How to create an AEM technical account, add it to a read-only product profile, verify the group sync, and grant access only to approved JCR paths.

What you'll configure

This guide covers four steps:

Generate an AEM technical account and download its service credentials.
Create a Read-Only product profile in Adobe Admin Console and add the technical account.
Trigger and verify the corresponding group sync in AEM.
Grant the group jcr:read access only to the required JCR root paths.

The result is a technical account that Medialake can use to read approved content from an AEM as a Cloud Service Author environment without receiving write access.

Before you begin

The people completing this setup need:

Access to the correct Adobe IMS organization
Access to the relevant AEM as a Cloud Service program and environment
Adobe Admin Console permission to create and manage product profiles
AEM Administrator access to the target Author instance

Confirm the target AEM Author environment before creating credentials or assigning permissions. Technical accounts and permissions are environment-specific.

>Keep the credentials private. The downloaded service-credentials JSON contains private-key material. Do not email it, paste it into a support ticket, or commit it to source control.

>Adobe terminology: the downloaded file is the AEM Service Credentials JSON. Medialake uses the values in the file to create a JWT, exchange it with Adobe IMS for an access token, and authenticate to AEM. The downloaded JSON is not itself a bearer token.

Step 1: Generate the technical account and service credentials

Creating service credentials has two parts: creating the technical account, then downloading the JSON associated with an active private key.

Sign in to Adobe Cloud Manager.
Open the program containing the target AEM as a Cloud Service environment.
In the Environments section, select the ellipsis next to the target environment and open Developer Console.
In the AEM Developer Console, open Integrations and select Technical Accounts.
Select Create new technical account.
Expand the technical account and its active private key.
Select View, then download the service-credentials JSON to an approved secure location.
Open the JSON and locate the technical account email in integration.email. It will look similar to:

[email protected]

Record the certificate expiry and plan to rotate the private key before it expires.
Provide the service-credentials JSON to Medialake through the agreed secure credential-sharing method.

Do not send the credentials file by email.

Step 2: Create a product profile and add the technical account

Sign in to the Adobe Admin Console.
Select the correct Adobe IMS organization.
Under Products and Services, select AEM as a Cloud Service.
Select the product instance associated with the target AEM environment, then open Product Profiles.

> Depending on the Admin Console version, the surrounding navigation may be labelled Products or Manage.

Select New Profile.
Enter the exact profile name Read-Only, then select Save.
Open the new Read-Only profile and select Add User.
Enter the technical account email from the service credentials file's integration.email value.
Save the membership.
Wait at least 10 minutes for the change to propagate.
Let Medialake know that the propagation window has elapsed and identify the exact AEM Author environment.

Medialake will make a test API call to trigger the technical account and group sync into AEM. If preferred, your team can make the authenticated request using the cURL flow in Adobe's service-credentials documentation.

Step 3: Verify the group sync in AEM

Complete this step after Medialake or your team has made the first authenticated API request to the intended AEM Author instance.

Sign in to the correct AEM Author instance as an AEM Administrator.
Navigate to Tools → Security → Groups.
Search for and open the Read-Only group.
Open the Members tab.
Confirm that the technical account email from integration.email is listed.

If the group is not visible:

Confirm that the authenticated test request reached this exact AEM Author environment.
Recheck the technical account's membership in the correct Read-Only product profile.
Confirm that the account email matches integration.email exactly.
Allow more propagation time, then make another authenticated request and recheck the group.
Do not create an unrelated local group with the same name as a shortcut.

Step 4: Assign JCR read permissions

Only grant access to the exact JCR roots Medialake needs to read.

In AEM Author, navigate to Tools → Security → Permissions.

> Some Adobe documentation or AEM versions may label the top-level console differently, but Permissions is normally available from the Tools security console.

Search the left pane for the Read-Only group and select it.
Select Add ACE or Edit, depending on the AEM version.
For each approved JCR root path, configure:

| Setting | Value |

| --- | --- |

| Principal | Read-Only |

| Path | The exact approved JCR root path |

| Permission type | Allow |

| Privilege | jcr:read only |

Save the access control entry.
Repeat for each approved root path.
Review inherited allows and denies to confirm the effective access matches the approved scope.

Do not grant jcr:write, rep:write, jcr:all, replication, or access-control privileges.

> Grant jcr:read at the narrowest practical root. An allow on a broad path can expose readable descendants unless a more specific deny applies.

Validate the completed setup

After all four steps are complete, test that:

Authentication succeeds against the intended AEM Author environment.
Reads succeed on every approved root path.
Reads fail on paths outside the approved scope.
Create, update, and delete operations remain denied.

The setup is complete when the Read-Only group contains the technical account and the effective permissions match the approved JCR paths.

Troubleshooting

Symptom	What to check
The `Read-Only` group is missing	Confirm the environment and product instance, allow propagation time, and make a successful authenticated API request to trigger the sync.
The technical account is not a member	Compare the AEM member login with the JSON's `integration.email` value and recheck the correct product profile.
`401 Unauthorized`	Check credential parsing, private-key or certificate expiry, token generation, the IMS exchange, and the calling system's clock.
`403 Forbidden`	Authentication succeeded, but AEM authorization did not. Check group membership, `jcr:read` entries, inherited denies, and the requested path.
The account has unexpected write access	Remove write or aggregate privileges, review inherited group memberships and access control entries, then retest.

Tell Medialake when Step 2 is complete

After the 10-minute propagation window, send us:

The name or URL of the target AEM Author environment
Confirmation that the technical account was added to the Read-Only product profile
Confirmation that the propagation window has elapsed

We can then make the test API call needed before you verify the group in Step 3.

Adobe Experience Manager — Set Up Read-Only API Access