Restrict Adobe Creative Cloud access to a specific IP address using Conditional Access

Overview

This article walks through restricting Adobe Creative Cloud access to one or more 
approved IP addresses using Conditional Access in Microsoft Entra ID. This is commonly 
used to ensure Creative Cloud can only be accessed from a corporate network or VPN, 
preventing use from personal devices on untrusted networks.

The approach uses two components working together: 

• Named Locations: A saved list of trusted IP addresses or CIDR ranges defined in 
Entra ID.

• Conditional Access policy: A policy that blocks Adobe Creative Cloud sign-ins 
originating from any IP not on the trusted list.

Important: Adobe Creative Cloud's desktop application users an embedded browser for sign-in that does not pass device identity to Entra ID by default. If your policy also requires devicecomplaince, you must deply the iAcroLoginType registry fix described in the Adobe Creative Cloud SSO KB. For IP-only restrictions, this registry fix is not required.

Please Note: This configuration requires Adobe Creative Cloud to be integrated with Microsoft Entra ID via SAML SSO. If SSO is not yet configured, complete that 
setup first before proceeding with this guide. Refer to the Adobe Creative 
Cloud SSO KB article for setup instructions.

Prerequisites

Before proceeding, confirm the following are in place:

• Microsoft Entra ID P1 or P2 license - required for Conditional Access.
• Conditional Access Administrator role or higher in Microsoft Entra ID.
• Adobe Identity Management (SAML) enterprise app registered in your Entra ID tenant with SSO configured.
• Security Defaults Disabled in Entra ID - Security Defaults and Conditional Access cannot run simultaneously.
• Known static IP address -  the public IP address or CIDR range of each approved location.
• Break-glass admin account -  must be excluded from this policy to prevent administrative lockout.

Important:  If your approved IP address is dynamic, this approach will not work reliably. You must use a static IP before implementing IP-based Conditional Access.

Step 1: Create a Named Location for Your Trusted IP(s)

A Named Location defines the trusted IP addresses that Entra ID will reference as a condition in the policy.

1. Sign in to the Microsoft Entra admin center at entra.microsoft.com
2. Navigate to Protection > Conditional Access > Named locations.
3. Select + IP ranges locations.
4. Name the location. For example: Trusted - Corporate Office
5. Check the Mark as trusted location checkbox.
6. Click + and enter your approved IP address or CIDR range. 

7.  Click Create.

Step 2: Create the Conditional Access Policy

Create a policy that blocks access to Adobe Creative Cloud from any location not on your trusted list.

1. In the Entra admin center, navigate to Protection > Conditional Access > Policies.
2. Select + New policy.
3. Name the policy. For example, Block Adobe CC - Outside Trusted IPs

Assignments: Users

1. Under Assignments > Users, select All users.
2. Under Exclude, add your break-glass admin account.

Assignments: Target Resources

1. Under Target Resources, select Cloud apps > Select apps.
2. Search for and select Adobe Identity Management (SAML).

Conditions: Locations

1. Under Conditions > Locations, set Configure to Yes.
2. Under Include, select Any location.
3. Under Exclude, select Selected locations, then choose the Named Location you created in Step 1.

Tip: This configuration reads: Apply this policy to sign-ins from any location except the trusted named location. Any Adobe Creative Cloud sign-in originating outside the trusted IP will be subject to the Block access grant control below.

Access Controls: Grant

1. Under Access Controls > Grant, select Block access.
2. Click Select to confirm.

Enable Policy

1. Set Enable policy to Report-only.
2. Click Create.

Important: Do not set this policy to On immediately. A block policy applied to All users that is misconfigured will lock all users out of Adobe Creative Cloud instantly. Always validate in Report-only mode first.

Step 3: Validate the Policy

Before enabling enforcement, confirm the policy is evaluating sign-ins correctly.

1. In the Entra admin center, navigate to Identity > Monitoring & health > Sign-in logs. 
2. Filter by the Adobe Identity Management (SAML) application. 
3. Open a sign-in from a user on your trusted IP and confirm the Conditional Access 
tab shows Would succeed. 
4. If available, review a sign-in from an untrusted IP and confirm it shows Would fail 
with the location condition listed as the reason. 
5. Investigate any unexpected Would fail entries for users on trusted IPs — this 
typically indicates the network is presenting a different egress IP than what is 
entered in the Named Location.

Tip:  Use the What If tool under Protection > Conditional Access to simulate how a specific user signing in from a specific IP would be evaluated without waiting for a real sign-in event.

Step 4: Enable the Policy

1. In the Entra admin center, navigate to Protection > Conditional Access > Policies.
2. Select the policy created in Step 2.
3. Change Enable policy from Report-only to On.
4. Click Save.

From this point forward, any Adobe Creative Cloud sign-in attempt from an IP address not included in your Named Location will be blocked. 

Please Note: Users who are already signed in to Adobe Creative Cloud when the policy is enabled will not be immediately signed out. The block takes effect on the next sign-in or token refresh, typically within 1 hour. 

Summary

The following table summarizes the full configuration process.