This blog post will deal with the Admin console profiles and group set up. I will try to explain how theses exactly work together and how you should actually set them up.
When you are managing a company with Adobe products, you used to have your management rights directly within your tool, be it Analytics, Audience, Target or Photoshop.
Now, Adobe has moved everything within the Experience Cloud. This move has been realized in order to help companies to better managed their products with Adobe. To be honest, I find it quite challenging to understand where to actually set what in order to access your product.
Lots of things have changed during this migration and the way that you were setting this directly in your tool won’t last very long now. I am still struggling with it after working for more than 6 months with the admin console, thus it means that I am probably not the only one having difficulties with that part.
What is the Admin Console ?
First thing first, what is the Admin Console. The admin console, is the the console that helps you manage your different adobe tools. If you are a super admin of Adobe products, you may have access to all of the products by directly going to https://adminconsole.adobe.com.
If you are only an administrator of one solution, you could have access to only that solution in the admin console.
It looks like this, when you have access to this (with multiple solutions):
I don’t have access to it ? what happened ?!
If you don’t have access to it, it means that you don’t possess the required rights. You should contact your administrator to get that access. It is something that has to be dealt by the company itself.
What can you do in the admin console ?
In the admin console, there are 3 different main actions that you can realize :
- Manage users
- Manage groups
- Manage Product profiles
Managing Users
On the admin console, you can add, modify or delete users for your organization. Once, you have created them, you can also assign them to user groups or product profile. The user groups will be part of Product profiles. That will give them access to specific product, with specific limitation set to this product profile.
When creating a user, you would need to have these information :
- first name (MANDATORY)
- last name (MANDATORY)
- email address (MANDATORY : Will be used as the key in all user-related operation)
- country (OPTIONAL : Country Code will be used)
You can use adobeID, which means a user that possess an adobe account, to create the account for this user in your organization.
The good thing is that it is gathering all of the enabled product within the adobe universe.
The less good thing is that you don’t host the user, so the company is not able to delete it. The company can only removed access to the organization for that user. Not delete his account.
The 2 other possible ways of creating an account are :
- Federated ID : based on your company user registry and authentication. You will need to setup a SSO service if you want to use that option.
- Entreprise ID : based on your company user registry, but this time, authentication is hosted by Adobe. (Recommended)
Video for full explanation on Enterprise and Federated ID : here
Managing User Groups
When you have created your user, you can then start to assign to user groups. As for Adobe Analytics before, user group is the level that do the connection between the user and the product he can access to.
There are different type of groups you can set up. In a way, you could create a group that gives access to all the products of your organization (This is not recommended).
At the bare minimum, we would recommend you to create 2 type of group :
Admin Groups :
These groups give access to a product for administration. It means that the group will contain users that has Administrator and User access. The and is very important here because a user with only administrator rights will not be able to access the tool. Admin rights enable you to manage the tool product profile and access but not to use it.
As most of the administrators of Adobe tools want to access them, I would recommend to set user and admin rights in the Admin Groups.
User Groups :
These users groups will be more numerous as they will probably have different level of access depending on your company structure.
The advice that I can give you is to try to be explicit on your group name. Having a sort of Naming convention can be very important.
Especially as when you work with API, you have no way to know which product profile is associated with a user group.
So be careful and try to stick to a naming convention.
There are some basic User Group that are pre-defined with the different Products. You can use them as models but I don’t feel these are really useful for the long run as you will modify them to your need over time.
Admin of User Groups
“What the hell is that ? You already told us about Admin groups! Is it sorcery ?!”
That is a bit a different, for each group that you are creating, there are the members of these groups, and the users that manage those members… so even an Admin groups needs admins for this group. They will be the admins of the admins 🙂
Managing Products (Product Profile)
This type of groups will be defining how the users will be able to access the tool. You can create as many as you want.
You can add users directly into these groups, and the same applies for the admin of these product profile. However, I would recommend you to set these product profile to specific groups and then manage the users by adding them to their respective user groups. Try to not add user directly to product profile
On the product profile, you will have very different possibilities depending the product you want to set up.
Work in progress…
As the new Experience Cloud setup is quite new by Adobe, it is not always providing the limitation or the set up you would like for your users.
I could not gives you all the details of all the products access possibilities, that would take too long, but sometimes, it is not enough.
For some products, additional setup have to be done directly in the product. Some may argue that it enables more detailed configuration. So you have a basic configuration on the Admin Console and more detailed ones within the product. My opinion is that it is really confusing and I hope Adobe will provide a single point of setup soon.
Especially that they are providing an API to manage the user within the Admin console.
Summary on the Admin Console
I hope you got a better understanding on how the different parts of the Admin Console work together. The users, the groups and the product profile are the pillars of the product administration in Adobe now.
Using the User Groups as the Pivot point for enabling users for multi solutions will make your work easier and enable better management.
However it is possible to manage users only with Product Profiles, as these product profile are groups for only one product.
It will generate users belonging to multiple groups fairly easy and the usage of the API even more important by choosing this path.
Example:
If we have only one solution, Adobe Analytics, you want, at least, 4 different product profiles:
- Basic Access
- Advanced Access
- Admin Access
- Developer Access
It won’t be long before you have users that belong to multiple groups, because of access rights that differ. It would be important to get a proper reporting on this. (This example is quite simple and doesn’t come with the problematic of splitting access to different reportSuites)
Normally this portal will get more and more important as it will be the single point of management in the future so start getting familiar with it.
if you want to have more in-depth knowledge about this, you can go to the official documentation : https://helpx.adobe.com/enterprise/using/admin-console.html