DocuSign <-> Azure SSO

Question

Dear Team,

my client have successfully done the SSO setting in Azure and DocuSign side, however, we would like to user to provisioning to their each owned account and we have found that we need to send the accountID and permissionID to docusign side as below.

https://support.docusign.com/en/guides/org-admin-guide-identity-providers

I want to create the two below custom attribute :

1- accountid (Optional):
The DocuSign ID for the account associated with the user. If specified, this accountId will be used during just-in-time provisioning. This is the account that the user will be provisioned into when the user is created on first login. The accountId must be in the account GUID format. This must be specified in conjunction with the PermissionProfileId below, otherwise login will fail.

2- permissionprofileid (Optional):
The DocuSign ID of the Permission Profile associated with the user. Permission Profiles are sets of account permission settings that can be applied to individual users. Using this option allows new users to be assigned to a permission profile when they are added to the account. The ID information can be retrieved using the REST API.

Is there any way to set up from Azure side to send the accountID and permissionID to DocuSign side?

How this can be done?

Kindly share us the guidance.

Thanks,

Answer 1

Hello @Inji Song , apologies for the delay. I could not get ahold of a DocuSign SSO enabled test env/subscription but I think we can make this work using Azure AD only.

First, you need to choose where to store the aforementioned values per user. You can use any of the following:

• Extension attributes: The easiest to implement. These properties were initially custom attributes provided in on-premises Active Directory (AD) and Microsoft Exchange. However, they can now be used for more than syncing on-premises AD and Microsoft Exchange data to Azure AD through Microsoft Graph.
• Directory (Azure AD) extensions: You can create 2 extensions in the DocuSign enterprise app.

Then you can configure the Azure AD DocuSign enterprise app SAML token claims to match what DocuSign expects:

Using extension attributes:

• Add new claim:
• Source it from Attribute
• Select the appropiate attribute (user.extensionattribute1 in this case)

• Click Save

Using Directory Extensions:

• Add new claim
• Source it from Directory schema extension (preview)
• Select the DocuSign enteprise application or the application where the directory extension was created:

• Select extension attribute:

• Click Add
• Click Save

Follow the same steps in order to add the permissionprofileid claim.

Let us know if you need additional assistance. If the answer was helpful, please accept it and rate it so that others facing a similar issue can easily find a solution.