Migration to the Adobe Business Platform - the new Adobe Identity and Admin Console

Hi @soniaespejo,

Thanks for posting this and providing those links.

Having been involved with a few Workfront customers who've already moved, "been" moved, or are trying to prepare to move (respectively):

• Who decides (Adobe vs the customer's SysAdmin) when a the customer's Workfront Adobe domain will be migrated?
• Who initiates (Adobe vs the customer) contact between the customer and Adobe's support team (to then "walk you through all the necessary steps to set you up for success")?
• Does Adobe have a proposed (or required) schedule of "which domains move when"?
• Does Adobe have desired (or required) deadline by which all domains must be migrated?

Regards,

Doug

Hi @soniaespejo,

As I understand from @jon_chen that you are currently preparing a response, I invite you to also review this related thread which @whituser and I have been discussing so you can then provide Adobe’s best practice(s) to control or avoid the default automatic emails that invite users to log in to yourdomain.preview and/or yourdomain.sb01 (etc) from being sent, since they can cause confusion (as I described in my Cautionary Tale).

Regards,

Doug

Hi @soniaespejo,

A few hours ago, I (and I presume my Workfront customer’s fellow SysAdmins) received an email from Adobe Workfront Support informing me that Adobe was initiating the Adobe Admin Console for the domain, to be in place no later than Jan 22, 2024. Would you kindly clarify:

- will such an email be sent to every Adobe Workfront SysAdmin in each Workfront instance that is not yet migrated to the Adobe Admin Console?

- will the January 22, 2024 pertain to all such instances (vs other sets of instances with different dates)?

- although the email specified that Adobe Workfront Administrators (ie SysAdmins) are to be migrated by the date mentioned, since some of the links also cited also refer to Adobe Workfront Users, whether the date mentioned also pertains to the latter (and if so, whether the Cautionary Tale to which I inquired above might then come into play)?

Regards,

Doug

Hi @doug_den_hoed__atappstore , the team will reach out via email with more info and to answer your previous answer. I will add the "cautionary tale" here as a comment later this week for future reference.

Thanks for all your comments! 

My pleasure @soniaespejo,

As the large majority of our mutual Adobe Workftont / AtAppStore customers have yet to migrate to the Adobe Admin Console, I’ve been directing them to your post (and my questions, and at your earliest convenience, your answers) to educate and encourage them.

As (technically) this is a blog post, @jon_chen, if you have the means to raise its visibility among the wider Workftont visitors, please do so.

Regards,

Doug

Hi @doug_den_hoed__atappstore ,

Please see the answers to your questions below:

• Who decides (Adobe vs the customer's SysAdmin) when a the customer's Workfront Adobe domain will be migrated?
  • Adobe will reach out to SysAdmins to initiate the migration but customers are welcome to reach out to support proactively. We are flexible when it comes to changing the initial migration date.
• Who initiates (Adobe vs the customer) contact between the customer and Adobe's support team (to then "walk you through all the necessary steps to set you up for success")?
  • Adobe initiates the conversation via email and/or support case depending on the type of customer
• Does Adobe have a proposed (or required) schedule of "which domains move when"?
  • Nothing official that we can share, but we are shooting for 60% by Q2. We are currently at 30%
• Does Adobe have desired (or required) deadline by which all domains must be migrated?
  • Nothing official as stated above, but our desired goal is to have 100% migrated by end of year 2024
  • Note - We have 6 different migration cohorts and each one is handled slightly differently. We will always notify all system admins of a migration. If anyone has questions and isn't assigned a specialist, they can and should submit a case to customer support to get assigned to one.
• Will such an email be sent to every Adobe Workfront SysAdmin in each Workfront instance that is not yet migrated to the Adobe Admin Console?
  • Yes, although the email changes slightly based on the cohort because different types instances must take different actions (i.e. SSO vs non-SSO accounts)
• Will the January 22, 2024 pertain to all such instances (vs other sets of instances with different dates)?
  • For accounts/domains we contacted in this "batch/cohort" yes, all instances will be migrated on that date (as mentioned earlier, each cohort is slightly different based on several factors such as size and complexity)
    • If customers are concerned they can always contact support
• Although the email specified that Adobe Workfront Administrators (ie SysAdmins) are to be migrated by the date mentioned, since some of the links also cited also refer to Adobe Workfront Users, whether the date mentioned also pertains to the latter (and if so, whether the Cautionary Tale to which I inquired above might then come into play)?
  • It depends on which cohort the customer falls in to. Depending on the type of customer we may do any of the following:
    • Admins and users all at once
    • Admins only
    • Sandbox/preview only for testing purposes
      • In sandbox, we can choose between certain admins/users

Other notes that may be helpful because they come up all the time:
1. A migration is complete once all lanes (sandbox/preview/prod) and all users/admins are migrated to the console

2. Yes, we are able to revert the migration temporarily should there be major issues and it's a quick process

3. There is no way to "opt-out" of a migration, but you may postpone or pick your own date

Hi @jonahmc (+ @soniaespejo),

Happy New Year, and thank you for your comprehensive responses (above) to my questions: excellent information for those who've yet to make the move to the Adobe IMS Console.

To keep things consolidated on this thread and continuing to roll in a positive direction...

TLDR: those reading along, I encourage you to ensure that all of your Workfront SysAdmin accounts -- especially those used in integrations -- match the Adobe IMS Console password restrictions shown below in advance of converting to Adobe IMS Console

Adobe IMS Console requires (sensible) password restrictions as shown below, but one of our legacy integrations (to Proof) relies on an older username/password authentication set back when it was developed. I've confirmed that the integration is at least still working as expected with the "old" password (which is good)...but believe it also confirms that the Proof username/password is independent from the "new" Adobe IMS Console password (which seems odd).

To rectify that, we are now scheduling a planned outage to ensure that the Workfront, Proof, and the API Integration all conform to the Adobe IMS Console password restrictions below, which (as above in bold) I'd encourage all Workfront SysAdmins to proactively do so, likewise.

For confirmation and future consideration:

• Am I understanding correctly that Adobe IMS Console password changes to (pre-existing accounts) apply to Workfront, but not to Proof username/passwords (yet)?
• If so, are there plans to extend Adobe IMS Console password changes to also apply to Proof username/passwords?
• If so, when might we expect to see that feature implemented?
• How (if possible) could an Adobe IMS Console Administrator adjust (i.e. "lower") the password rules to meet their own corporate policies?
• Password rules notwithstanding, does Adobe IMS Console enforce a certain cadence for changing passwords (e.g. annually, every 6 months, etc.)?
• How (if possible) could an Adobe IMS Console Administrator adjust such a cadence to meet their own corporate policies?

Regards,

Doug

Hi @jonahmc and @soniaespejo,

We have a legacy Workfront SysAdmin account called "Queue" (intended exclusively for setting up and "owning" Workfront Queues). That account was automatically migrated to Adobe IMS Console along with all other users, but is no longer necessary, so -- logged in to Adobe IMS Console with a different SysAdmin account -- we have removed all products, user groups, and administrator access from that Queue account.

Having essentially orphaned it, as far as Workfront is concerned, how can we now delete that user from Adobe IMS Console (i.e. so that searching for it, as shown below, then returns "no result")?

Regards,

Doug

Hi @doug_den_hoed__atappstore!

Thanks and happy new year. Hopefully the answers below will help clarify your questions and concerns.

• Am I understanding correctly that Adobe IMS Console password changes to (pre-existing accounts) apply to Workfront, but not to Proof username/passwords (yet)?
  • It depends on the type of Proof account
    
    • Proof "standalone" passwords are not connected to Workfront passwords.You may create/use the same password for both Workfront and Proof but they are not connected
    • "Integrated" Proof accounts do not have a separate password
• If so, are there plans to extend Adobe IMS Console password changes to also apply to Proof username/passwords?
  • No
• If so, when might we expect to see that feature implemented?
  • N/A
• How (if possible) could an Adobe IMS Console Administrator adjust (i.e. "lower") the password rules to meet their own corporate policies?
  • Password/Authentication settings can be found in this article here
  • Also, I recommend bookmarking this Article for an Admin Console overview
• Password rules notwithstanding, does Adobe IMS Console enforce a certain cadence for changing passwords (e.g. annually, every 6 months, etc.)?
  • This can be found in the Password/Authentication article above
• How (if possible) could an Adobe IMS Console Administrator adjust such a cadence to meet their own corporate policies?
  
  • This can be found in the Password/Authentication article above
• Deleting/removing users from the Admin console -- your "queue" user
  • Based on your screenshot, you do not appear to be an Admin Console system administrator because you are missing certain options in the top nav bar. If you are an Admin Console admin then you'll have the proper permissions
    • Here is an article on how to remove users from the console

For posterity purposes, I recommend saving this page as it is a valuable tool to find answers for general Admin Console questions.

Thanks!

Hi @jonahmc,

On behalf of our mutual clients, thank you for your transparency, candor, and assistance: this is excellent information.

As we typically have at least one WF SysAdmin account in each of our clients domains, we are observing the increasing pace of Adobe's Case Number 99999999 - Admin Console Migration - Your Domain  email notifications sent to SysAdmins. We've also noticed that some improvements have been made to these email notifications over time; the most recent being to include timelines with highlighting such as this example:

"We will begin by migrating your Workfront product to the Adobe Admin Console listed above within 30 days or more of receiving this email. We will send you a reminder email 10 days before the migration date:"

Most recently, there is now also a consent section:

"Adobe Admin Console System Admins please reply to this email with 'I provide consent'. By providing consent, you give consent for Adobe to migrate your Workfront users to the Adobe Admin Console listed above."

Sharing my understanding here as I learn more, as WF SysAdmins receive such email notifications from Adobe:

• Assuming the phrase "within" 30 days is intentional, does the first improvement above mean that such a migration could then be immediately followed up with the reminder email so that (at the very earliest) the migration of the WF SysAdmin accounts would then occur 10 days following the latter?
• Will these timeframes (i.e. "within 30 days" and "10 days before") vary by WF domain?
• Are those timeframes negotiable?
• Can WF SysAdmins opt out of this "automatic" process and instead move to a "manual" process (i.e. where the WF SysAdmin determines the timing)?
• And on the second improvement, as you helped me understand in your previous post, since it is (only) the Adobe Admin Console SysAdmin (vs "just" a WF SysAdmin), to avoid confusion, may I suggest you either update the email to explain the difference, or (ideally) change the process to first target and obtain permission from those Adobe Admin Console SysAdmins, and then send these announcements out with Adobe's assertion that such consent has indeed been obtained?

Regards,

Doug

cc: @jon_chen