---
locale: "en"
updated_at: "2025-10-27T22:49:26.278Z"
canonical: "https://www.isdecisions.com/en/userlock/docs/guides/sso/configure-the-applications/docusign"
---

# Integrate DocuSign with UserLock Single Sign-On

Configure SSO access to DocuSign through UserLock.

## Introduction

This guide explains how to integrate DocuSign with UserLock Single Sign-On (SSO) using the SAML 2.0 protocol. 

Once integrated, DocuSign logins are authenticated by UserLock against Active Directory. This provides a smooth sign-in experience for users and allows administrators to enforce UserLock [access policies](/userlock/docs/reference/core-concepts/access-policies) (MFA, time, machine, or location restrictions) on SSO sessions.

🚩 **Before starting:**

- You need a **DocuSign account** with an approved domain.
- **UserLock SSO** must already be [installed and configured](/userlock/docs/guides/sso/install-configure-sso).

## Step 1. Configure DocuSign (Service Provider)

1. Open the **DocuSign Admin console**:
  - In the eSignature console, go to **Settings**.
  - Click **SWITCH TO**, then select **DOCUSIGN ADMIN**.
  ![](https://a.storyblok.com/f/122374/705x299/95e221f8db/docusign-admin.png)
2. In the top menu, click **Identity Providers**.
3. Click **ADD IDENTITY PROVIDER**.
4. Enter the following values, using your **UserLock SSO URL** (visible in **UserLock console ▸**⚙**  Server settings ▸ Single Sign-On**). 

Example with `https://sso.contoso.com`
  ![](https://a.storyblok.com/f/122374/551x595/6f629b617b/docusign-setting.png)
5. Save the settings.
6. Add a certificate:
  - Go to **UserLock console ▸ **⚙** Server settings ▸ Single Sign-On**
  - Click on **Download ▸ SAML certificate**.
  - In DocuSign Admin, click **Add certificate** and upload the file.

## Step 2. Configure DocuSign in UserLoc

1. In the **UserLock console**, go to ⚙** Server settings ▸ Single Sign-On**.
2. Click on the **DocuSign row**.
3. Fill in the fields with information from DocuSign Admin:
  | Settings | Values |
  | --- | --- |
  | Email domain | The domain used for DocuSign logins (e.g. contoso.com). |
  | Issuer | Available in DocuSign Admin ▸ Identity Providers ▸ Endpoints (Actions menu). |
  | ACS URL | Available in the same Endpoints section. |
  | Certificate | In **DocuSign Admin ▸ Identity Providers**, open the **Endpoints **view (Actions ▸ Endpoints) and download the metadata. Copy the X.509 certificate from this metadata file and paste it here. |
4. Save the profile.

![](https://a.storyblok.com/f/122374/577x790/2a26d1d21f/docusign-settings.PNG)

## Update the SAML certificate in DocuSign

When you renew the SAML certificate in UserLock (see [Renew the SAML certificate](/userlock/docs/guides/sso/renew-saml-certificate)), you must also update the configuration in DocuSign:

1. In the **UserLock console**, go to ⚙ **Server settings ▸ Single Sign-On**.
2. Click **Download ▸ SAML certificate** and save the file.
3. Open the certificate in a text editor (Notepad) and copy the full contents.
4. In **DocuSign Admin**, go to **Identity Providers** and select your IdP.
5. Replace the existing IdP certificate with the new file.
6. Save the configuration.

DocuSign will now trust the renewed UserLock certificate for SSO logins.

## Troubleshooting

For common issues, see [Troubleshooting SSO](/userlock/docs/support/troubleshooting/sso-issues).
If the problem persists, please contact [IS Decisions Support](/support).

## Next steps

You can extend the security of SSO sessions by applying UserLock access policies in addition to authentication.

- [Apply MFA on SaaS connections](/userlock/docs/guides/mfa-implementation/mfa-for-sso) to require stronger authentication.
- [Hour restrictions](/userlock/docs/reference/access-policies/time-restriction): define when users are allowed to connect.
- [Geolocation rules](/userlock/docs/reference/access-policies/geolocation): enforce access policies based on user location.
- [Session limits](/userlock/docs/reference/access-policies/session-limit): allow or deny SaaS logins entirely for specific users.