Skip to content
Cloudflare for Teams
Visit Cloudflare for Teams on GitHub
Set theme to dark (⇧+D)

Protecting DocuSign with Access for SaaS

This guide covers how to protect your DocuSign account with Access for SaaS.


⏲️ Time to complete: 10 minutes

Create the Access for SaaS application

  1. On the Teams Dashboard, go to Access > Applications.

  2. Select Add an Application.

  3. Select SaaS.

  4. Use the following configuration:

    • Set the Application to DocuSign.
    • Put placeholder values in EntityID and Assertion Consumer Service URL (e.g. We’ll come back and update these.
    • Set Name ID Format to: Unique ID.
  5. DocuSign requires SAML attributes to do Just In Time user provisioning.

    • Ensure you are collecting SAML attributes from your IdP:

    DocuSign SAML Attributes

  6. These IdP SAML values can then be mapped to the following DocuSign SAML attributes:

    • Email
    • Surname
    • Givenname
  7. Set an Access policy (for example, create a policy based on Emails ending in

  8. Copy and save SSO Endpoint, Entity ID and Public Key.

## Configure your DocuSign SSO instance

  1. Ensure you have a domain claimed in Zendesk.

  2. From the DocuSign Admin dashboard, click Identity Providers.

  3. On the Identity Providers page, click ADD IDENTITY PROVIDER. Use the following mappings from the saved Access Application values:

    • Name: Pick your desired name.
    • Identity Provider Issuer: Entity ID.
    • Identity Provider Login URL: Assertion Consumer Service URL.
  4. Save the Identity Provider.

  5. Upload your certificate to the DocuSign Identity Provider menu.

  6. Configure your SAML Attribute mappings. The Attribute Names should match the values in IdP Value in your Access application.

    DocuSign Custom Attributes mapping

  7. Go back to the Identity Provider's screen and select Actions > Endpoints. Copy and save the following:

    • Service Provider Issuer URL.
    • Service Provider Assertion Consumer Service URL.

DocuSign SAML 2.0 Endpoints

Finalize your Cloudflare configuration

  1. Go back to your DocuSign application under Access > Applications.
  2. Click Edit.
  3. Use the following mappings:
    • EntityID->Service Provider Issuer URL.
    • Assertion Consumer Service URL -> Service Provider Assertion Consumer Service URL.
  4. Save the application.

When ready, enable the SSO for your DocuSign account and you will be able to login to DocuSign via Cloudflare SSO and your Identity Provider.