adobe-enterprise-rbac

# Adobe Enterprise RBAC ## Overview Configure enterprise-grade access control for Adobe integrations using Admin Console product profiles, User Management API (UMAPI) for programmatic user provisioning, and SCIM-based identity sync with Azure AD or Google Workspace. ## Prerequisites - Adobe Enterprise or Teams subscription - Adobe Admin Console system administrator access - Identity Provider (Azure AD, Google Workspace, or Okta) for SSO - Understanding of SCIM 2.0 protocol ## Instructions ### Step 1: Set Up Federated Identity in Admin Console 1. Go to https://adminconsole.adobe.com > Settings > Identity 2. Create a Federated ID directory 3. Configure SSO: - **Azure AD**: Admin Console > Add Azure Sync > Follow SCIM setup - **Google Workspace**: Admin Console > Add Google Sync > SCIM provisioning - **Generic SAML**: Upload IdP metadata XML ```yaml # SAML Configuration Values (for your IdP) Adobe SP Entity ID: https://federatedid-na1.services.adobe.com/federated/saml/metadata ACS URL: https://federatedid-na1.services.adobe.com/federated/saml/SSO Name ID Format: urn:oasis:names:tc:SAML:2.0:nameid-format:emailAddress ``` ### Step 2: Define Product Profiles (Adobe's RBAC Mechanism) Product Profiles in Admin Console are Adobe's native RBAC system. Create profiles that map to your application roles: | Profile Name | Adobe APIs Granted | Application Role | |-------------|-------------------|------------------| | `API-Developers` | Firefly, PDF Services, Photoshop ...