Adobe Identity Management FAQ adobe-identity-management-faq

What is Adobe Identity?

Adobe Identity Management System consists of three components.

When will existing Marketo Engage subscriptions be integrated with IMS?

Existing Marketo Engage subscriptions are currently being migrated to the Adobe IMS upon any sales event, which includes renewals, re-contracting events, and/or addendums. Migrations outside of a sales event are now supported as of October 2024.

After migration, will Marketo Engage URLs remain the same?

No. URLs will look different after migration.

Is there anything we need to do to prepare for the URL change?

Yes. After migration, Marketo Engage will go from being served from experience.adobe.com to Adobe Experience Cloud. You’ll need to work with your IT team to allowlist all Adobe domains listed at the top of this article to prevent disruption to Marketo Engage access.

Previous links and bookmarks to Marketo Engage assets on the engage-xx.marketo.com domain will continue to function. However, you must first log in to the Marketo Engage instance for the URL you are navigating to. For example, to navigate to a bookmark for a Smart Campaign in instance with Munchkin ID 123-ABC-456, you need to first log in to the Marketo Engage instance with Munchkin ID 123-ABC-456.

What’s the difference between an Adobe Product Admin and a Marketo Engage Admin?

Is there any change in User Management API client support?

Yes. Those who’ve been onboarded to Adobe IMS cannot utilize all the existing Marketo User Management APIs. For user invite, update, and deletion actions, the Adobe IMS APIs should be used. For role management, the Marketo User Management APIs still apply. Beyond this there are no other changes to Marketo REST API client support.

Who do we contact for support if we are integrated with IMS?

If you have Ultimate Success, you have access to Admin Console Migration White Glove Service. Please reach out to the Adobe Account team (your Account Manager) for assistance.

If I use an Adobe Identity to access other Adobe applications, can I use that to access Marketo?

Even if you have other Adobe products, you cannot access Marketo with Adobe Identity until the subscription is migrated to IMS.

Are Marketo user roles (within workspaces) managed in Adobe Admin Console?

No. User Role management (within workspaces) is completed in Marketo Engage.

I’m a Marketo Admin in an IMS integrated subscription and don’t have access to the Admin Console. How do I gain access?

Any Adobe System or Product Admin that has access to your organization’s Admin Console can give you access. If you’re not sure who in your organization has admin privileges in the console, contact Adobe Customer Care.

How would an Admin add users to Marketo Sales Connect?

While there will be a product card in Admin Console for Sales Connect, Admin Console should not be used to add/manage users. The following link will allow Admins to manage users via Marketo Sales Connect: https://toutapp.com/next#settings/admin/user-management.

Where can I learn more about the Adobe Admin Console?

https://helpx.adobe.com/enterprise/admin-guide.html.

Do I still go to the Admin section in Marketo to make user account changes for my account?

No, you would need to navigate to account.adobe.com.

How does this work with Marketo’s Universal ID?

Those onboarded to Adobe identity can access all IMS-enabled subscriptions seamlessly via the subscription switcher in the product.

Does this work with SSO?

Yes. Marketo integration with Adobe IMS supports Universal ID users and SSO. SSO is now driven by Adobe IMS and is set up at the organization level in the Adobe Admin Console. Learn more here.

I’ve already been onboarded to Adobe Identity and now I want to implement SSO. What do I do?

If you want to implement Single Sign On and your subscription has been onboarded to Adobe Identity without SSO implemented in the Adobe Org, please submit a ticket to Marketo Support and specify the topic as “Marketo on Admin Console, implementing SSO.”

How does device authorization work?

Adobe IMS does not currently support anything like Marketo’s device authorization feature.

Is it still possible to use the “Login in Invite User Dialog” feature, to make a user’s login unique from their email?

No. The User Invite workflow is no longer active when a subscription is IMS-enabled, so the feature is no longer valid. Adobe identity requires a user’s identity to be driven by their email.

For Adobe IMS, do we have the option to use Adobe ID, Enterprise ID, or Federated ID?

Yes, you determine the type of identity to have your organization support. More info can be found here: Identity Overview and here: Set up Identity.

Which product cards are supported in the Adobe Admin Console?

The supported product cards are: Marketo Engage, Marketo Measure, Marketo Dynamic Chat, Marketo Sales Connect, and Marketo Sales Insight Actions.

What if my user login doesn’t match my email when I get migrated to an Adobe Identity?

Current Marketo Engage users with logins different from their email address will no longer log in with that credential once migrated to an Adobe Identity. Adobe Identities always authenticate with a user’s email address. You can update an Adobe identity email address at account.adobe.com.

What happens after the Adobe Identity migration if my subscription uses IP restriction settings?

When subscriptions are onboarded to Adobe Identity, IP restriction settings do not get migrated to the Adobe Admin Console. Marketo’s IP restriction settings include allowing only access from specific IP addresses, and blocking specific IP addresses from access. At this time, Adobe Identity Management System does not support IP restriction features.

Coming in early 2025, Adobe Identity Management System will release a feature to support allowing only specific IP addresses, supporting a transition for Marketo users currently utilizing this feature. Those who currently use this feature will not undergo user migration until the feature is released. Once the feature is delivered, users will be notified of their migration being scheduled. More information about the feature will be provided when available.

Users who currently use the IP restriction, blocking specific addresses from access, will no longer be able to use this feature after being migrated to Adobe Identity, as it is not supported by Adobe Identity Management System.

What happens after Adobe Identity migration if I have users with a role that has the option to ‘Bypass Single Sign On’?

When subscriptions are onboarded to Adobe Identity, Single Sign On (SSO) is set up at the Adobe Organization level for all users. When SSO is set up, it will be enforced for all Marketo users/all Marketo instances in that Adobe Org. Previously, Marketo supported allowing a user role to be set up to have the option to ‘Bypass Single Sign On.’ This is not supported by Adobe Identity Management System.

I have more than one subscription, but not all have Single Sign On enabled. What happens after Adobe Identity migration?

When subscriptions are onboarded to Adobe Identity, Single Sign On (SSO) is set up at the Adobe Organization level. This means SSO applies to all product instances in the Adobe Org. When SSO is set up, it will apply to all Marketo instances in that Adobe Org. Previously, Marketo supported this setting at an instance level. That is not supported by Adobe Identity Management System.

Are any changes needed to CNAMEs, SPF, or DKIM we currently use for Marketo Engage after the Adobe Identity migration?

No, there are no impacts to these configurations.

I now have to navigate into Experience Cloud to access Marketo Engage. Is there a way to streamline this flow?

Yes. You can create a browser bookmark of the link that launches after clicking the Launch button on the Marketo Engage instance entrance page to bypass that page going forward.