Managing user permissions efficiently is critical in large-scale Adobe Experience Manager (AEM) environments, especially when integrated with Adobe’s
This guide walks you through the end-to-end setup — from creating an IMS group in Adobe Admin Console to syncing and mapping it in AEM Cloud environments.
Step 1: Understand How IMS and AEM Permissions Work Together
Before diving into setup, let’s clarify the relationship:
- Adobe IMS (Identity Management System): Centralized user/group management for Adobe solutions, including AEM as a Cloud Service.
- AEM Cloud Service: Uses IMS authentication — meaning users log in with their Adobe ID and their roles/permissions are derived from IMS groups.
When an IMS group is synced with AEM:
- A corresponding group is auto-created in AEM (prefixed by
ims:). - You can then map that IMS group to AEM groups or permissions.
This ensures that when a new user is added to the IMS group, they automatically get the same permissions in AEM across all environments.
Step 2: Create an IMS Group for Content Authors
- Log in to the Adobe Admin Console.
- Navigate to your AEM Product Configuration:
- Select the specific Environment or Program (e.g., “Marketing Sites” or “Corporate Portal”).
- Under Product Profiles, click New Profile or select an existing one.
- Create a new IMS group for content authors, for example:
aem-authors-marketing - Assign relevant permissions and entitlements:
- Access to AEM environments (Dev, Stage, Prod).
- Permissions for Assets, Sites, or Forms as needed.
Notes: Follow a naming convention like aem-[role]-[project] (e.g., aem-author-corporate, aem-admin-commerce) to maintain clarity across multiple AEM programs.
Step 3: Assign Users to the IMS Group
Once your IMS group exists:
- Go to Users in the Adobe Admin Console.
- Add users or bulk import them.
- Assign them to the IMS group you just created.
These users will inherit permissions as soon as they log into AEM environments tied to that IMS group.
Step 4: Sync IMS Groups with AEM Environments
Adobe automatically syncs IMS groups with all linked AEM environments — Dev, Stage, and Prod — under the same Cloud Manager program.
Verify the Sync:
- Log in to your AEM Author instance (e.g., Dev).
- Go to:
Tools → Security → Groups - Search for the group with prefix
ims:(e.g.,ims:aem-authors-marketing). - You’ll see the group auto-created by the IMS sync process.
Flow Diagram: IMS Group to AEM Sync
Diagram: How Adobe IMS groups map and sync across AEM Dev, Stage, and Prod environments.
Step 5: Map IMS Groups to AEM Local Groups or Roles
IMS groups define who can log in; AEM groups define what they can do.
- Go to AEM Author → Tools → Security → Groups.
- Open your IMS group (e.g.,
ims:aem-authors-marketing). - Add this group as a member of local AEM groups such as:
- Save changes.
Step 6: Ensure Consistency Across Environments
AEM Cloud Service automatically syncs IMS groups across environments. However, ensure that local AEM group mappings are consistent.
- Use Cloud Manager pipelines or configuration sync tools to promote security configurations.
- Optionally automate mappings with Repository Initialization (Repo Init) scripts:
Sample Repository Initialization (Repo Init) script
create group aem-authors add "ims:aem-authors-marketing" to group aem-authors
Step 7: Test the Setup
- Log in as a test user from the IMS group.
- Verify access to AEM Author UI.
- Confirm:
- Can they open and edit pages/assets?
- Are permissions consistent across environments?
- Does removal from IMS revoke access?
Summary
| Step | Action | Outcome |
|---|---|---|
| 1 | Create IMS group | Centralized author group in Admin Console |
| 2 | Assign users | Access managed via Adobe ID |
| 3 | Sync with AEM | Auto-created in all environments |
| 4 | Map to AEM groups | Permissions applied correctly |
| 5 | Validate & Test | Consistent access across Dev, Stage, Prod |
Final Thoughts
Using Adobe IMS groups to manage AEM permissions is a best practice that enhances security, scalability, and ease of management. By configuring groups once in IMS and mapping them in AEM, you can ensure consistent authoring permissions across Dev, Stage, and Production — saving time and preventing access drift.
SEO Metadata
SEO Title: How to Set Up Adobe IMS Groups for AEM Permissions Across Environments
Meta Description: Learn step-by-step how to create Adobe IMS groups, assign permissions, and sync them across AEM Dev, Stage, and Prod environments for secure and consistent author access.
Tags: AEM, Adobe IMS, Adobe Admin Console, AEM Cloud Service, AEM Permissions, AEM Security, AEM Author Roles, DevOps, Cloud Manager
