DocumentationExperience Cloud KCS

IMS groups not synchronized for user accounts in Adobe Experience Manager as a Cloud Service

Last update: October 1, 2026

In Adobe Experience Manager as a Cloud Service, a user who belongs to multiple IMS groups sees some group memberships missing after login. This issue occurs when the user has both an Adobe ID and a Federated ID associated with the same email address, resulting in inconsistent group synchronization. To fix this issue, use a single identity type for authentication and allow IMS group synchronization to complete.

Description description

Environment

Adobe Experience Manager as a Cloud Service (all versions)

Symptoms

  • A user who is a member of several IMS groups synchronized from Active Directory logs in to AEM.
  • Most IMS groups are synchronized, but one or more expected groups are missing.
  • No specific error messages are observed in the logs.
  • The issue persists across multiple login attempts.
  • The user has both an Adobe ID and a Federated ID associated with the same email address.
  • Group synchronization behavior differs depending on the identity used for authentication.

Cause

AEM synchronizes IMS group memberships based on the identity used during authentication. If a user has both an Adobe ID and a Federated ID with the same email address, only the groups associated with the authenticated identity are synchronized. Group synchronization does not occur on every login and is affected by caching intervals. Using both identity types for the same email results in inconsistent group membership representation in AEM.

Resolution resolution

Follow the steps below to resolve the issue.

  1. Confirm the identity type used for authentication:

    1. Determine if the user is logging in with their Adobe ID or Federated ID.
    2. Note that AEM maintains a single user profile per email address, and group memberships are synchronized based on the currently authenticated identity.

  2. Test group synchronization with the Federated ID:

    1. Log out from all Adobe services.
    2. Open a new private or incognito browser session.
    3. Log in explicitly using the Federated (Company/SSO) account.
    4. Wait for the membership synchronization refresh interval to pass (allow several minutes).
    5. Log in again and check the user’s groups in AEM.

  3. Review IMS group assignments in the Adobe Admin Console:

    1. Ensure the user is a member of the expected IMS group.
    2. Confirm that the group is mapped and provisioned for AEM Cloud Service.

  4. Check AEM logs for synchronization events:

    1. Review AEM logs during login attempts for group synchronization events or errors.
    2. If no relevant information is found, increase log verbosity for identity synchronization components as needed.

  5. Avoid using both Adobe ID and Federated ID for the same email address. For consistent group synchronization, use a single identity type (preferably Federated ID for SSO-based access).

  6. If the issue persists:

    1. Collect detailed timestamps and group membership information.
    2. Contact Adobe Support for further assistance.

To verify resolution, log in with the intended identity and confirm that all expected IMS groups are present in the user’s AEM profile.

recommendation-more-help
experience-cloud-kcs-help-kbarticles