shown in the screenshot below.
Locate and click the POST line in Orange with SAML tag that ends in ‘accauthlinktest’.
-
Click SAML (next to HTML and Parameters).
-
Copy all contents to text file and include with new support case.
-
To perform SSO triage, locate the 4 mandatory SAML 2.0 assertions:
- NameID
- FirstName
- LastName
- Case must exactly match that shown in the list above.
- Check the values next to each and validate that each is populated.
- Check to be sure that Email matches NameID.
- Check to be sure that Email and NameID formats are both correct and complete.
A mismatch between the network user account and the Adobe user account name causes SSO to fail.
When problems arise, another good place to check is the Admin Console under Settings > Identity > <click domain> > Event Logs. These logs are provided from the SP (Okta) syslog. It can take a few minutes for the log to update.
