Login UX improvements

I have several suggestions for improving the User Experience for logging in to Creative Cloud.

Support for logging in from Trusted Devices in an Enterprise environment using SSO with Conditional Access enabled 

In our enterprise environment, when we rolled out Windows 11 over a year ago, our IT Security group implemented Conditional Access. Conditional Access has broken SSO authentication for Creative Cloud. 

The login control on the welcome screen of the Creative Cloud Desktop, and individual member applications, do not support the requirements of Conditional Access.  Specifically the device information is not passed to the authentication server.  Thus the authentication server is unable to determine if the login credentials are being sent from a trusted device.  So although the authentication server is able to validate that the user has submitted valid credentials, it denies them access anyway, because it cannot determine that the device is trusted.

The workaround Adobe Support provided us is to use Login using your browser.  The main problem with this is that the Login using your browser option is hidden in the Help Menu, and most users either don’t know about it, or frequently forget. They try using the login control provided on the welcome screen of the Creative Cloud Desktop app, and get an error message saying “You cannot access this right now”.  Then they call the helpdesk.  The amount of lost productivity adds up and is a drain on our resources, both creative resources and helpdesk resources.

Adobe needs to implement support for Conditional Access across all login forms, in all applications.

I’ve also been told by Adobe Support that enabling Conditional Access breaks the session life settings.  We are forced to have no expiration to a login session, because when we tried to set a time limit on session length, stored credential tokens were not being cleared from the Credential Manager/Keychain when they expired, resulting in an “error”:“invalid_credentials” error being presented to the user after their login.

Login Screen customizations

The administrators would appreciate the capability to customize the login screen, to remove options that aren’t appropriate for our environment. This will make it simpler and easier for our users to log in, by providing them only the methods that are approved and that work in our environment, and reduce calls to our internal helpdesk for issues related to attempting to log in by unsupported means. 

• For example, we’d like to be able to suppress the question, after the user enters their user ID and password, to choose whether they are logging into their personal or business account.  We only support logging in to the business account on our devices.
• We would also like to suppress the “Continue with Facebook|Google|Microsoft|Apple” options from the login screen, as our environment does not support using these methods.
• We also would like to suppress the “New user?  Create an account” link; in our environment, users request access through our internal software request process.  It’s misleading and confusing to present a way to request access from the welcome screen of the application.