Enterprise Device Authentication Management for Creative Cloud Desktop Apps and Acrobat Pro

What this feature does: 

This enterprise-level configuration lets you set the authentication mechanism for Creative Cloud desktop applications, including Acrobat Pro Desktop, at the device level. Pair it with your company's device deployment process so that when a user signs in, they're automatically redirected to your organization's identity provider for the claimed domain, instead of landing on Adobe's generic sign-in screen. 

Before you start: 

To use this, your company must first claim the relevant domain in the Adobe Admin Console. You can claim more than one domain, but on any single machine the policy must resolve to one claimed domain. If you've claimed multiple domains, you can direct different users on different machines to different domains. 

Why configure this:

1. Users are automatically redirected to your company's identity provider at app launch, for any domain claimed in the Admin Console 
2. Sign-in can be restricted to Organizational IDs only 
3. Social sign-in options can be removed from the authentication screen entirely 

How to configure it: 

macOS 

1. Create a plist file specifying the claimed domain you want users redirected to 
2. Place the plist file at /Library/Preferences/com.adobe.NGL.AuthInfo.plist 
3. Restart the Creative Cloud desktop app (a full device restart is recommended) 

Windows 

1. Open Registry Editor (Windows + R, type regedit, press Enter) 
2. Navigate to Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Adobe\ 
3. Add a key named NGL 
4. Within NGL, add a key named AuthInfo 
5. Within AuthInfo, create a string value named login_domain, with the claimed domain as its value 
6. Restart the Creative Cloud desktop app (a full device restart is recommended) 

Good to know: 

• This configuration does not affect existing trust relationships 
• Users must authenticate with a Federated ID account for this to apply 
• Wildcards aren't supported when specifying a domain, use the exact domain 
• This won't work if browser-based login is configured by the admin