The Community is now in read-only mode to prepare for the launch of the new Flexera Community. During this time, you will be unable to register, log in, or access customer resources. Click here for more information.

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
  • Owner: Nicolas Rousseau
  • Owner Email Address: nrousseau@flexera.com
  • Solution Type: Custom Inventory Import & Custom SQL Reports
  • Flexera Product & Version: FNMS 2016+
  • Environment: On Prem Only
  • Development Effort (Days): 3
  • Implementation Effort (Days): 0.1
  • Disclaimer:

SOLUTIONS ARE PROVIDED ON AN "AS IS" BASIS. NEITHER FLEXERA NOR ITS SUPPLIERS MAKE ANY WARRANTIES, EXPRESS OR IMPLIED, STATUTORY OR OTHERWISE, INCLUDING BUT NOT LIMITED TO WARRANTIES OF MERCHANTABILITY, TITLE, FITNESS FOR A PARTICULAR PURPOSE OR NONINFRINGEMENT. LICENSEE MAY HAVE OTHER STATUTORY RIGHTS. HOWEVER, TO THE FULL EXTENT PERMITTED BY LAW, THE DURATION OF STATUTORILY REQUIRED WARRANTIES, IF ANY, WILL BE LIMITED TO THE SHORTER OF (I) THE STATUTORILY REQUIRED PERIOD OR (II) THIRTY (30) DAYS FROM LICENSEE’S ACCEPTANCE OF THE AGREEMENT.

 

The report described below (code embedded in the Word document below) analyzes, user per user, the subscribed plans, the installed applications, the used applications, the costs of current license and gives the recommendations and calculates the possible financial optimization.

Business need and approach

There are two challenges with Adobe:

  • This is a subscription-based licensing.
    • So, you need to integrate data from the Adobe Portal (directly from the portal through WebService integration or through an excel export or finally through Active Directory groups imports)
  • There is a bundle and standalone applications. With 3 or more standalone applications, the bundle is cheaper. There could be case where both bundle and standalone licenses have been subscribed.
  • FlexNet Manager can Manage the Creative Cloud Suite as a “Suite” application:
    • The standalone applications are deleted and replaced by the “Suite” application. This is not the case in the latest versions. The goal is to avoid double license consumptions. This has the downside of “hiding” the real components.
    • A side effect of the Suite recognition is that standalone is that the last used date is the latest use date of one of the components. If Illustrator, Acrobat and InDesign are installed, InDesign and Illustrator have never been used but Acrobat has been used yesterday, the Creative Cloud Suite installation will show a last used date of yesterday.
    • FNMS supports now bundled licenses and having individual standalone products recognized is no longer an issue.
    • You can deactivate the Suite recognition (recommended) with forcing the number of needed standalone components to be the max (20 for instance) to recognize the Suite in the evidence/Suite and member section of the application (see screenshot below).

The report below answers the simple but hard to answer question: “Is it worth licensing the Suite on this computer?”

The report assumes the usage information (coming from SCCM of FlexNet Manager) is reliable. The quality of usage must be carefully assessed, and best practice is to check with the application user if he confirmed he does not use it before uninstalling it.

Adobe Subscriptions importer

The first attached document gives an example of PowerShell that collects the Adobe Portal Information.

To implement this reader, you need PowerShell skill and admin role on the portal (to generate the certificate).

The document describes then a classical Business Adapter (On the beacon UI for instance) that can allocate users from the CSV file, using the "data transformation" feature of the Business Adapter.

Note that if you have an integration between your Azure Active Directory and the Adobe Portal, you will just need to manage AD groups that will map with the Adobe CC subscriptions.

BeaconADImports.png

You need in the filter to restrict on a group using "MemberOf", one example below. The grammar is cryptic but your AD admins should be able to help you. You filter on 1 group and multiple domains for instance. I was not able to filter on multiple groups using wildcards (Acrobat%)... so, you need as many Business Adapters as groups.
(&(objectCategory=user)(!cn=CHILD$)(memberof=CN=DG_Adobe_AcrobatPro-Users,OU=GRP,OU=Global,OU=PRD,DC=net,DC=fr,DC=ch))

LDAP Query Detail.png

The logs will appear in the FNMS UI

ADImportsLogs.png

Don't forget, like when using the PowerShell import approach, to use the "detach unfound computers from considered software allocations to make sure that if a subscription is no longer in the Portal, le allocation will be deleted in FNMS. 

Don't forget to AllocationCreation.png

Preview

Adobe Optimization.png

Report details

Please notice that it is recommended to “de-activate” the Suite recognition for better transparency of the data usage. If suites are recognized, the report will provide the needed transparency, but performance of the report will be impacted (re-constructing usage for each standalone component requires queries in very large evidence and usage tables).

The report focuses on Adobe products but could easily be adapted to other vendors / applications (Example on Microsoft below)

  • It lists all adobe applications installed on computers…
    • When the standalone product was installed, it shows it
    • When the suite has been recognized, it will show the initial components, as well as the recognized suite (that deleted it)
  • It also catches usage information that turned into Named User license consumption.
  • It “constructs” installations and last used date for applications managed as a suite. Note that this step impacts performance quite massively. If you de-activate the Adobe Suites, the report will no longer need to compute last used dates.
    • It catches from installer and file evidence usage the usage reported with the following details:
      • The last used date
      • The number of evidence reporting usage for the devices (two different files could for instance report usage and be linked to an application)
      • The number of sessions. Here, we need to be careful, the number may depend on the length of the measurement period. Usage records have a start date, the number of sessions may vary withing these periods. The report sums all sessions (eventually from multiple files and installer evidences) that have happened in the last three month (Start date is less than 90 days in the past).
    • It builds usage for the component (mast recent las used date from file and installer usage)
  • Once installations and consuming usage have been identified, it groups the information by user & consumed license.
    • If a user for instance consumes a Creative Cloud license because of 4 installed applications on 2 computers, the report will show 1 row for the user, but will provide on the consuming applications.
    • If installations are not consuming licenses, the report will show one row per installed unlicensed application and user
  • It analysis for the users / installed applications the following data items
    • List and number of installed applications consuming the license
    • Number of used applications consuming the license
    • Number of Product covered by the license
    • Number of installed Products consuming the license
    • Number of used products consuming the license
  • With all this information the reports will compute recommendations that can be tuned in the section after“--Add the recommendations now” (Line 945)
    • Priority 1: This user has an active Adobe CC subscription, at least one active computer no related installed application. Please stop subscription.
      • An active subscription will create a line in the report… if a computer at least is inventoried for the user and no installation
    • Priority 1: Downgrade user plan to standalone products (based on installed products)
      • There are less than 3 stand alone products installed. You can safely downgrade the subscription
    • Priority 1: This user has Adobe CC for Complete AND at least one other standalone product subscription (can be added to another recommendation).
      • This is an easy double subscription case.
    • Priority 2: Downgrade user plan to standalone products (based on used products)
      • Here, less than 3 products are really used. Check usage quality before doing any change.
    • Priority 2: Uninstall the product and stop the Standalone subscription (Based on usage)
      • This was a standalone subscription, product is installed, but the product is not used.
    • Priority 2: Uninstall the product and stop the CC Complete subscription (Based on usage)
    • Priority 2: This user has commercial applications not covered by a license
      • This comment is added when an unlicensed Abobe commercial installation is on a computer. Note that with the new Adobe Portal functionality, an installed application cannot be used if the subscription is not active. It may not be a problem.
      • This was the Suite subscription, products are installed, but not used.
    • Priority 3: This user has an active Adobe CC subscription, no known computer (and no related installed application). Please stop subscription or check if inventory is exhaustive
  • The reports analysis the installed and used applications for users with active subscriptions and makes a financial analysis of the potential saving. Note that the subscription cost is either inherited from the latest software or subscription purchase linked to the consumed license or from the “Overridden” price that you can set on a license (Purchase tab).

List of columns

  • ComputerUserName
  • Email,
  • InstalledComputer(s),
  • Last Inventory Date for Computer(s),
  • LicenseName
  • LicenseCost
  • OptimalLicenseCost
  • OptimizationForUser
  • TotalOptimization
  • LicenseType
  • Recommendation
  • ListOfActiveCCSubscriptions
  • Location,
  • Coporate Unit,
  • Cost Center,
  • Installed Applications For User Consuming The License,
  • Used Applications For User Consuming The License,
  • NumberOfProductsCoveredByTheLicense,
  • NumberOfProductsInstalledForTheUserConsumingLicense,
  • NumberOfProductsUsedForTheUserConsumingLicense
100% helpful (3/3)
Comments
pavol_holes
By
Level 6

Hi Nicolas,

thanks for the KB. I have one question which we'll need to solve before diving into Adobe reporting from FNMS. You mentioned:

So, you need to integrate data from the Adobe Portal (directly from the portal through WebService integration or through an excel export or finally through Active Directory groups imports)

Is this something already done by Flexera what we can use? I mean data extractor from the Adobe Portal to FNMS through API.

Thank you!

Regards,

Pavol

kclausen
By
Flexera Alumni

@pavol_holes  - Integration to the Adobe Cloud Portal directly from FNMS is not a feature that FNMS has.  If you have FNMS, you have 2 options:
1) Log into your Adobe Cloud Portal as the Admin, and then download your current Subscriptions and User Assignments as CSV and then create a Business Adapter to Allocate these users to the corresponding license within FNMS
2) Create your own PowerShell script that connects to the Adobe Cloud API to pull down your subscriptions and user assignments and output to CSV, and then use a Business Adapter to allocate these users to the corresponding license within FNMS

Outside of FNMS, the Flexera SaaS Manager application does have a built-in Adobe Cloud connection, and you can then integration SaaS Manager with FNMS to create the licenses and user assignments within FNMS automatically.

pavol_holes
By
Level 6

Thanks @kclausen for info. I understand.

Regards,

Pavol

nrousseau1
By Level 10 Champion
Level 10 Champion

Hello @pavol_holes , @kclausen , here is a PowerShell sample in production with several customers.  The doc will maybe be extended...

I just extended the article with  solutions to import the users subscriptions, either for the Adobe Portal, or from the Active Directory groups if you have an integration between you Azure AD and the Adobe Portal.

Best regards,

Nicolas

INgrid
By
Level 5

When you write "Adobe Cloud Portal" or "Adobe Portal", is that the same thing as the Adobe Admin Console?

nrousseau1
By Level 10 Champion
Level 10 Champion

Hi Ingrid,

Yes, you can export to Excel the list of subscriptions (that unfortunately can contain multiple subscriptions per row)... or use the PowerShell that queries the data using the web service APIs of the portal. Data formatting is better (one row per subscription) and you can automate the task.

Best regards,

Nicolas

bmaudlin
By Level 9 Champion
Level 9 Champion

Hello @nrousseau1

Is there any reason this only applies to On-Prem customers and not Cloud/Flexera One, as after having a brief read through I'm not sure this is an On-Prem feature only.

Ben

INgrid
By
Level 5

Hi @nrousseau1 ,

Yes, I already do that :). My question was about the naming. 

I use the "License Status Report" under Users in Adobe Admin Console (AAC), that way you only get one subscription per row. But I haven't automated the alignment between AAC and FNMS yet. There is usually some investigation needed for 10-20% of the mismatches at our end. 

nrousseau1
By Level 10 Champion
Level 10 Champion

Hi Ben, the Users import and allocation will work in FNMS Cloud / Flexera One... but the report, that is performing SQL queries to join data from multiple tables and "deconstruct" suites can only be implemented on prem... until it is released out of the box (Q1 2022... or Q4 even if we can make you a good surprise).

nrousseau1
By Level 10 Champion
Level 10 Champion

hello @INgrid , thanks for the hint on one row per subscriptions import... matching FNMS licenses names with Adobe plans description could be a challenge. To perform the mapping, you can you the data transformation feature in the Business Adapter that is super practical, even in the Beacon version.user mapping.jpg

INgrid
By
Level 5

Hi @nrousseau1

Right. So far I am using Excel to translate the license names, VLOOKUP and a translation table with license ID from FNMS and the respective names of the product/license

milind_teli
By
Level 3

Hi Nicolas ,

do we have any document what changes need to do in powershell adaptor you provided in order to work that at ourside.

Thanks,

Milind

markus_kuenzli
By
Level 2

In our case this is a named user licence.  How can I remove the software allocation or change the status if the user is no longer in the active directory group?

First deleting all allocation is surely not the best solution.

Thanks,
Markus

kclausen
By
Flexera Alumni

@markus_kuenzli - The best and most cost efficient way to resolve your situation is to go to the Adobe Cloud Portal and remove that user as an active subscriber to the Adobe Subscription.  That way, you are not paying for an employee who is no longer with the company, and the next time you run the Adapter and pull users via the Adobe API and allocate users to your License, that user will be removed.

nrousseau1
By Level 10 Champion
Level 10 Champion

Hello @milind_teli and hello to those who struggled with the certificate generation. I got more detailed instructions on who to generate the certificate that should hopefully solde your issues. I just uploaded v1 of the document that contains the additional steps.

Best regards and sorry for the pain... any feedback is welcome.

Thanks,

Nicolas

kstaude
By
Level 4

Any reason this isn't built into the product or mostly due to try and not compete with SaaS Manager? 

nrousseau1
By Level 10 Champion
Level 10 Champion

Hello @kstaude,

Thanks for submitting this comment.

The moving forward strategy is that SaaS Manager is the SaaS application inventory tool and ITAM / FNMS uses the data for computing consumption and optimization, particularly in Hybrid use case (Microsoft 365) and On Prem (for Adobe, 100% in on premise).

Our roadmap efforts will be more focused in making FSM collecting more data, FSM to ITAM integration more performant (automated creation of licenses (include SKUs for Adobe licenses)), better support compliance and optimization in ITAM (Adobe Optimization report in ITAM in Q2), than productize integrations from the beacon that indeed overlap with what FSM (that is now part of ITAM Standard) does.

That said, custom inventory solutions like this one should work nicely, with limited implementation efforts. Please let me know if you face challenges.

Best regards,

Nicolas

ms_rajan
By
Level 2

Hi @nrousseau1 / @kstaude ,

Do we have an updated script for the integration as Adobe has deprecated the JWT Credentials method and support O-Auth Server-to-Server credentials only?

Version history
Last update:
‎Feb 04, 2022 06:05 AM
Updated by: