Adobe Creative Cloud Apps

How to deploy Adobe apps (Creative Cloud) to macOS devices via Relution and keep them up to date with the Remote Update Manager.

Adobe apps cannot be installed like a classic native app through Relution. The reason: Adobe packages are not simple silent installers – during installation they start their own background processes (Creative Cloud Desktop / HyperDrive). These do not run reliably in the restricted context of the native MDM command – the PKG upload succeeds, but the installation hangs or fails.

The installation is therefore performed via a script (macOS Companion). Updates are managed centrally through the Remote Update Manager.

Why a script is needed

Installation: installer -pkg … -target / runs in full root context, exactly as documented by Adobe. The signed-in user does not need administrator rights.
No file push: The macOS Companion does not deliver a file. The PKG must therefore be obtained (downloaded) over the network.
Updates: In the managed package, auto-update for end users is disabled. Updates are performed via a recurring update script that calls the Remote Update Manager (RUM).

Create the package in the Admin Console

After signing in to the Adobe Admin Console →, the Packages area is opened.
A Managed Package is created, with all apps selected that are to be installed on the devices – multiple apps (e.g. Photoshop, Illustrator, Acrobat) are bundled into one PKG.
In the management options, Remote Update Manager (RUM) is enabled. This ships the RUM binary with the PKG to the devices, so it is available for updates later.
The finished package is then downloaded. The installer is located in the package folder under Build/<PackageName>_Install.pkg.

Note on splitting: If all users receive the same set of apps, one combined package is sufficient. If different groups need different apps, a separate package is created per app or bundle and assigned to the respective device group. The update script (see below) remains the same in both cases.

Deploying the PKG

Since the Companion does not deliver a file, the PKG must be hosted at a network-reachable location from which the script downloads it – e.g. an internal web server or cloud storage.

Important: A permanent storage location is required. The download link from the Adobe Admin Console is temporary and session-bound and is not suitable as a fixed source. The package is downloaded once and hosted on internal infrastructure. The file name must also contain no spaces.

Automation scripts

Prerequisite: The macOS Companion is switched on under Settings → Relution Client Apps via Enable macOS companion. The Companion is not deployed on devices running a macOS version lower than 12 or on user-enrolled devices; this procedure cannot be used there.

The rollout consists of a one-time initial installation and a recurring update. Both scripts are created under Scripts → Scripts via Add script as shell scripts for macOS and are executed on the device by the macOS Companion:

Initial installation: The script is started once via the Execute shell script action on the device or device group, alternatively via Execute on device in the script list (see Overview of actions →).
Update: In a macOS policy, the Script configuration is added and the update script is selected. In the Time based execution section, the weekdays (Repeats on) and the Start time are defined (see Overview of configurations →).

In addition to the log file on the device, the execution state as well as the result and error output of each run can be viewed in the history of the respective script under Scripts → Scripts.

Initial installation (recommended)

Adobe packages are often several gigabytes in size. A direct download within a Relution script can exceed the script timeout and is then aborted. The timeout is set on the script in the Timeout (in minutes) field (default 5, maximum 30 minutes). The following script avoids this: it installs a LaunchDaemon that performs the download, installation and first update run decoupled in the background. The Relution script itself finishes within seconds.

Per package, only PKG_URL and APP_LABEL need to be set.

Show full configuration example

#!/bin/bash
#
# Adobe Managed Deployment – JOB 1: Initial installation
# Run via the Relution macOS Companion.

set -e

# --- Configuration (adjust per package) ---
PKG_URL="https://your-share.example/Photoshop_Install.pkg"
APP_LABEL="photoshop"   # only for log/daemon name

LABEL="io.relution.adobe.${APP_LABEL}"
WORKER="/usr/local/relution/${LABEL}.sh"
PLIST="/Library/LaunchDaemons/${LABEL}.plist"
LOG="/var/log/relution_adobe_deploy.log"

if [ "$(id -u)" -ne 0 ]; then
    echo "ERROR: must run as root." >&2
    exit 1
fi

mkdir -p "$(dirname "$WORKER")"

cat > "$WORKER" <<WORKEOF
#!/bin/bash
PKG_URL="${PKG_URL}"
APP_LABEL="${APP_LABEL}"
RUM_BIN="/usr/local/bin/RemoteUpdateManager"
PLIST="${PLIST}"
WORKER="${WORKER}"
LOG="${LOG}"

log() { echo "\$(date '+%Y-%m-%d %H:%M:%S') [\$APP_LABEL] \$1" | tee -a "\$LOG"; }
log "=== Initial installation started ==="

BEFORE="\$(find /Applications -maxdepth 2 -iname "Adobe*.app" 2>/dev/null | wc -l | tr -d ' ')"

TMP="\$(mktemp -d /tmp/adobe.XXXXXX)"
PKG="\$TMP/install.pkg"
log "Downloading PKG: \$PKG_URL"
if caffeinate -i curl -fL --retry 4 --retry-delay 10 -C - "\$PKG_URL" -o "\$PKG" >>"\$LOG" 2>&1; then
    log "Download ok. Installing..."
    installer -pkg "\$PKG" -target / >>"\$LOG" 2>&1 && log "installer succeeded." || log "ERROR: installer (\$?)."
else
    log "ERROR: download failed (\$?)."
fi
rm -rf "\$TMP"

if [ -x "\$RUM_BIN" ]; then
    log "Starting RemoteUpdateManager..."
    "\$RUM_BIN" --action=install >>"\$LOG" 2>&1
    log "RUM finished (RC \$?)."
else
    log "WARNING: RUM not found."
fi

AFTER="\$(find /Applications -maxdepth 2 -iname "Adobe*.app" 2>/dev/null | wc -l | tr -d ' ')"
log "Adobe apps: before \$BEFORE, after \$AFTER"
find /Applications -maxdepth 2 -iname "Adobe*.app" 2>/dev/null | while read -r a; do
    mdimport "\$a" 2>/dev/null || true
    VER="\$(defaults read "\$a/Contents/Info.plist" CFBundleShortVersionString 2>/dev/null || echo '?')"
    log "  - \$a (version \$VER)"
done

log "=== Done, cleaning up ==="
launchctl bootout system "\$PLIST" 2>/dev/null || true
rm -f "\$PLIST" "\$WORKER"
WORKEOF

chmod 700 "$WORKER"

cat > "$PLIST" <<PLISTEOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key><string>${LABEL}</string>
    <key>ProgramArguments</key>
    <array><string>/bin/bash</string><string>${WORKER}</string></array>
    <key>RunAtLoad</key><true/>
    <key>StandardErrorPath</key><string>${LOG}</string>
</dict>
</plist>
PLISTEOF

chown root:wheel "$PLIST"
chmod 644 "$PLIST"

launchctl bootout system "$PLIST" 2>/dev/null || true
launchctl bootstrap system "$PLIST"
echo "Bootstrap ok: $LABEL started."
exit 0

The result is logged to /var/log/relution_adobe_deploy.log.

Ongoing updates

This script is assigned as a Script configuration in a macOS policy and is thus executed on a recurring basis (e.g. once a week). It requires no download – the Remote Update Manager fetches the updates directly from Adobe. Without specifying products, all installed Adobe apps are updated together; a separate script per app is not needed.

#!/bin/bash
RUM_BIN="/usr/local/bin/RemoteUpdateManager"
RUM_PRODUCTS=""   # empty = all apps; otherwise SAP codes, e.g. "APRO,PHSP"
LOG="/var/log/relution_adobe_update.log"

log() { echo "$(date '+%Y-%m-%d %H:%M:%S') $1" | tee -a "$LOG"; }

if [ ! -x "$RUM_BIN" ]; then
    log "ERROR: RUM not found – is an Adobe app installed?"
    exit 2
fi

log "=== RUM update started ==="
if [ -n "$RUM_PRODUCTS" ]; then
    "$RUM_BIN" --action=install --productVersions="$RUM_PRODUCTS" >>"$LOG" 2>&1
else
    "$RUM_BIN" --action=install >>"$LOG" 2>&1
fi
log "RUM finished (RC $?)."

SAP codes for updating individual apps: APRO (Acrobat), PHSP (Photoshop), ILST (Illustrator), IDSN (InDesign), PPRO (Premiere Pro), AEFT (After Effects).

Alternative: Self-service

If users are to install their Adobe apps themselves instead of a central rollout, a Self-Service package is created in the Admin Console instead (alternatively, the options Enable self-service install and Allow non-admins to update and install apps are enabled in the package). The script then installs only the Creative Cloud Desktop app; users then select and install the actual apps themselves. This requires Named User Licensing with matching product profiles. A central update script is not needed, since updates run through the Desktop app.

Show full configuration example

#!/bin/bash
#
# Self-service – installs only the Creative Cloud Desktop app.
# The actual apps are installed by the user afterwards.

PKG_URL="https://your-share.example/CreativeCloud_Install.pkg"

if [ "$(id -u)" -ne 0 ]; then
    echo "ERROR: must run as root." >&2
    exit 1
fi

TMP="$(mktemp -d /tmp/ccda.XXXXXX)"
PKG="$TMP/install.pkg"

echo "Downloading Creative Cloud Desktop app..."
if caffeinate -i curl -fL --retry 4 --retry-delay 10 -C - "$PKG_URL" -o "$PKG"; then
    installer -pkg "$PKG" -target /
    RC=$?
else
    echo "ERROR: download failed."
    rm -rf "$TMP"
    exit 1
fi
rm -rf "$TMP"

if [ "$RC" -eq 0 ]; then
    echo "Creative Cloud Desktop app installed."
    exit 0
else
    echo "ERROR: installation failed (RC $RC)."
    exit 1
fi

Note: If the package is very large and the direct download runs into the script timeout, the decoupled LaunchDaemon variant from Initial installation is the better choice: PKG_URL is set to the Creative Cloud Desktop app package and the RUM step is omitted.

Status monitoring via App Compliance

In this setup, installation is performed via the script – no PKG is uploaded to Relution. The App compliance configuration of a macOS policy therefore does not serve distribution but status monitoring: the app is created via Manually add app, and the bundle ID is entered in the Internal name field.

In the App compliance configuration, the source Manually add app is selected under Required apps via Add (without PKG upload).
A Name is assigned and the bundle ID is entered in the Internal name field, e.g. com.adobe.acc.AdobeCreativeCloud.
Relution regularly checks whether this bundle ID is included in the device’s list of installed apps.
Devices without the app are flagged as Noncompliant, provided the option Add compliance violation when required apps are missing is enabled under Settings → Device Management → Device Management (default). The installation script can then be run (again) on those devices.

App-specific detection (e.g. Photoshop only): Relution checks every stored bundle ID against the device’s list of installed apps. For an app-specific check, the bundle ID of the individual app is therefore stored instead of com.adobe.acc.AdobeCreativeCloud (via Manually add app). The bundle ID can be looked up in the list of installed apps of a device on which the app is already installed. This requires macOS to report the app in that list.

Notes

Licensing (Named User Licensing): After installation, the user signs in with their Adobe ID on first launch. Each app requires a matching product profile in the Admin Console – without an entitlement the app is installed but not usable.
Major upgrades: The Remote Update Manager only updates within the installed major version (base and security updates). Moving to a new yearly generation requires a new package.
Education environments: For Adobe education customers, auto-update for end users is not available; management via the Remote Update Manager is the intended path here.
Spotlight: The initial installation script indexes installed apps via mdimport so they are immediately findable through Spotlight search – not only in Finder.

Customer Hub

Adobe Creative Cloud Apps

Why a script is needed #

Create the package in the Admin Console #

Deploying the PKG #

Automation scripts #

Initial installation (recommended) #

Ongoing updates #

Alternative: Self-service #

Status monitoring via App Compliance #

Notes #