Adobe SSO: Sign In to Adobe Through SSOGEN

Adobe SSO with SSOGEN starts with one question: which Adobe product? Creative Cloud and Experience Cloud sign in through a Federated ID directory in the Adobe Admin Console. Acrobat Sign has SAML settings of its own.

Plan a trial

Adobe SSO with SSOGEN signs people in to Adobe products with their SSOGEN account, under your sign-in policy and with a second factor where you require one. Adobe is the SAML 2.0 service provider and SSOGEN is the identity provider.

The SSOGEN App gallery has three Adobe cards, one per product family, and each card links to Adobe’s own guide.

Which Adobe product are you connecting?

SSOGEN App gallery card	Where Adobe takes the SSO settings	Who signs in
Adobe Creative Cloud	Adobe Admin Console: Settings, Identity, Directories	People with a Federated ID in a claimed domain
Adobe Experience Cloud	The same Admin Console directory	The same Federated ID users
Adobe Acrobat Sign	Acrobat Sign SAML settings	Users of the Acrobat Sign account

The Creative Cloud and Experience Cloud cards link to the same Adobe guide, the Admin Console directory setup. Both cards list SAML and OpenID Connect; this guide uses SAML, the route Adobe’s Other SAML Providers option takes.

Before you start: Federated ID and the domain

Adobe has three identity types. Only Federated ID supports SSO with Adobe products: authentication runs through your identity provider, and passwords cannot be reset in the Admin Console. Enterprise ID accounts are owned by the company but authenticated by Adobe. Adobe ID accounts belong to the user.

Two rules decide the plan:

One type per domain. Enterprise ID and Federated ID are exclusive at the domain level. A domain on Enterprise ID can be switched to Federated ID.
Every user in a claimed domain. Adobe signs in Federated ID users only from domains your organization has claimed and verified.

Connect the Admin Console directory

Create the directory. In the Admin Console open Settings, Identity, Directories. Create a directory, choose Federated ID, then Other SAML Providers.
Claim and verify the domain. Add acme.example to the directory and complete Adobe’s domain verification.
Copy Adobe’s values into SSOGEN. Download Adobe’s metadata file, or copy the ACS URL and Entity ID. In SSOGEN, select the Adobe Creative Cloud card and use them in the Connection step.
Give Adobe SSOGEN’s metadata. On the application’s Integration tab, open the IdP metadata address and save the XML. Upload it on Adobe’s identity provider screen.
Map attributes in Adobe. Choose a default country in Attribute mappings. Adobe can also update user details at each sign-in.
Test, then activate. Assign one person in SSOGEN, run Test, check the four values below, and select Activate application.

Adobe turns on automatic account creation by default: a person from a verified domain who has no Federated ID yet gets one at first sign-in. The SSOGEN Assignments tab decides who receives an assertion, so it also decides who can get an Adobe account.

The four values Adobe checks in every assertion

Adobe expects Email, FirstName and LastName as attributes, with exactly this capitalization, and a Name ID equal to the email address.

Adobe expects	Set in SSOGEN, Identity sent to app
Name ID equal to the email	Identify the person by: `email — mail address`
`Email`	Add an attribute named `Email`, value `email`
`FirstName`	Add an attribute named `FirstName`, value `given_name`
`LastName`	Add an attribute named `LastName`, value `family_name`

Adobe answers a mismatch with “Access Denied”. The cause is usually a first name, last name or email that differs from the Admin Console record. The SSOGEN Test card lists the exact values for a named person, so compare them with the Admin Console before anyone signs in.

Connect the signing account

Acrobat Sign has its own SAML mode, with three settings:

Mode	Effect
SAML Disabled	Native Acrobat Sign sign-in only
SAML Allowed	SSOGEN or the Acrobat Sign password. Adobe recommends it during setup.
SAML Mandatory	SSOGEN only, with an option that lets admins keep native sign-in

In SSOGEN, select the Adobe Acrobat Sign card. Enter Acrobat Sign’s Entity ID/SAML Audience and Assertion Consumer URL in the Connection step. In Acrobat Sign, enter SSOGEN’s IdP entity ID as Entity ID/Issuer URL, the Single sign-on URL as Login URL/SSO Endpoint, and the signing certificate. Start in SAML Allowed, test, then move to SAML Mandatory.

Questions people ask

How do I set up Adobe SSO with SSOGEN?

Create a Federated ID directory with Other SAML Providers in the Adobe Admin Console, exchange metadata with SSOGEN, claim and verify your domain, send Email, FirstName and LastName with the email as Name ID, test the assertion in SSOGEN, then activate.

Do I need Federated ID for Adobe SSO?

Yes. Federated ID is the only Adobe identity type that supports SSO. Users with Enterprise ID authenticate with Adobe, and a domain cannot hold both types. A domain on Enterprise ID can move to Federated ID.

Why does Adobe show Access Denied after SSOGEN signs me in?

The assertion does not match the Admin Console record. Check that the Name ID equals the Email attribute and that the first name, last name and email match Adobe’s user. The SSOGEN Test card shows what was sent.

Does Acrobat Sign use the same directory?

Acrobat Sign has its own SAML settings with three modes. Register it in SSOGEN with the Adobe Acrobat Sign card and the values Acrobat Sign shows, separate from the Creative Cloud application.

Where to go next

Hub. The SSO applications hub has the protocol comparison and the other guides.
The SSOGEN screens. Register a SAML application and Assign people, set the sign-in policy, test and activate describe each step.
Electronic signatures elsewhere. Docusign SSO covers the other common signing service.

Sources, all read 2026-11-15 (Adobe Help Center):