What's new: Federated Guest Access is now generally available
TL;DR Federated Guest Access (FGA) is now generally available. It allows enterprise customers to onboard external partners, agency staff, vendors, consultants, as federated users, without requiring ownership of their email domain. This feature is available to organizations that purchased an enterprise plan directly from Adobe and have at least one active federated directory. If that's not your setup, this capability won't appear in your Admin Console yet.
What changed
Previously, creating a Federated ID user required your organization to own the user's email domain. That meant you couldn't add anyone using a non-claimable domain, such as gmail.com, or a domain claimed by another organization as a Federated ID user. In practice, this blocked a common scenario: bringing an external vendor or consultant into your Adobe environment under the same SSO and authentication policy you use for employees.
FGA removes that restriction. You can now add a user with any email address as a federated guest, a new variation of the Federated ID account type. Federated guests authenticate through your organization's IdP, just like internal employees, and their account is scoped entirely to your organization, independent of any account they hold elsewhere, including with their own employer.
Federated Guest Access is particularly useful anywhere enterprises rely on outside expertise, marketing teams working with agencies, IT departments bringing in consultants, or organizations collaborating with partner companies. In each of these cases, FGA replaces the workaround methods teams previously used to onboard external contributors, which often led to inconsistent authentication, extra admin overhead, or gaps in access control. With FGA, external partners are brought under the same SSO and security policy as internal employees; their entitlements remain fully isolated from any other Adobe account they hold; and admins manage them through the same console and controls they already use for internal users.
A concrete example from Adobe's documentation: a contractor who already has a federated account through her employer can be added as a federated guest by the company hiring her. She signs in through the hiring company's SSO to access assigned tools. Her federated guest account carries its own entitlements and assets, fully separate from her employer-owned account. Neither organization has visibility into the other's data.
Who this applies to:
This capability requires an enterprise plan purchased directly from Adobe, plus at least one active federated directory already configured. If your organization doesn't meet both conditions, you won't see the Guest domains tab in your Admin Console. Contact Adobe Support if you believe you should be eligible, and the option isn't showing.
What you need to know before setting this up
-
Supported products right now are limited to four: AEM Assets as a Cloud Service, Adobe Express, GenStudio, and Workfront. Assigning any product outside this list to a federated guest will fail without consuming a license. Check this list before you provision.
-
Setup occurs via a new Guest domains tab within each directory's settings in the Admin Console.
-
Every federated guest completes a one-time email verification and consent step before their first sign-in.
-
If your organization owns a claimed domain, you control whether other organizations can use it as a guest domain, and you can review that usage from Identity Settings at any time. If you wish to block your claimed domain usage as guest domain, please contact Adobe Support.
-
Federated guests use an account switcher to move between accounts tied to the same email address, but each switch requires re-authentication, since each account has its own federation.
Get started. Full setup steps, including guest domain management and the Global Admin Console hierarchy for multi-org setups, are documented in “Federated Guest Access” on Help document.
Quick links
Hit an edge case setting this up? Drop it in the thread below.
More questions? Start a conversation | Catch up on all updates: ICYMI
AdChoices