Migration to the Adobe Business Platform - the new Adobe Identity and Admin Console

[#1]

Hello Workfront Community members! 

As you may have seen in previous communications, we are supporting our customers in their transition to the Adobe Business Platform to create a consistent experience across all Adobe products. This has meant changes to the Workfront admin console as customers have been migrated throughout 2023. 

What is the Adobe Business Platform? 

The Adobe Business Platform is Adobe’s Admin Identity and Console - a central location for managing Adobe entitlements across your organization. Your adoption of the console will improve work management efficiency and position your organization for faster innovation in the future. You will be able to: 

• Authenticate to Workfront and other products using a single Adobe identity 
• Manage user entitlements separately between production and sandbox or preview environments 
• Utilize Multiple SSO configurations for Workfront users 
• Manage entitlements to Workfront the same way you do so for other Adobe products 

How do I onboard my organization to the Adobe Admin Console? 

The time needed to make the change will vary by customer and our support team will walk you through all the necessary steps to set you up for success. You can reference the migration checklist below or reach out to the Adobe Workfront migration support team, who will walk you through all the necessary steps and ensure that the transition is as smooth and hassle-free as possible. 

Resources

Migration Checklist: Prepare to onboard your organization to the Adobe Admin Console

For an in-depth review of Adobe Identity and Admin console, you can reference this support page or the Admin Console comparison matrix

As always, if you have any questions, comments, or feedback, please feel free to contact customer support.

[#2]

Hi @soniaespejo,

Thanks for posting this and providing those links.

Having been involved with a few Workfront customers who've already moved, "been" moved, or are trying to prepare to move (respectively):

• Who decides (Adobe vs the customer's SysAdmin) when a the customer's Workfront Adobe domain will be migrated?
• Who initiates (Adobe vs the customer) contact between the customer and Adobe's support team (to then "walk you through all the necessary steps to set you up for success")?
• Does Adobe have a proposed (or required) schedule of "which domains move when"?
• Does Adobe have desired (or required) deadline by which all domains must be migrated?

Regards,

Doug

[#3]

Hi @soniaespejo,

As I understand from @jon_chen that you are currently preparing a response, I invite you to also review this related thread which @WhitUser and I have been discussing so you can then provide Adobe’s best practice(s) to control or avoid the default automatic emails that invite users to log in to yourdomain.preview and/or yourdomain.sb01 (etc) from being sent, since they can cause confusion (as I described in my Cautionary Tale).

Regards,

Doug

[#4]

Hi @soniaespejo,

A few hours ago, I (and I presume my Workfront customer’s fellow SysAdmins) received an email from Adobe Workfront Support informing me that Adobe was initiating the Adobe Admin Console for the domain, to be in place no later than Jan 22, 2024. Would you kindly clarify:

- will such an email be sent to every Adobe Workfront SysAdmin in each Workfront instance that is not yet migrated to the Adobe Admin Console?

- will the January 22, 2024 pertain to all such instances (vs other sets of instances with different dates)?

- although the email specified that Adobe Workfront Administrators (ie SysAdmins) are to be migrated by the date mentioned, since some of the links also cited also refer to Adobe Workfront Users, whether the date mentioned also pertains to the latter (and if so, whether the Cautionary Tale to which I inquired above might then come into play)?

Regards,

Doug

[#5]

Hi @Doug_Den_Hoed__AtAppStore , the team will reach out via email with more info and to answer your previous answer. I will add the "cautionary tale" here as a comment later this week for future reference.

Thanks for all your comments! 

[#6]

My pleasure @soniaespejo,

As the large majority of our mutual Adobe Workftont / AtAppStore customers have yet to migrate to the Adobe Admin Console, I’ve been directing them to your post (and my questions, and at your earliest convenience, your answers) to educate and encourage them.

As (technically) this is a blog post, @jon_chen, if you have the means to raise its visibility among the wider Workftont visitors, please do so.

Regards,

Doug

[#7]

Hi @Doug_Den_Hoed__AtAppStore ,

Please see the answers to your questions below:

• Who decides (Adobe vs the customer's SysAdmin) when a the customer's Workfront Adobe domain will be migrated?
  • Adobe will reach out to SysAdmins to initiate the migration but customers are welcome to reach out to support proactively. We are flexible when it comes to changing the initial migration date.
• Who initiates (Adobe vs the customer) contact between the customer and Adobe's support team (to then "walk you through all the necessary steps to set you up for success")?
  • Adobe initiates the conversation via email and/or support case depending on the type of customer
• Does Adobe have a proposed (or required) schedule of "which domains move when"?
  • Nothing official that we can share, but we are shooting for 60% by Q2. We are currently at 30%
• Does Adobe have desired (or required) deadline by which all domains must be migrated?
  • Nothing official as stated above, but our desired goal is to have 100% migrated by end of year 2024
  • Note - We have 6 different migration cohorts and each one is handled slightly differently. We will always notify all system admins of a migration. If anyone has questions and isn't assigned a specialist, they can and should submit a case to customer support to get assigned to one.
• Will such an email be sent to every Adobe Workfront SysAdmin in each Workfront instance that is not yet migrated to the Adobe Admin Console?
  • Yes, although the email changes slightly based on the cohort because different types instances must take different actions (i.e. SSO vs non-SSO accounts)
• Will the January 22, 2024 pertain to all such instances (vs other sets of instances with different dates)?
  • For accounts/domains we contacted in this "batch/cohort" yes, all instances will be migrated on that date (as mentioned earlier, each cohort is slightly different based on several factors such as size and complexity)
    • If customers are concerned they can always contact support
• Although the email specified that Adobe Workfront Administrators (ie SysAdmins) are to be migrated by the date mentioned, since some of the links also cited also refer to Adobe Workfront Users, whether the date mentioned also pertains to the latter (and if so, whether the Cautionary Tale to which I inquired above might then come into play)?
  • It depends on which cohort the customer falls in to. Depending on the type of customer we may do any of the following:
    • Admins and users all at once
    • Admins only
    • Sandbox/preview only for testing purposes
      • In sandbox, we can choose between certain admins/users

Other notes that may be helpful because they come up all the time:
1. A migration is complete once all lanes (sandbox/preview/prod) and all users/admins are migrated to the console

2. Yes, we are able to revert the migration temporarily should there be major issues and it's a quick process

3. There is no way to "opt-out" of a migration, but you may postpone or pick your own date

[#8]

Hi @JonahMc (+ @soniaespejo),

Happy New Year, and thank you for your comprehensive responses (above) to my questions: excellent information for those who've yet to make the move to the Adobe IMS Console.

To keep things consolidated on this thread and continuing to roll in a positive direction...

TLDR: those reading along, I encourage you to ensure that all of your Workfront SysAdmin accounts -- especially those used in integrations -- match the Adobe IMS Console password restrictions shown below in advance of converting to Adobe IMS Console

Adobe IMS Console requires (sensible) password restrictions as shown below, but one of our legacy integrations (to Proof) relies on an older username/password authentication set back when it was developed. I've confirmed that the integration is at least still working as expected with the "old" password (which is good)...but believe it also confirms that the Proof username/password is independent from the "new" Adobe IMS Console password (which seems odd).

To rectify that, we are now scheduling a planned outage to ensure that the Workfront, Proof, and the API Integration all conform to the Adobe IMS Console password restrictions below, which (as above in bold) I'd encourage all Workfront SysAdmins to proactively do so, likewise.

For confirmation and future consideration:

• Am I understanding correctly that Adobe IMS Console password changes to (pre-existing accounts) apply to Workfront, but not to Proof username/passwords (yet)?
• If so, are there plans to extend Adobe IMS Console password changes to also apply to Proof username/passwords?
• If so, when might we expect to see that feature implemented?
• How (if possible) could an Adobe IMS Console Administrator adjust (i.e. "lower") the password rules to meet their own corporate policies?
• Password rules notwithstanding, does Adobe IMS Console enforce a certain cadence for changing passwords (e.g. annually, every 6 months, etc.)?
• How (if possible) could an Adobe IMS Console Administrator adjust such a cadence to meet their own corporate policies?

Regards,

Doug

[#9]

Hi @JonahMc and @soniaespejo,

We have a legacy Workfront SysAdmin account called "Queue" (intended exclusively for setting up and "owning" Workfront Queues). That account was automatically migrated to Adobe IMS Console along with all other users, but is no longer necessary, so -- logged in to Adobe IMS Console with a different SysAdmin account -- we have removed all products, user groups, and administrator access from that Queue account.

Having essentially orphaned it, as far as Workfront is concerned, how can we now delete that user from Adobe IMS Console (i.e. so that searching for it, as shown below, then returns "no result")?

Regards,

Doug

[#10]

Hi @Doug_Den_Hoed__AtAppStore!

Thanks and happy new year. Hopefully the answers below will help clarify your questions and concerns.

• Am I understanding correctly that Adobe IMS Console password changes to (pre-existing accounts) apply to Workfront, but not to Proof username/passwords (yet)?
  • It depends on the type of Proof account
    
    • Proof "standalone" passwords are not connected to Workfront passwords.You may create/use the same password for both Workfront and Proof but they are not connected
    • "Integrated" Proof accounts do not have a separate password
• If so, are there plans to extend Adobe IMS Console password changes to also apply to Proof username/passwords?
  • No
• If so, when might we expect to see that feature implemented?
  • N/A
• How (if possible) could an Adobe IMS Console Administrator adjust (i.e. "lower") the password rules to meet their own corporate policies?
  • Password/Authentication settings can be found in this article here
  • Also, I recommend bookmarking this Article for an Admin Console overview
• Password rules notwithstanding, does Adobe IMS Console enforce a certain cadence for changing passwords (e.g. annually, every 6 months, etc.)?
  • This can be found in the Password/Authentication article above
• How (if possible) could an Adobe IMS Console Administrator adjust such a cadence to meet their own corporate policies?
  
  • This can be found in the Password/Authentication article above
• Deleting/removing users from the Admin console -- your "queue" user
  • Based on your screenshot, you do not appear to be an Admin Console system administrator because you are missing certain options in the top nav bar. If you are an Admin Console admin then you'll have the proper permissions
    • Here is an article on how to remove users from the console

For posterity purposes, I recommend saving this page as it is a valuable tool to find answers for general Admin Console questions.

Thanks!

[#11]

Hi @JonahMc,

On behalf of our mutual clients, thank you for your transparency, candor, and assistance: this is excellent information.

As we typically have at least one WF SysAdmin account in each of our clients domains, we are observing the increasing pace of Adobe's Case Number 99999999 - Admin Console Migration - Your Domain  email notifications sent to SysAdmins. We've also noticed that some improvements have been made to these email notifications over time; the most recent being to include timelines with highlighting such as this example:

"We will begin by migrating your Workfront product to the Adobe Admin Console listed above within 30 days or more of receiving this email. We will send you a reminder email 10 days before the migration date:"

Most recently, there is now also a consent section:

"Adobe Admin Console System Admins please reply to this email with 'I provide consent'. By providing consent, you give consent for Adobe to migrate your Workfront users to the Adobe Admin Console listed above."

Sharing my understanding here as I learn more, as WF SysAdmins receive such email notifications from Adobe:

• Assuming the phrase "within" 30 days is intentional, does the first improvement above mean that such a migration could then be immediately followed up with the reminder email so that (at the very earliest) the migration of the WF SysAdmin accounts would then occur 10 days following the latter?
• Will these timeframes (i.e. "within 30 days" and "10 days before") vary by WF domain?
• Are those timeframes negotiable?
• Can WF SysAdmins opt out of this "automatic" process and instead move to a "manual" process (i.e. where the WF SysAdmin determines the timing)?
• And on the second improvement, as you helped me understand in your previous post, since it is (only) the Adobe Admin Console SysAdmin (vs "just" a WF SysAdmin), to avoid confusion, may I suggest you either update the email to explain the difference, or (ideally) change the process to first target and obtain permission from those Adobe Admin Console SysAdmins, and then send these announcements out with Adobe's assertion that such consent has indeed been obtained?

Regards,

Doug

cc: @jon_chen 

[#12]

Building slightly on Doug's concerns, I also received one of these colorful missives this morning. As did all of my admin users, several of my standard non-admin users, and one user who's account has been disabled since 2022. I'm curious as to why people who have left my organization, and were never admins, needed to receive this message?

I'd like to understand how I can explicitly REVOKE consent for this unnecessary move. My message included the note as below, which is the source for my specific concern. We've just finished a rather painful SSO migration, and I do not want to migrate my people to an entirely different platform all over again, nor do I want to explain to my external customer users that they need new credentials either. The rather high-handed demand that we WILL do so in the next 30 days or else is also rather distasteful.

I have no problem with a new console for my own management process, but I do not need the confusion and headache of telling 350 people that I just finished training on login procedures that they have to learn something else. It is not acceptable for Adobe to email my users with login instructions that do not align with our internal training documents and change management processes. When announcements need to be sent, they come from me alone with appropriate tailored distribution lists.

For those of us who have organizations that do not use any other Adobe product, and thus have no need for a consolidated admin tool, how can we decline to participate entirely? 

[#13]

Hi @JonahMc,

I just finished a call with Adobe and an 18K+ user client during which I volunteered to create the "Adobe IMS Console 30-Day Migration Best Practice Diagram".

Watch this space...

UPDATE: here…

Regards,

Doug

P.S. @KatherineLa I will include a placeholder for if and when you learn of an "decline to participate entirely" mechanism; but from what I learned today, believe that Adobe's expectation is that once a client receives their initial "Adobe IMS Console Admin User migration" notification such a client will then be fully migrated (prod, preview, and sandboxes) within 30 days

[#14]

You are a brave one @Doug_Den_Hoed__AtAppStore!

[#15]

I am afraid our thousands of requesters are going to be thoroughly confused by an adobe login screen. A large number of these requesters are not technical at all and  we have enough issues with them accessing just through regular SSO, where they don't even NEED a login. I can't find any information on how to make this easier for those people that don't use other Adobe products and have very little understanding of technology.  And, of course, most of them are not going to read the announcements they receive in advance about what to expect. Does anyone know of a video or other resource to share with free users (reviewers in this case) to give them a visual of what to expect? The screenshots I found will only confuse them more...

[#16]

@RhondaGTriggs my client had the same fear, but I found that by giving them screenshots of the screens they'd expect to encounter and hosting "office hours" after the change was made we were able to remedy the issue.

[#17]

Hi @MikeMcGovern,

Thanks for sharing your screenshots and office hours tips: it's good to hear that they were effective for your users.

If you or anyone else reading who has completed their migration of Workfront into Adobe IMS Console have any additional "Success Stories" to share, I suspect those who've not migrated would be encouraged to hear about them.

Regards,

Doug

[#18]

Thanks for the continued commentary here @Doug_Den_Hoed__AtAppStore !

[#19]

We worked through our migration and tested it in our Preview environment. It works, but the extra screens are annoying to click through. To make it even more of a challenge, now our Creative Cloud apps are tied to the "Personal account" login and Workfront is tied to our "Company or School Account." This only affects a portion of our users, but for those users it's definitely confusing to log into one account for your CC apps and the other for Workfront. This also screwed up by Experience League profile, my Workfront ExL profile got tied to my personal account (which really isn't personal!), so if I want to check the commuity for Workfront help and saved posts, I have to log out of the Workfront App. I'm trying to get this fixed, but when I opened a Workfront support ticket, they said they couldn't help and to contact Adobe support. When I contacted Adobe support, they told me they couldn't help and to contact Workfront support (@jon_chen any ideas on how I can get this fixed?).

Adobe wanted to migrate our Production environment early, but we're waiting until the date they gave us, which is next Monday. Fingers crossed that everything goes smoothly.

[#20]

@Sheri_Whitten I'm in a similar situation with two Adobe accounts.  My IT team advised me to use different browsers for different things.  So I use Chrome for Workfront and Experience League and Edge for the admin console.  That way each browser remembers the username and password for a different account.  If you can't end up getting your accounts merged (or while you wait for it), this could help.  

[#21]

@ChloeWY yep, that's what I've been doing, and it works for now, but I do have an open ticket where support thinks they found someone that can fix it. Fingers crossed! 

Regarding the migration in general, we were fully migrated as of this past Monday. It seems so long ago already! I will say, the preemptive email with screenshots I sent to users a week prior was helpful. Most of my active users have not had any issues accessing Workfront, but if they have, or want, Creative Cloud apps, it's a different story. Now users are requesting licenses to CC apps through our "Workfront/Company or School account" and our company has that tied to personal accounts with work email addresses (a different team and company that manages those), so I have to deny requests and let the other team know. If you have everything under one Adobe account, I would imagine your experience will be much better. 

One additional caveat, we never had SSO enabled in our custom refresh sandbox and since I don't use it often, it was refreshed last November. I cleaned up all our users in our production environment so that only active users were migrated. Well, surprise! Adobe migrated anyone who was still left active in our custom refresh sandbox and sent invitation emails to all those users to access the sandbox - people who don't even know we have a custom refresh sandbox, people left the company, external users set up just for our reference and testing, you name it. Now that was an unexpected headache.

[#22]

I just noticed that my Community Profile is "personal account" and the profile for the console is a new blank account    I haven't submitted a ticket yet, but hope this can be merged somehow so that I can have easy access to my history. 

[#23]

@sheri_w, Hi Sherri, in your post above, you mention about sending out preemptive email communication to your users about the migration. I was wondering if you would be able to share example of that communication. We are in the beginning stages of migration and would like to have a communication that I can send to users when it is time to provide them with information on what to expect and what they may need to do. On the Support Site, I could not see any communication examples provided by Workfront for this. Any help would be appreciated. Thanks.

[#24]

Hi @TerryHy , the email template is available to all sellers on the SP site - Adobe Workfront Customer Success Resources On-Demand. Adding it here for easier reference, you can directly access with the following link: https://adobe.sharepoint.com/sites/WFCXCustomerSuccess/SitePages/CS%20On%20Demand.aspx#top-resources

Subject: Welcome to Adobe Workfront!

Body:  

Hi [customer name],

Welcome to Adobe Workfront!

We are excited to partner with you as we continue to transform the way people plan, execute, and automate work.

To access Adobe Workfront, please work with your Adobe Admin Console System Administrator to create your Workfront Product Profile Administrator in the Admin Console. Please refer to this article. Next, follow these step-by-step instructions to add yourself as a user in Workfront.

Here are some resources that will help you get started:

• Learn the “what” of Workfront with this Adobe Workfront Overview and see how it will help your teams control their time and get back to doing what they do best – quality work
• You will learn about customer success tips and best practices at the Adobe Experience Cloud Blog
• Adobe Experience League is the go-to place for documentation and training
• Be sure to check out the Events page to view and register for FREE, interactive workshops, hosted each week by the Adobe Workfront Customer Success team. 

Thank you,

The Adobe Workfront Team

[#25]

Hi Sonia,

I can't get to the link you posted above.

Request Id: dcedf3bb-a18e-4707-bf0d-7d0a7d7a1202
Correlation Id: b90f13a1-501f-4000-e09d-b87262655760
Timestamp: 2024-03-08T16:04:59Z
Message: AADSTS90072: User account 'Pia.Raymond@flagstar.com' from identity provider 'https://sts.windows.net/97730094-151b-4438-a840-84762ef0cdae/' does not exist in tenant 'Adobe' and cannot access the application '00000003-0000-0ff1-ce00-000000000000'(Office 365 SharePoint Online) in that tenant. The account needs to be added as an external user in the tenant first. Sign out and sign in again with a different Azure Active Directory user account.

@soniaespejo 

[#26]

@Sheo 

Hi Sheri,

I would love to see what communication you sent to your users. Will you please share them with me?

[#27]

Sure @TerryHy and @meswede1. It's nothing special, but I added it below. If you are not a Google Workspace company, you'll need to customize this to your enterprise workspace provider. I exported a list of users who logged into Workfront in the past six  months to easily grab their email addresses and sent them the following:

Workfront - New Login Screen Coming Soon

Hello,

You are receiving this email because you have logged into Workfront in the past six months. Due to a mandatory update from Adobe, the parent company of Workfront, the Workfront login screen will look different in the near future. When you log in to Workfront, you will be presented with the Adobe login screen. To log in to Workfront, click Continue with Google, then select Company or School Account. If your current browser session was authenticated with SSO you'll be redirected to your normal Workfront homepage. If you were not already authenticated with SSO you may be presented with our SSO login screen where you will need to login with your ID and password before being redirected to the Adobe login screens and then your normal Workfront homepage. 

If you have any trouble accessing Workfront, please reach out to me for assistance.

[#28]

Hi @JonahMc,

I was reviewing this Log in as another user post, and noticed this warning: 

When I then logged into mydomain.sb02.workfront.com (which has been onboarded to the Adobe Admin Console, as a test), I was in fact able to both see and use the Login As feature, as usual.

Is the documentation simply out of date, or (hmm...) will the Login As eventually not be available under Adobe Admin Console?

Regards,

Doug 

[#29]

@Sheri_Whitten were you able to get your Adobe accounts merged?  The using two different web browsers thing isn't working out as well as I thought it would.

[#30]

@ChloeWY not yet - my case is still open, but they inadvertently made it worse. Apparently, they deleted my new community profile altogether which didn't allow me to log in at all and the Workfront community page just kept flashing for me. They restored the new profile, so now we're back to square one, but they're confident they can fix it. I'll keep you posted and provide my case # if they do get it fixed. In the meantime, I'm getting to know the Microsoft Edge browser pretty well...

[#31]

They've completely revoked my entire Support account at this point, so I can't open new tickets or follow-up on any existing ones through the portal regardless of browser. I don't mind calling in to open tickets but it's then impossible to make any additions or see the statuses. 

So far all we've gotten done is migration of my single admin account in a sandbox environment and even that was enough to break things. 

[#32]

Hi @Doug_Den_Hoed__AtAppStore circling back to this.

Thanks for being patient, the Experience League isn't a normal part of my day-to-day so I was unaware there were responses to this thread.

To address your most recent question, that documentation is incorrect. "Login-As" should continue to work as normal and there are no plans to sunset it as we understand how important it is for admins. I'll find out who needs to update that for us.

Going back to earlier questions in this thread, I'd like to clarify and hopefully simplify a few things.

It may not be a surprise, but we are picking up the pace with these migrations with over 1,000 completed to date. A big part of that is our approach strategy based on the type of account. For example, we are picking a migration date for some customers to get the ball rolling per-se. Even though we are selecting a date, we will continue to honor requests to change that date and pick one that is more suitable for them so long as the requested date isn't too far in the future. Customers need only open up a support case to plan their migration date if one is not opened already.

Note that the bulk of the "fully automatic" migrations are almost done but no matter what email notification they receive from us, we always encourage customers to reach out to support should they have questions or concerns regarding the migration to ensure a smooth transition.

Also, to hopefully dispel some future confusion, there are 3 major parts to a migration.
1. Product migration

This has ZERO impact to end users. The product migration is essential for some customers to begin configuring SSO and/or setting up Admin Console user groups. It is also required before we are able to start migrating users.

2. User Migration

This is when users can expect to receive emails if they do not have an Adobe Identity. For those who have one, they won't receive an invite email.

3. "Turning It On" or "Flipping The Switch"

After we confirm all users have been migrated successfully, we "flip the switch" on our side to complete the migration to the Admin Console. After this is completed is when users will see the new Adobe login screen. This is also when admins can begin to manage their users within the console but most user management can continue to be done within Workfront.

If there's anything I missed or if you have other questions please let me know.

Thanks!

[#33]

Thanks @JonahMc,

For those who've read this thread, I invite you to also check out (and contribute to) the new Adobe Admin Console: Dear Diary... post I just created.

Regards,

Doug 

[#34]

Hi @ChloeWY, just following up - support did fix my profile and now my correct Adobe ExLeauge profile is attached to my Adobe Workfront profile. It's so much better than using two separate browsers! Let me know if you want my case #

[#35]

Hi @Sheri_Whitten , yes, please send me your case number!

[#36]

@ChloeWY here you go! Case #00391797

[#37]

Thank you, @Sheri_Whitten !

[#38]

@Sheri_Whitten thank you again for the help!  Support was able to merge my accounts together rather quickly with your example.

[#39]

@Sheri_Whitten Thank you for sharing your support case of merging accounts!

[#40]

We are going to move to Adobe admin console in couple of months. We have SSO directory implemented in our instance. How does this change with the new console? Do we need to implement it again for the Console?