Adobe Advertising Cloud User Management

Adobe Advertising Cloud Permission Model

Adobe Advertising Cloud delegates all identity and access management to the Adobe Admin Console. Access is granted through product profiles -- each profile maps to a specific set of capabilities within Advertising Cloud DSP, Search, Social, or Creative. Users can hold multiple product profiles simultaneously, and permissions compound across profiles.

The hierarchy works in three layers:

1. Organization -- the top-level Adobe Experience Cloud org tied to your enterprise IMS account.
2. Product Profiles -- named permission sets created under the Adobe Advertising Cloud product card (e.g., "Advertising Cloud - DSP Full Access", "Advertising Cloud - Search Analyst").
3. Advertiser Scoping -- within a product profile, users can be restricted to specific advertisers, campaigns, or business units.

This means a single user can have DSP Admin access scoped to Advertiser A, plus Search read-only access across all advertisers, controlled entirely through profile assignments.

Roles and Product Profile Types

Adobe Advertising Cloud does not use a simple role dropdown. Instead, roles are defined by the product profile the user is assigned to. Common profile configurations:

System Administrator and Product Profile Admin are Admin Console roles, not Advertising Cloud roles. They control who can manage users, not what advertising features are available.

Admin Console Navigation

All user management happens in the Adobe Admin Console, not within the Advertising Cloud UI itself.

Adding or editing users:

Admin Console (adminconsole.adobe.com)
  > Products
    > Adobe Advertising Cloud [DSP / Search / Creative]
      > [Product Profile Name]
        > Users tab
          > Add User / Edit / Remove

Managing product profiles:

Admin Console
  > Products
    > Adobe Advertising Cloud
      > New Profile (to create custom permission sets)
      > [Existing Profile] > Permissions tab (to configure feature access)

Viewing user assignments:

Admin Console
  > Users
    > [Search by name or email]
      > Products tab shows all assigned profiles

API Access Management

Adobe Advertising Cloud APIs authenticate through Adobe I/O (Developer Console) using OAuth 2.0 server-to-server credentials or JWT (legacy, being deprecated).

Key API access considerations:

• Service Account (OAuth Server-to-Server) -- the recommended credential type. Created in Adobe Developer Console under the organization. Not tied to a specific user but scoped to product profiles.
• JWT Credentials (Legacy) -- being phased out. If still in use, these are tied to a technical account and require a public/private key pair.
• API access requires product profile assignment -- the service account or technical account must be added to the relevant Advertising Cloud product profiles in Admin Console, just like a human user.
• Scopes -- API credentials can access DSP (dsp), Search (search), and Creative (creative) depending on product profile assignments.

To audit API access: Admin Console > Users > filter by "Technical accounts" to see all service accounts with Advertising Cloud access.

Analytics-Specific Permissions

Adobe Advertising Cloud integrates tightly with Adobe Analytics and Adobe Experience Platform. Permissions that affect analytics data:

• Cross-solution access -- users who need Advertising Cloud data in Adobe Analytics workspaces require product profiles in both products. Advertising Cloud data flows into Analytics through the AMO integration; the user needs Analytics access to see it.
• Conversion reporting -- Floodlight and conversion tag management requires DSP Full Access or Search Manager profiles. Analysts can view conversion data but cannot modify tag configurations.
• Audience sharing -- creating or editing shared audiences between Advertising Cloud and Experience Platform requires the DSP Full Access profile plus an Audience Manager or RTCDP product profile.
• Attribution models -- custom attribution model creation in Search requires Search Manager; viewing attribution reports requires Search Analyst or higher.
• Report scheduling and export -- available to any user with at least Analyst-level access. Scheduled reports run under the creating user's permissions, so if their access is revoked, scheduled reports stop.

User Lifecycle Considerations

• Federated ID vs. Enterprise ID -- if your org uses SSO (SAML/OIDC), users authenticate through your identity provider. Removing them from your IdP revokes Adobe access, but their Admin Console profile persists until manually cleaned up.
• Directory trust -- cross-org access (agency managing client accounts) requires directory trust configuration in Admin Console. The agency org must be trusted by the client org.
• Audit trail -- Admin Console logs all user additions, removals, and profile changes. Export from Admin Console > Insights > Logs.
• Bulk operations -- Admin Console supports CSV bulk upload for adding multiple users to product profiles simultaneously.

Step-by-Step Guides

• Add User Access -- invite users via Admin Console and assign product profiles
• Update Access & Roles -- modify product profile assignments and advertiser scoping
• Remove User Access -- revoke access, handle API credentials, and transfer assets