Adobe's Teams plan has no SCIM, so offboarding is manual. Here's how to automate Adobe Admin Console deprovisioning with browser automation and signed evidence.
TL;DR
- Adobe's Teams plan has no SCIM at all, so when someone leaves, their Adobe access is removed by hand or not at all. Most 100–500-employee companies are on Teams.
- Adobe SCIM exists only on Enterprise, syncs only from Microsoft Entra or Google Workspace (not Okta), and doesn't even assign licenses — so license cleanup stays manual regardless.
- Browser automation is the practical fix: it drives the Admin Console the way an admin would, with a signed evidence record per action.
- KINT deprovisions Adobe in about 5 seconds per seat, captures a screenshot per product removal, signs it with Ed25519, and maps it to SOC 2 CC6.3.
- It runs inside the joiner-mover-leaver workflow, so Adobe is revoked in parallel with the user's other apps.
The problem: Adobe offboarding is manual at most companies
When an employee leaves, you want their Adobe Creative Cloud and Acrobat access gone the same day — both for security and because every assigned product is a license you're still paying for. For most mid-market companies, that doesn't happen automatically, and the reason is a plan-tier gap, not negligence.
Adobe gates automated provisioning behind its Enterprise plan. On the Teams plan — which most 100–500-employee companies use — there is no SCIM provisioning endpoint at all. So your IdP can't push a deprovision to Adobe, your lifecycle tool can't route one over SCIM, and the leaver's Adobe seat stays assigned until an admin logs in and removes it by hand.
It gets worse on closer inspection. Even on Adobe Enterprise, SCIM only syncs from Microsoft Entra or Google Workspace (Okta isn't supported natively), and SCIM handles user create and remove but does not assign or unassign licenses. So even the companies paying for Enterprise still face manual license cleanup. Adobe is the textbook non-SCIM offboarding problem.
This is one slice of a bigger pattern: roughly 40% of mid-market apps don't support SCIM at their plan tier, and Adobe is among the most common offenders because Creative Cloud is nearly everywhere.
The manual process (for reference)
Here's what an admin does by hand for every leaver with Adobe access:
- Sign in to the Adobe Admin Console.
- Go to Users.
- Find the departing user.
- Open their profile and remove them from each assigned product — Acrobat, Photoshop, Illustrator, whatever's assigned.
- Confirm each license is freed so it returns to your available pool.
- Record what was done, when, and by whom — for the audit trail.
It's a few minutes per user, it's easy to forget on a busy Friday, and step 6 is the one that gets skipped. Multiply by your annual leavers and it's both a recurring time cost and a recurring audit gap.
The automated process: browser automation
Since Adobe gives the Teams plan no API to call, the way to automate is to drive the Admin Console itself — deterministically, at machine speed, with evidence captured at every step. That's browser automation (how browser automation works across your stack).
How KINT does it
When a leaver event fires from your HR system (BambooHR, Workday, Rippling, Keka, Greythr, or a CSV) or your IdP:
- KINT opens the Adobe Admin Console headlessly using stored credentials (held in a secrets store, never plaintext in a script).
- It navigates to Users and locates the account.
- It removes the user from each licensed product — the same clicks an admin would make.
- It captures a screenshot per product removal.
- It signs each record with Ed25519, timestamps it, and maps it to SOC 2 CC6.3.
- The Adobe evidence is appended to the same signed packet as the user's other apps.
Total: about 5 seconds per Adobe seat. And because it runs inside the wider leaver workflow, Adobe is revoked in parallel with GitHub, Slack, and everything else — not as a separate manual chore.
What makes it audit-grade, not just a script
The difference between a brittle macro and governed automation is the evidence and the failure behaviour:
- Per-action evidence, signed. A screenshot of each product removal, signed with Ed25519 — not a log line that says "removed." That's what a SOC 2 auditor accepts for CC6.3.
- Idempotent. If the flow runs twice, it sees the user is already removed and logs "already completed" instead of erroring.
- Fail-closed. If Adobe changes the console UI and a step can't complete, the workflow alerts IT and waits, rather than silently reporting success.
Manual vs automated, side by side
| Manual (Adobe Admin Console) | Browser automation (KINT) | |
|---|---|---|
| Trigger | Someone remembers after the HR email | HR leaver event, automatically |
| Time per seat | A few minutes of clicking | ~5 seconds |
| License cleanup | Manual, easy to miss | Removed from each product, freed automatically |
| Evidence | A note in a ticket, if anyone writes it | Signed screenshot per action, mapped to CC6.3 |
| Runs with other apps | No — separate task | Yes — in parallel within the leaver workflow |
| Plan required | Works on Teams (manually) | Works on Teams (no Adobe Enterprise needed) |
The last row is the point: browser automation gives you automated, evidenced Adobe deprovisioning on the Teams plan, so you don't pay the SCIM tax of upgrading to Adobe Enterprise just to turn accounts off.
KINT's current state for Adobe (honest, June 2026)
Adobe Admin Console is KINT's first fully live browser-automation integration — deprovisioning, signed evidence, ~5 seconds per seat, in production today. Other non-SCIM apps (Figma, Canva, Notion, Loom, Miro) are in progress, not live; /connectors is the source of truth for status. KINT has zero paying customers so far and is hunting design partners — the Adobe flow is a real capability you can run in a trial, not a customer outcome we're claiming.
Browser automation is on the Growth plan ($5/employee/month) for up to 5 apps. Pricing is published at /pricing.
FAQ
Does Adobe Admin Console support SCIM provisioning?
Only on the Enterprise plan, and only syncing from Microsoft Entra or Google Workspace — not Okta. Adobe's Teams plan has no SCIM at all. And even on Enterprise, SCIM handles user create and remove but doesn't assign or unassign licenses, so license cleanup still needs another path. Most 100–500-employee companies are on Teams, where automated deprovisioning requires browser automation or manual work.
How do you remove a user from Adobe Admin Console?
Manually: sign in, go to Users, select the person, remove them from each assigned product, and confirm the license is freed. Automatically: a browser-automation tool drives those same steps when a leaver event fires. KINT does it in about 5 seconds per seat and signs a screenshot of each action for audit evidence.
How long does automated Adobe deprovisioning take?
About 5 seconds per Adobe seat with KINT's browser automation, versus a few minutes of manual clicking per user. It runs as part of the wider leaver workflow, so Adobe is revoked in parallel with the user's other apps rather than as a separate manual task.
Is automated Adobe deprovisioning auditable for SOC 2?
Yes, if the evidence is signed. KINT captures a screenshot per product removal, signs it with Ed25519, timestamps it, and maps it to SOC 2 CC6.3, then exports it with the rest of the leaver's evidence packet. A console log that just says "removed" is not audit evidence; a signed, verifiable record is.
Do I need Adobe Enterprise to automate deprovisioning?
No. Browser automation works on the Teams plan, where Adobe offers no SCIM. That's the whole point — you get automated, evidenced deprovisioning without upgrading to Adobe Enterprise solely to unlock provisioning you'd then have to feed from Entra or Google anyway.
Can it handle license reassignment, not just removal?
Removal frees the license back to your pool automatically. Reassignment to a new user is a provisioning (joiner/mover) action, which the same workflow handles — so a freed Adobe seat can be picked up by the next hire who needs it, rather than sitting idle and billing.
Adobe doesn't give the Teams plan a way to automate offboarding. Browser automation does — with the signed evidence an audit needs.
See it on your Adobe seats — start free for 14 days → · Book a 15-min walkthrough
14-day trial · No card · Live in under an hour
KINT (by Kingsley Integrators) is an HR-driven identity lifecycle automation platform for companies with 100–500 employees. It automates onboarding, role changes, and offboarding across SaaS apps — including the apps without APIs, via browser automation — and produces SOC 2 CC6 audit evidence as a byproduct. Pricing is published per employee per month ($3 Starter, $5 Growth). Self-serve signup at kingsleyint.com.
Gowtham Palanisamy
Founder of Kingsley Integrators, building KINT in public. Writes about identity lifecycle, SaaS access, and audit evidence.