Resolve 403 Forbidden errors when using Azure AD groups in Edge Delivery Service
Adobe Experience Manager as a Cloud Service (AEMaaCS) with Edge Delivery Service may return 403 Forbidden errors during Preview or Publish actions when Azure AD groups are used in the permissions configuration. To resolve the issue, verify the permissions configuration and confirm that Azure AD groups are properly synchronized with the Admin Console.
Description description
Environment
- Adobe Experience Manager as a Cloud Service (AEMaaCS) with Edge Delivery Service
- Any environment where Azure AD groups are used for permissions
Issue/Symptoms
- Users who are members of Azure AD groups configured in the permissions configuration file encounter a 403 Forbidden error when attempting to use the Preview or Publish functionality.
- The issue affects all users in the specified Azure AD groups and is consistently reproducible.
- The error suggests that group permissions are not being recognized as expected.
- The issue may be related to configuration or synchronization problems.
- Users in the affected Azure AD groups cannot successfully use the Preview or Publish features.
Root cause
A 403 Forbidden error during Preview or Publish typically indicates a permissions misconfiguration or a synchronization issue between Azure AD groups and the Admin Console.
Resolution resolution
Follow the steps below to resolve the issue:
-
Verify the permissions configuration file and ensure that the Azure AD group names are entered exactly as they appear in both Azure AD and the Admin Console.
-
Confirm that the Azure AD groups are properly synchronized with the Admin Console and that group membership is up to date.
-
Test with individual users:
- Add an individual user directly to the permissions configuration file and verify whether Preview or Publish works for that user.
- If the functionality works for individual users but not for groups, the issue is likely related to group resolution or synchronization.
-
If the issue persists, collect the following information for further troubleshooting:
- A HAR file captured during a failed Preview or Publish attempt.
- The approximate time and time zone of the failed attempt.
- A redacted copy of the permissions configuration file and the affected document path.
-
Contact Adobe Support and provide the collected information for further assistance.
-
Verify the resolution by confirming that users in the Azure AD groups can successfully use the Preview and Publish features without encountering a 403 Forbidden error.