Invite a User to Adobe Analytics | OpsBlu Docs

Invite a User to Adobe Analytics

Step-by-step instructions to grant the collaborator access through the Adobe Admin Console.

Follow this runbook whenever the collaborator needs to be added to your Adobe organization or assigned to additional report suites. Adobe Analytics uses the Adobe Admin Console for centralized identity and access management across the Experience Cloud.

Understanding Adobe Analytics Permissions

Adobe Analytics access is managed through Product Profiles in the Admin Console, with permissions spanning multiple dimensions:

User Types and Identity Models

Adobe ID

  • User-owned account not controlled by your organization
  • User retains control even after leaving your company
  • Avoid for service accounts - prefer Enterprise or Federated IDs

Enterprise ID

  • Organization-owned account managed via Adobe Admin Console
  • Your organization controls password resets and account lifecycle
  • Suitable for service accounts when federated identity isn't available

Federated ID

  • SSO-based authentication through your identity provider (SAML 2.0)
  • Centralized identity management and automated provisioning
  • Preferred for enterprise deployments and service accounts
  • Requires identity provider configuration (Okta, Azure AD, ADFS, etc.)

Product Profile Roles

Product Administrator

  • Manage users within the product profile
  • Cannot modify profile permissions or create new profiles
  • Useful for delegating user management without full admin access

Admin

  • Full access to Analytics features and report suites within the profile
  • Can create calculated metrics, segments, and virtual report suites
  • Cannot manage users or product profile configurations

User (Standard Access)

  • Access determined by the specific permissions in the product profile
  • Typical roles include Analyst (view and analyze) and Editor (modify configurations)

Report Suite Permissions

Access can be scoped to specific report suites:

  • All Report Suites: Access to current and future report suites
  • Specific Report Suites: Limit access to designated suites only
  • Virtual Report Suites: Filtered views of full report suites

Tool and Feature Permissions

Granular permissions control access to Analytics capabilities:

  • Analysis Workspace: Interactive analysis and visualization
  • Reports & Analytics: Legacy interface (being deprecated)
  • Report Builder: Excel add-in for data extraction
  • Data Warehouse: Large-scale data exports
  • Segment Builder: Create and manage segments
  • Calculated Metrics: Define custom metrics
  • APIs: Programmatic data access (1.4 and 2.0)
  • Admin Tools: Suite settings, processing rules, classifications

Prerequisites

Organizational Preparation

  • Confirm which Adobe organization and IMS region the engagement will use (North America, EMEA, Japan)
  • Verify the organization has available user licenses or seats
  • Identify the Analytics product profile(s) that should govern access
  • Determine which report suites and virtual report suites to share

Identity and Access Planning

  • Collect the collaborator's service account email and preferred identity type
  • If using Federated ID, ensure the user exists in your identity provider first
  • Confirm whether the collaborator needs access to other Experience Cloud products (Launch, Target, Audience Manager)
  • Define whether access is temporary or permanent with expiration dates if applicable

Administrative Access

  • Ensure you have System Administrator or Product Administrator rights in the Adobe Admin Console
  • Verify permissions to assign the specific product profile and report suites needed
  • Review your contract to confirm the access aligns with master service agreement terms

Invite the Account

  1. Sign in to adminconsole.adobe.com
  2. Select the correct organization from the dropdown if you manage multiple
  3. Verify you're in the correct IMS region (check the URL and organization settings)

Add User to Organization

  1. Click Users in the top navigation
  2. Select Add User or Add Users by CSV for bulk additions
  3. Enter the collaborator's service account email address
  4. Choose the identity type:
    • Federated ID if SSO is configured (recommended for enterprises)
    • Enterprise ID if you want Adobe-hosted identity without SSO
    • Adobe ID only if explicitly required (not recommended for service accounts)
  5. Click Next to proceed to product assignment

Assign Analytics Product Profile

  1. Navigate to Products → Adobe Analytics in the Admin Console
  2. Select the product profile that matches the engagement requirements:
    • Analytics - All Access: Full permissions (use sparingly)
    • Analytics - Analyst: Standard reporting and analysis
    • Analytics - Custom Profile: Purpose-built profile with specific permissions
  3. Click Add User or select users to add from the list
  4. If creating a new profile:
    • Click New Profile and name it descriptively (e.g., "Vendor - Implementation Support")
    • Configure permissions under Permissions tab
    • Assign report suites under Report Suites tab
    • Enable specific tools and features as needed

Configure Detailed Permissions

Within the product profile, set granular permissions:

Analytics Tools

  • Enable Analysis Workspace for modern analysis interface
  • Grant Segment Builder and Calculated Metrics if creating custom definitions
  • Allow Report Builder if Excel integration is needed
  • Provide Data Warehouse access for large exports

Report Suite Access

  • Select All Report Suites for comprehensive access
  • Or choose specific suites from the list
  • Include virtual report suites if using curated data views

Administrative Capabilities

  • Grant Admin Tools access only if the collaborator needs to configure suite settings
  • Enable Processing Rules for data transformation requirements
  • Allow Classifications management if taxonomy uploads are needed

Additional Experience Cloud Products

If the engagement spans multiple Adobe products:

Adobe Launch (Tags)

  • Add to Launch product profile with appropriate company and property access
  • Define roles: Approver, Developer, Publisher based on responsibilities

Adobe Target

  • Grant Approver, Editor, or Observer roles as needed for testing and personalization

Adobe Audience Manager

Finalize and Send Invitation

  1. Review the summary of assigned products and profiles
  2. Optionally add a note referencing the engagement or ticket number for audit purposes
  3. Click Save or Invite to send the invitation email
  4. Adobe will dispatch an email to the collaborator with setup instructions

Post-Invite Checklist

Verification and Monitoring

  • Confirm the account appears in Users with status "Invited" or "Active"
  • Monitor for acceptance - follow up if not accepted within 48-72 hours
  • Verify the user appears in the correct product profile with expected permissions
  • Check that report suite assignments match engagement scope

Communication to Collaborator

Provide the following information to the collaborator's team:

  • Adobe organization name and IMS region
  • Product profiles assigned and permission summary
  • Report suite list with property IDs and names
  • VPN or IP allowlist requirements if network restrictions apply
  • Link to Adobe Analytics login: analytics.adobe.com
  • Primary contact for access issues or questions
  • Any company-specific Adobe Analytics standards or naming conventions

Documentation

  • Log the invitation in your IAM tracker with:
    • Service account email and identity type
    • Organization and product profile assigned
    • Report suites granted access
    • Tool permissions enabled
    • Invitation date and approval reference
  • Update engagement documentation with the new access grant
  • Record any temporary access expiration dates for future review
  • Note related product access (Launch, Target, etc.) for coordinated management

Adobe-Specific Considerations

Identity Provider Integration

If using Federated ID with SAML SSO:

  • Coordinate with your IT team to add the user to the appropriate directory groups
  • Verify email domain is configured in Adobe identity settings
  • Test SSO login immediately after invitation to catch misconfigurations
  • Ensure user attributes (name, email) sync correctly from IdP to Adobe

User Sync Tool and UMAPI

For organizations using Adobe's User Management API:

  • Manual invitations may conflict with automated provisioning
  • Coordinate with your IT team on the authoritative source for user management
  • Document any exceptions to automated processes for audit purposes

Report Suite Access Patterns

  • Development/Staging report suites should have separate permissions from production
  • Use virtual report suites to provide filtered views when full suite access isn't appropriate
  • Consider time-based access expiration for temporary engagements

Analytics API Access

  • API credentials (OAuth Server-to-Server or JWT) are separate from UI access
  • If the collaborator needs API access, create dedicated integrations in Adobe Developer Console
  • Associate API projects with appropriate service accounts and technical roles

Troubleshooting

Invitation pending for 24+ hours

  • Resend from the Admin Console Users page
  • Verify the email address spelling and deliverability
  • Check the collaborator's spam/junk folders
  • Federated IDs require pre-provisioning in the identity provider - confirm user exists in IdP
  • Contact Adobe Support with the invitation timestamp if delivery issues persist

Report suite missing after login

  • Verify the product profile includes the report suite under Report Suites tab
  • Check that the report suite wasn't deleted or renamed after invitation
  • Confirm the user is assigned to the correct product profile
  • Clear browser cache and cookies, then log in again
  • Allow up to 30 minutes for permission changes to propagate fully

Can't access Analysis Workspace

  • Ensure Analysis Workspace permission is enabled in the product profile
  • Verify browser compatibility (latest Chrome, Firefox, Safari, or Edge)
  • Check for corporate firewalls or proxy settings blocking access
  • Confirm the report suite has sufficient data and isn't brand new without hits

Need temporary access

  • Set a calendar reminder to remove or modify access after the engagement period
  • Document the expiration date in your IAM tracker and engagement records
  • Consider creating a time-limited product profile specific to the engagement
  • Schedule quarterly access reviews to identify and remove expired accounts

Federated ID authentication fails

  • Verify the user exists in your identity provider with the exact email address
  • Check SAML configuration in both Adobe and your IdP
  • Test SSO with a known working account to isolate user-specific vs. system-wide issues
  • Review IdP logs for authentication attempts and error messages
  • Ensure user attributes (email, first name, last name) are mapped correctly

Multiple organizations or wrong region

  • Adobe accounts can belong to multiple organizations - ensure you're inviting to the correct one
  • IMS region determines data residency - verify you're using the right region for compliance
  • If the user needs access to multiple organizations, send separate invitations from each
  • Region cannot be changed after org creation - contact Adobe if region is incorrect

Security Best Practices

  • Use Federated or Enterprise IDs for all service accounts; avoid Adobe IDs
  • Apply the principle of least privilege - start with minimal permissions and elevate as needed
  • Create engagement-specific product profiles rather than adding users to "All Access" profiles
  • Document business justification for Admin or Product Admin roles in your IAM tracker
  • Review product profile membership quarterly and remove inactive accounts
  • Implement IP allowlisting or VPN requirements for sensitive production environments
  • Enable Multi-Factor Authentication (MFA) for all users if supported by your Adobe contract
  • Rotate API credentials quarterly or when team membership changes

Compliance and Audit Requirements

  • Capture screenshots of the Admin Console showing the invitation and product profile assignment
  • Log all invitations in your IAM tracker with requester, approver, and date
  • Retain invitation records for compliance audits (SOC 2, ISO 27001, GDPR, etc.)
  • Ensure Analytics access aligns with data processing agreements and client contracts
  • Document data access implications, especially for report suites containing PII
  • Include Adobe Analytics access in regular access certification and recertification processes
  • Maintain evidence of approved access for the duration required by your compliance framework (typically 3-7 years)

After granting access, provide the collaborator with:

  • Report suite IDs, virtual report suite details, and naming conventions
  • Implementation documentation (data layer specifications, custom variables)
  • Adobe Launch property access and publishing workflows
  • Segment and calculated metric libraries
  • Processing rules documentation and data governance policies
  • Escalation contacts for technical issues and Adobe Support procedures
  • Links to Adobe Analytics documentation and your internal runbooks
返回顶部