Adobe Domain Enforcement
The VCU Instructional Computing Services team (the team that manages Adobe software at VCU) has identified a new set of environmental settings available to some Adobe Enterprise customers which enables the ability to enforce restrictions for account creation under specific email domains.
These new settings provide the ability to directly restrict the use of an email address under a linked domain (vcu.edu, apps.vcu.edu, mymail.vcu.edu, and alumni.vcu.edu) from creating an Unmanaged Personal Account (Adobe ID). To ensure compliance with our Adobe Enterprise Agreement and ease some challenges experienced by VCU end-users over the last several years, the VCU Instructional Computing Services team will roll out these settings in a phased approach as described by the timeline below.
We've also provided a list of questions and answers for end-users who may have different levels of access to Adobe software at VCU based on their job role, student status, and other factors starting with a definition to help everyone understand; what is an Unmanaged Personal Account (Adobe ID) and how is it different from a Managed Enterprise Account (Federated ID)?
Implementation Timeline
Phase 1 - Implementation Date: January 1st, 2024
In the first phase of this project, the setting for enabling “domain enforcement” will be turned on which will disallow anyone from creating a personal Adobe ID account using their VCU email address under the vcu.edu or mymail.vcu.edu email domains. End-users with an existing personal Adobe ID associated with their VCU email address will not be impacted and they will continue to be able to use their personal Adobe ID account until the beginning of the next phase of this project.
Phase 2 - Implementation Timeframe: June 2024
In the second phase of this project, the setting for enforcing existing personal Adobe ID users with an account that is associated with their VCU email address will be required to change their email address associated with their personal Adobe ID account to a personal non-VCU email address. The use of apps.vcu.edu, alumni.vcu.edu, and vcuhealth.org accounts will also be strictly prohibited with this change. A secondary component of this change will be the enforcement of the use of Federated ID’s specific to VCU for shared-devices in computer labs, classrooms, and in other academic spaces. This means anyone using a personal Adobe ID, or an Enterprise ID from another institution will not be able to sign-in and use computers in these academic spaces. Only currently-enrolled students and active employees/affiliates will be permitted to use these shared devices.
Phase 3 - Implementation Timeframe: January - February 2025
In the third and final phase of this project, the list of existing end-users with a personal Adobe ID associated with their VCU email address will be parsed for active employees, students, and affiliates who have not updated their account to use a personal email address and these users will be given a final notice. After a minimum of 30 days, VCU’s Adobe System Administrators will request permanent deletion of any personal Adobe ID accounts associated with the VCU email domain that have not been updated to use a non-VCU email address.
As of December 2023, there are approximately 34,000 personal Adobe IDs associated with VCU email addresses. Aside from users on the VCU Qatar Campus (around 500), and former administrators of retired VIP and Teams plans (less than 2 dozen active VCU employees), none of these approximately 34,000 users are affiliated with any active VCU enterprise, business, or teams plan since VCU transitioned to a single university-wide ETLA in Summer 2019.
Adobe Account Types
Adobe utilizes several different types of accounts to distinguish between personal accounts (owned by end-users) and business/enterprise accounts (owned by the organization). These account types have some differences and in some cases limitations to specific apps, services, functions, and features depending on a variety of factors. Below, are descriptions of the two account types VCU end-users should familiarize themselves with to better understand how Adobe software licensing is managed under the VCU Adobe Enterprise Term License Agreement (ETLA).
We've also included a table to show how these accounts will be impacted before and after the domain enforcement settings have been implemented.
What is a Managed Enterprise Account (Federated ID)?
A Managed Enterprise Account (Federated ID) is an Adobe account (adobe.com and other associated websites/platforms), that belongs to the organization that manages the account and is tied to a specific email domain or affiliation with an organization. This type of account exclusively uses an organization's Single Sign-On portal. Accounts of this type of type are always managed by an organization.
It is important to note that a Federated ID account remains associated with the organization even when an end-user becomes inactive or leaves the organization. End-users do NOT retain ownership of this account once they become inactive and/or separate from their organization. This means they will lose access to the account and any data, files, assets, and libraries stored within the account upon graduation (students) or if not re-enrolling, termination (only for employees), and when completely separating from the university. All Federated ID accounts are managed by the VCU Instructional Computing Services team.
What is an Unmanaged Personal Account (Adobe ID)?
An Unmanaged Personal Account (Adobe ID) is an Adobe account (adobe.com and other associated websites/platforms), that belongs to an end-user regardless of their email domain or affiliation with any organization. This type of account utilizes a simple email address and password combination that is not tied to any organization's Single Sign-On portal.
Although VCU end-users may have an Adobe ID account associated with their VCU email address (vcu.edu, apps.vcu.edu, mymail.vcu.edu, or alumni.vcu.edu), with exception of VCU Qatar end-users under a separate Adobe Enterprise Term License Agreement (ETLA), ALL Adobe ID accounts for end-users in the North American region are considered unmanaged accounts that belong to the end-user.
Account Type Comparison Table
| Account Type | Account Creation | Account Ownership | Account Email Address | Account Support |
|---|---|---|---|---|
| Managed Enterprise Account (Federated ID) | Organization (VCU) | Organization (VCU) | Only @vcu.edu email addresses | Supported by VCU & Adobe |
| Unmanaged Personal Account (Adobe ID) | End-User | End-User | Must change to non-VCU email address after June 1st, 2024 | Only supported by Adobe |
Frequently Asked Questions
Below is a list of frequently asked questions about the Adobe Domain Enforcement policy at VCU that pertain to ALL VCU students and employees (including affiliates).
This change is being made for several reasons outlined below, however, it is important to note that while this change may impact many VCU end-users, the VCU Instructional Computing Services team does not manage personal Adobe ID accounts regardless of their association with a VCU email address and does not have access to troubleshoot, view, modify/cancel, or create any personal Adobe ID account. VCU exclusively utilizes Federated IDs that work with our Single Sign-On portal, the VCU Central Authentication Service (CAS).
The current use of personal Adobe ID accounts with an email address that belongs to one of the VCU email domains (vcu.edu, mymail.vcu.edu, alumni.vcu.edu, and apps.vcu.edu) creates a confusing “dual-identity” account structure for many end-users and VCU technical support personnel. This has resulted in many VCU students and employees being unnecessarily charged (by Adobe, NOT VCU) for “retail subscriptions'' that are not part of our current Adobe ETLA (Enterprise Term License Agreement).
Under a “dual-identity” account, VCU has suffered a lack of mitigating controls to prevent access to features under either a personal Adobe ID account OR an Federated ID account tied to the same VCU email address. This creates a compliance gap whereby we cannot effectively mitigate access to some Adobe “cloud” / web resources which we do not permit end-users to utilize under the terms and conditions set forth by the Instructional Computing Services team and the VCU Information Security Office. In short, Adobe has created a loophole that results in a lack of enforcement of their own environmental settings, erring on the side that allows them to provide users with access to tools VCU cannot effectively comply with the usage of. This incongruity can only be addressed by eliminating the usage of personal Adobe ID accounts with a VCU email address.
Domain Enforcement provides a clear and easily demonstrable method by which VCU can claim numerous email domains and effectively enforce compliance with our own environmental settings that represent our commitment to complying with the Product Specific Licensing Terms (PSLT) set forth by Adobe as governed by the language within our Enterprise Term License Agreement (ETLA) as well as information security audit objectives we must comply with as a university and a Virginia state agency.
Essentially, by removing the ability to create personal Adobe IDs with a VCU email address, VCU end-users will only be permitted to utilize their VCU email address with an Federated ID account. This enables VCU to retain complete ownership of all data, assets, files, libraries, and other elements stored within any account associated with a VCU email address and effectively mitigate some of the risks associated with Adobe “cloud” / web platforms where current controls within our Adobe Admin Console are not granular enough to guarantee a sufficient reduction of risk to an acceptable level.
ALL members of the VCU community with a VCU email address belonging to the vcu.edu, mymail.vcu.edu, apps.vcu.edu, and alumni.vcu.edu domains may potentially be impacted by this change. Members who have a vcuhealth.org email address in addition to their vcu.edu address are only impacted when using their vcu.edu email account. See more details below about end-users who already have a personal Adobe ID associated with a VCU email address.
There are several changes which will take effect over the course of 1 full calendar year.
The first phase of this project, the initial domain enforcement change, takes effect on January 1st, 2024 at 12:00am Eastern Time.
The second phase of this project which will enforce that existing end-users with a personal Adobe ID associated with their vcu.edu, mymail.vcu.edu, apps.vcu.edu, and/or alumni.vcu.edu email address update their accounts to use a non-VCU email address will go into effect in June 2024.
You should use both the VCU and Adobe guides listed below for backing up your data as soon as possible.
In fact, Adobe already discontinued their file syncing services (similar to Dropbox / Google Drive) on February 1st, 2024 for personal Adobe ID accounts regardless of email domain affiliation.
While this service discontinuation won’t immediately impact VCU Federated ID accounts associated with VCU email addresses, it will impact everyone with an Adobe account of any type on October 1st, 2024 when Adobe completely discontinues the file syncing portion of their cloud storage platform.
This means the window for backing up your synced files, assets, libraries, and other data/information in your personal Adobe ID account will soon close. Any data, assets, files, and other non-cloud-based documents/libraries will no longer be synced as of October 1st, 2024.
VCU Adobe Backup/Migration Guide - https://go.vcu.edu/adobe/backup
Adobe HelpX Article - https://helpx.adobe.com/creative-cloud/help/sync-creative-cloud-files.html
VCU does not require end-users to provide credit/debit card information to access the Adobe software titles provided under our Adobe ETLA. In fact, there is only one specific use-case where VCU students and employees may even use a credit/debit card using their VCU Adobe Federated ID account which is to purchase Adobe Stock assets via stock.adobe.com, but this is not required and remains purely an optional element of our Adobe ETLA.
If you are currently being charged for access to Adobe software, it may be through a retail subscription under a personal Adobe ID that may be associated with your VCU email address. You will need to directly contact Adobe support to cancel any retail plans. The VCU Instructional Computing Services and VCU IT Support Center teams cannot assist with canceling any retail subscription associated with a personal Adobe ID.
Currently, the simplest way to determine if you may be impacted by this change is to attempt signing in to adobe.com using your vcu.edu email address (NOT your vcuhealth.org email address).Click here to see a video of how to check.
- To start, in your web browser open an Incognito Browser window for either Chrome or MS Edge (you can also use Safari or Firefox’s built-in Private Browsing) which will ignore any previous sign-in sessions for adobe.com.
- Next, browse to adobe.com and on the right top corner select “Sign In”.
- When prompted, input your vcu.edu email address and click the blue “Continue” button. IMPORTANT: Don’t use any other email address such as vcuhealth.org. ONLY use your vcu.edu email address.
If you are prompted to select an option (see screenshot below for an example), such as Personal Account or Company/School Account, you have a personal Adobe ID associated with your VCU email address that will need to be changed.
Note: The VCU Instructional Computing Services and the VCU IT Support Center teams CANNOT make changes to personal Adobe ID accounts. If you have a personal Adobe ID, it is YOUR responsibility to take action and update YOUR account to a non-VCU email address as soon as possible.
Currently, we do not have good visibility into which users have personal Adobe ID accounts and those formerly associated with former Adobe VIP/Teams plans which were purchased many years ago and are now considered inactive. At one time, there were over 70+ individual Adobe VIP/Teams plans across dozens of business units at VCU prior to June 2019. Our visibility into this history only extends so far, and our resources to investigate beyond this date are extremely limited.
Right now we have a list of approximately 34,000 end-users and we will be setting up a form for end-users to check whether they have a personal Adobe ID or not by simply logging into their VCU Google Workspace account using their vcu.edu email address.
In the meantime and until that form is ready, if the process above (see Q6) doesn’t provide you the answer you’re looking for or if you just want to be sure, please email us at adobe@vcu.edu or submit a ticket at https://itsupport.vcu.edu under the Teaching & Learning > Instructional Resources > Adobe Software category and we may be able to verify from our existing list of end-users whether you have a personal Adobe ID associated with your VCU email address.
Disclaimer: Any answer provided by the VCU Instructional Computing Services team or any member of VCU Technology Services should not be taken as a definitive answer. Ultimately, no one at VCU is responsible in any way for the management, maintenance, or support of your personal Adobe ID account except each individual end-user. If you do have a personal Adobe ID account, it is considered an individual end-user responsibility to determine whether you will be impacted by this change and to take the appropriate actions as we’ve recommended in this document (see Q4).
As of December 2023, there are approximately 34,000 end-users at VCU who have a personal Adobe ID account associated with their VCU email address on the vcu.edu and mymail.vcu.edu domains. Most are users who have manually created their own accounts while some are end-users who had an Adobe ID created under an older VIP (Value Incentive Plan) or other retail subscription through Adobe.com.
Unfortunately, with the very limited details Adobe has provided, we cannot determine whether a personal Adobe ID account was created under a VIP/Teams account or by an end-user. At this point, VCU has had an ETLA for over 4.5 years (since June 2019) which has allowed an unprecedented level of access to a variety of users generating enormous cost-savings for end-users across the university. Any remaining users from non-enterprise Adobe subscription plans (either monthly or annual) should be inactive.
Aside from end-users on the VCU Qatar Campus, none of these accounts are currently under the purview for management of access, data storage/sharing, or security (password complexity/multi-factor authentication requirements) of VCU. However, as we begin to clean up our Adobe environment, these accounts will eventually need to be updated to a non-VCU email address. The enforcement for changing email addresses for personal Adobe ID accounts will not go into effect until June 2024.
No. Exception requests will not be considered for any reason including discounts offered by Adobe. Adobe has not presented a way for us to better handle the “dual-identity” scenario aside from enforcing the usage of our email domain to only Federated ID accounts.
While this change will provide several months of “grace period” before we begin requiring users update their personal Adobe ID account to use a non-VCU email address, unfortunately this is not something we can continue supporting in our environment given the number of users reaching out to us confused about why they continue to be charged for retail subscriptions they may have purchased in error.
To be clear, at this time the only legitimate reason someone should have an Adobe ID associated with their VCU email address is because they are a currently-enrolled student and/or active employee of the VCU Qatar campus. Beyond this, exceptions will not be made or considered for any reason.
As of September 2023, VCU Technology Services began working with the Adobe administrators of the VCU Qatar campus to establish a plan of action to transition active VCU Qatar campus users with an Adobe ID associated with their Adobe ETLA (Enterprise Term License Agreement) to the Federated ID identity type.
More information will be provided to these users in the near future around what that transition process will look like and what impacts it may have on users who move between campuses either temporarily or permanently.
Absolutely not. Your team will be impacted and will need to move to our university-supported licensing program for Adobe software under the VCU Adobe Central Software License Agreement. You and/or your department may also be paying considerably more for the same software. Please schedule a consultation (https://go.vcu.edu/adobe/consultation) with us as soon as possible so we can help you set up a transition plan.
No. While we cannot prevent end-users from purchasing software using their own personal credit/debit card, once the second phase of this project for domain enforcement is implemented, you cannot continue using your personal Adobe ID account with your VCU email address and you will be required to update the email address for your account to a non-VCU email address.
If you are a current VCU student currently enrolled in at least one credit-bearing course, you get access to Adobe Creative Cloud as part of the VCU Student Software Bundle at no additional cost (included in your Student Technology Fee). Unless you recently graduated or are no longer taking classes at VCU, there is no legitimate reason you need to purchase a retail subscription for the Adobe Creative Cloud suite, even at a discounted rate for Students/Teachers.
If you or your departmental fiscal administrator are using a VCU P-card chances are, you are likely paying considerably more for the same software VCU has already procured. You and/or your employees under retail subscription licensing may also be directly violating several university policies surrounding the use of cloud data storage for VCU data as classified under the Data Security Standards. If your department is refusing to cover the cost of an Adobe software license under the VCU Adobe Central Software License Agreement, please reach out to us at adobe@vcu.edu.
Frequently Asked Questions for VCU Health Employees
Below are additional questions that pertain only to VCU Health employees who may be affiliated with a VCU Academic/Business unit and/or who may be currently-enrolled in at least one credit-bearing course as a VCU student.
Q13. I am a VCU Health (hospital) employee. Does this change impact me?
Possibly. If you are a VCU Health employee and you are/were also a VCU student, employee, and/or affiliate now or any time in the past, you may have a personal Adobe ID. If you receive a notice from us to change the email address of your Adobe ID account, please do so as soon as possible to avoid losing access to this account and any data, files, assets, or other information stored within the account.
Q14. I am a VCU Health (hospital) employee using a personal Adobe ID with my vcuhealth.org email address. Does this change impact me or my coworkers who are also assigned a license from VCU Health using our vcuhealth.org emails?
No. This change does not directly impact users who are assigned an Adobe software license who have a personal Adobe ID account associated with the vcuhealth.org email domain.
However, you may not realize you also have a VCU Federated ID account if you are also a currently-enrolled VCU student (part-time or full-time) and/or employee, affiliate, resident/fellow, or otherwise considered to have a business relationship affiliation with the academic side of VCU (the non-VCU health/hospital side) such as the Schools of Medicine, Dentistry, Pharmacy, Nursing, the College of Health Professions, the Massey Comprehensive Cancer Center, the Office of the Senior Vice President for Health Sciences (OSVPHS), or the VCU Office of the Vice President for Research Innovation (OVPRI). If you’re unsure, please reach out to us at adobe@vcu.edu.