Fix Adobe Acrobat Online Login Error with Microsoft Defender for Cloud
Question details
Users experience login failures when accessing Adobe Acrobat Online through Microsoft Defender for Cloud session policies.
- Product
- Adobe Acrobat Online / Microsoft Defender
- Device & OS
- not provided
- Scenario
- Attempting to authenticate to Adobe Acrobat Online using SAML authentication redirected through the mcas.ms proxy.
- Observed behavior
- Adobe displays a 'Could not log you in' error, stating that the login appears to be an unsupported identity-provider-initiated login.
Ensure you have administrative access to your Microsoft Entra ID conditional access policies and your Defender for Cloud Apps portal to review authentication logs.
Exclude Adobe Acrobat Online from Session Control Proxy
Since Adobe does not support identity-provider-initiated logins via the mcas.ms proxy, excluding Acrobat Online from Defender for Cloud Apps session control is the recommended workaround.
Adobe's authentication service interprets the Microsoft Defender for Cloud Apps proxy redirect as an IdP-initiated login. Because this is unsupported for main Creative Cloud and Acrobat services, bypassing the proxy for this specific app prevents the error.
Log in to the Microsoft Defender portal as a security or global administrator.
Go to 'Cloud Apps' > 'Policies' and select 'Conditional Access App Control'.
Find the session policy currently routing your Adobe Acrobat Online traffic through the mcas.ms proxy.
Edit the policy to explicitly exclude Adobe Acrobat Online from the targeted applications, or change the action from 'Control' to 'Monitor only'.
Save the policy changes. Wait a few minutes for the policy to propagate, then test the Adobe Acrobat Online login to confirm the error is resolved.
Edit PDFs Offline Easily with WPS Office
If cloud-based PDF editors are causing authentication and conditional access headaches, WPS Office provides a robust, locally-installed suite that handles PDFs and Office documents flawlessly without relying on complex proxy routing.
Frequently Asked Questions
Why does Adobe Acrobat Online show an 'unsupported identity-provider-initiated login' error?
This error occurs because Microsoft Defender for Cloud routes traffic through its mcas.ms proxy for session control. Adobe's authentication service misinterprets this proxy redirect as an IdP-initiated login, which it currently does not support.
Can I use SAML authentication with Adobe Acrobat without Microsoft Defender for Cloud Apps?
Yes, standard SAML authentication directly between your Identity Provider (like Microsoft Entra ID) and Adobe works perfectly. The login failure only arises when the session is intercepted and proxied by Defender for Cloud Apps.
Will Adobe fix this proxy compatibility issue?
Adobe generally restricts IdP-initiated logins for security reasons across its Creative Cloud and Acrobat services. You should regularly check the official Adobe enterprise deployment release notes for any updates on third-party proxy compatibility.
