Workfront Experts on Best Practices for the Adobe Business Platform Migration

Adobe Employee

If you are seeing a discrepancy between WF active users and the Admin Console assigned users please submit a support case so we can investigate further. There are a variety of things that can cause this to occur so a support agent will need to access your console and WF. If you have some users who are showing as deactivated in WF but assigned in the AC provide the emails as examples to assist them.

E

EmmaG13

Level 4

Hello

@rexxma and @mckaywh

We are having Workfront migrated into the Adobe Admin Console next month. One of the questions that we are having difficulty around is SSO (single sign on).

Workfront has SSO in my organisation.

All other Adobe Products do not.

I would like to understand the impact of migration - we do not want to lose the ability to have SSO on Workfront but also to keep all other Adobe products using username/password log-in.

Any help would be amazing. I will be attending this event.

Thank You

Emma

E

EmmaG13

Level 4

As a note - I have investigated two admin consoles HOWEVER feedback from the community is that you need to keep logging in and out of Adobe products.

So for example Creative Studio who use Creative Cloud and Workfront for their job will need to keep logging in and out all day to get information on the artwork they are creating.

Kindest

Em

IMS-Migration-Communication_clean.docx

McKayWh

Adobe Employee

Hi @emmag13,

Suppose you set up SSO in the existing console. In that case, you can use SSO for all newly created users without converting any existing users to SSO (though you can convert Adobe ID users to Federated ID once it's been set up if desired). But if you set up SSO in that console, any new users would be created as Federated ID users and would have to log in via SSO, for all Adobe products in that console.

If you do not want other Adobe product users to log in via SSO, the recommendation would be to use a separate admin console, but as you mentioned, this creates more work for end users as they have to manage signing into multiple accounts.

Thanks!

C

CatherineKe

Level 5

@McKayWh @RexxMa We are in the process of migrating. Our Workfront currently uses SSO with federated IDs.

Our sandbox environments were migrated
Support is ready to migrate our production environment as soon as we give the go-ahead

We had a couple issues we worked out in sandbox-

caching when trying to log into Workfront for the first time via the console
existing Adobe IDs that were all capitals
noted that users (some?) will now have to select between “Personal” or “Company or School Account” when logging in

I’m looking for assistance in communicating the change to my users, and issues they may encounter when logging in for the first time. Does Workfront have a “template” or a “playbook” that we can start from, in preparing our communication?

Additionally, my current support account on Experience League uses my Adobe “Personal Account.” I’m wondering if it should use my “Company or School Account” instead? If so, could the history of my support cases be moved? Both account types use the same email address but have different passwords.

Thank you!

CynthiaBoon

Adobe Employee

Hey Cathy! I know that Rexx and McKay will have to handle technical questions, but Rexx sent me a Word doc that might help with the end user communication. I'm uploading the Word version so that anyone who might need it can download it and edit it for their org. Hopefully this helps!

S

Stacey_Robertson

Level 5

@mckaywh @rexxma

We just had our fusion instance and all sandbox/preview environments migrated to Admin Console on Friday. Yesterday none of the admins could log into Fusion as we had not been assigned to that product. That issue has now been resolved. Everything seems to be functioning in Fusion today. Support mentioned that webhooks or connections could no longer use a name/password combination to log into another source for our integrations. I inherited the instance, so I'm not sure how those were originally set up. Is there a way I can tell in Fusion if they use a name/login to connect? Our big integration is with Salesforce, but we also use Office 365.

Adobe Employee

The username/password authenitcation only applies to WF modules. Existing connections will continue to work however, when setting up new connections you will not be able to authenticate with a WF username/password.

If you need to setup a new connection I recommend logging into WF first as the user you want to establish the connection through. Once logged into WF access Fusion and create the connect. This will recognize the active WF session and take care of all other authentication needs automatically.

If you do not use the above method, you will be prompted to sign into WF through the admin console while creating the connection. Enter in the AC credentials for the use you want to establish the connection through.

Once created the connection holds the credentials so you will not need to authenticate again.

S

Stacey_Robertson

Level 5

@mckaywh @rexxma

We just had our fusion instance and all sandbox/preview environments migrated to Admin Console on Friday. We have an integration with Salesforce and Workfront. When a design request is entered in Salesforce, they can add contacts to that request. If those contacts are not currently in Workfront, our integration adds the user to Workfront. Do they need to be added to Admin Console first and is there a delay between the time they are added there and the time they would appear in Workfront to complete the set-up of their profile? What is the best way to make this user autoprovisioning happen in the new model? Currently, there is no admin intervention needed in this user setup and we would like to make this seamless for our admins going forward.

Adobe Employee

You can still add users to WF through the API. When this is done the user needs a System Admin approval before they can be activated in WF and pushed to the AC.

You can also use the Admin Consoles UMAPI functionality to add users to the AC and assign the WF product. This does not require system admin approval and would only take a few minutes for the user to be added to the WF product. You would need to contact the AC team if you need assistance in setting that up.

Maribeth_Foley

Level 2

@McKayWh @RexxMa

Q: How can I tell if a user has another profile for Adobe (with the same email address)? Scenario: developer has two profiles - the one I created 5 years ago for Workfront (and we migrated to Console 5/15). And another (through who I'm guessing is another Adobe Admin in our company who issues the Creative Suite licenses). How would I know this? I learned about it last week because she sent me a snapshot of both profiles from her perspective. Thanks!

McKayWh

Adobe Employee

There is no way to see this info from your side, but you can contact our support team if you ever have a specific need to track this kind of information down across multiple Admin Consoles across your org.

jon_chen

Author

Community Manager

The Coffee Break is now LIVE. Ask your questions about the Adobe Business Platform migration here - our experts will be on this thread for the next hour.

test signature

J

jlankenau

We have a Fusion integration with Workday. This scenario uses a Fusion Automation Bot user account to add new users to Workfront when they are added to a certain cost center in Workday.

I want to confirm the new user provisioning between Workfront and the Admin Console is bi-directional. If this Fusion bot account adds a new user in Workfront, will that new user also be added in the Admin Console?

I've had our Adobe product owner at our company add the Fusion Bot user as an admin in the console, I just want to ensure no updates to our Fusion scenario will be necessary to accommodate this migration.

Thanks!

McKayWh

Adobe Employee

Ultimately this is something you should make sure you test in a Sandbox environment and ensure it's working before you complete your Production migration, but I would expect you'll need to make some changes in this case.

The sync between Workfront and the Admin Console is bi-directional, but for that to work the user has to have an active IMS session, which a bot account connecting to the Workfront API won't have - so the bot account can't create a user in the Admin Console this way.

I suspect you will need to update your Fusion scenario to connect to our User Management API (https://adobe-apiplatform.github.io/umapi-documentation/en/UM_Authentication.html) and create the user in the Admin Console first, which you can then assign to Workfront and then use the Workfront modules to update any user details needed after they've been created.

D

DerrickPo

@McKayWh @RexxMa

Our institution already has an existing Admin Console that we'll be migrating to. Does our Workfront SSO configuration need to match the Admin Console SSO configuration? Our concern is that the Admin Console SSO is set up to pass a different university ID from the one we use for Workfront SSO (in the Federation ID user field).

Thank you!

Adobe Employee

The WF SSO configuration will be going away and the AC SSO config will be the new way authentication is handled. You will want to setup that configuration to work with your orginizational needs. You can have more than one SSO configuration in the console but you can only have 1 configuration per claimed domain.

For example I can have an SSO configuration setup for @61380.com users and then a different SSO configuration for @workfront-1.com users.
IF you are not using different domains then users will need to be updated based on what configuration the AC is using.

JanaMB

@mckaywh @rexxma We just had our preview environment migrated to our org's current instance of Admin Console last week. We use SSO for both Admin Console and Workfront. On the WF side, if our users are not currently in the system, it automatically adds them. It is working fine for the admins that were added last week to Admin Console manually; however, when a non-admin user tries to login they have no access to Workfront even though they are a current user of workfront. Do they need to be added to Admin Console as a Workfront user first manually or is there an automated way to make this happen for new users? Is there a way to migrate current Workfront users to Admin Console?