Help with Federated ID Access for External Users in Workfront

[KervinWelsch2]

Hi everyone,

I’m reaching out to see if anyone has experience dealing with external users accessing Workfront via Federated ID (SSO).

I’ve recently invited an external client to our Workfront instance using their corporate email. The user was automatically provisioned in the Adobe Admin Console as a Federated ID, since their domain is already registered under another organization in Adobe IMS (likely due to their use of Adobe Sign or Creative Cloud).

Although the user has been correctly assigned a Workfront license in our admin console, they are encountering the following error when attempting to log in:

"User is not assigned to this application."

I’ve confirmed:

• The user appears as active in our Adobe Admin Console

• The Workfront product profile has been assigned

• Other external users with Federated IDs (from different companies) have successfully accessed our environment

I suspect the issue may be related to the SSO configuration on the client's side — possibly their organization is not allowing access to external Adobe tenants.

Has anyone experienced this before? Are there recommended workarounds for enabling access in this type of cross-organization federated setup? Should I ask the client to log in via https://experience.adobe.com instead of our direct Workfront URL?

Any insights or best practices would be greatly appreciated!

Thanks in advance

[Richard__Carlson]

We have some external vendors who have access to Workfront.  In Adobe Admin Console we have internal users set up with a Federated ID, all external users should be using an Adobe ID.

[KervinWelsch2]

Hi Richard,

Thank you for your reply.

Yes, this is what Adobe states, but the issue arises when the external user is already associated with Adobe products within their own company. When I try to add them, they are automatically assigned a Federated ID.

My company is still using Adobe ID, so when I add internal users, they are automatically created with Adobe ID. For external users, sometimes they are assigned Adobe ID — based on how my organization is configured — and other times they are assigned Federated ID. This likely happens because their company already has access to Adobe products configured with Federated ID. Since they are using the same corporate email, the Adobe Identity Management System (IMS) links the domain and prioritizes the domain configuration of their organization.

At least, that’s the behavior I observed after extensive research.

I’ve encountered this situation before — although in that case, the user was eventually able to access the system. That ticket was more preventive than corrective: I chose to open it after detecting this anomaly.

Position by adobe: "Kervin, that is not going to cause any login issues for the user. This is happening because the user already has a Federated ID in the Adobe system and the system will always prioritize the Federated ID when they are added to a new Admin Console. Again, this will not cause any access issues for them. They will just choose their Federated ID (named "company/school" option) user at login rather than username and password route but, they will be able to access without any issues. Please don't hesitate to let me know if there is anything else I can help with or further clarify. Best, Syrus"

Now, however, I’m facing a real issue. The user cannot access the system, and I haven't been able to find any official documentation or guidance to help external users log in under these conditions.

[skyehansen]

I'm wondering if you can have the user try to log in using an incognito browser (just making sure we get all the caching issues out of the way to start with)

[Lyndsy-Denk]

For my external users, they need to select Personal instead of Company/school.

[KervinWelsch2]

Hi Lyndsy,

Do you have a user guide or instructions that you send to your customers to help them access the system?
At the moment, I’m unable to create something similar because I can’t replicate the external user login process in Workfront. That makes it difficult for me to guide them through their first login, as I have no idea what steps they’re going through.

Currently, my company doesn’t use Federated ID. So, when I access Adobe Experience Cloud, I’m directed to this page, but there’s no option to select “Personal Account” instead of “Company or School Account.”

In the past, I’m pretty sure there used to be a page where you could choose between a personal and a company/school account. Does this option still exist?

Thank you

[Lyndsy-Denk]

The instructions I give my external users:

1. Make sure you have an Adobe ID that matches the email address I used to add you to our system. If necessary, provide me with an alternate email address that is already associated with an Adobe account.
2. Navigate to experience.adobe.com.
3. Sign in with the email address you used for your Adobe account.
4. Select Personal when prompted. (I think this appears after entering the username/email address.)
5. Click Workfront.

One way you can mock up the external experience is to try to log in with an incognito window. Without an external address, you can't go far, but you might be able to go far enough to see what the experience is like.

[kautuk_sahni]

@KervinWelsch2 Just checking in — were you able to resolve your issue?
We’d love to hear how things worked out. If the suggestions above helped, marking a response as correct can guide others with similar questions. And if you found another solution, feel free to share it — your insights could really benefit the community. Thanks again for being part of the conversation!

[KervinWelsch2 · Accepted solution]

Hi Kautuk,

I discovered how it works after solving my client's issue. Please advise the Adobe team to update the documentation or create a new one to reflect this behavior.

If the external client already has a Federated ID, the Adobe Console will automatically associate that ID with their account. It is not possible to create or switch to an Adobe ID, contrary to what the Adobe manual suggests.

External users with a Federated ID should follow these steps:

1. Go to: https://experience.adobe.com/

2. Enter the email and password they already use within their organization

3. If they are registered under multiple companies, once they land on the Adobe Experience Cloud homepage, they will have the option to switch between different company instances

4 - They need to select the correct organization and then click on the Workfront icon.

Recommendations: Always check the Admin Console to verify whether the external user you created in Workfront is using an Adobe ID or a Federated ID.

Always prepare two separate user guides to send:

- One for users with a Federated ID

- Another for users with an Adobe ID

Thanks for the support!