Configure DocuSign user provisioning

As an administrator, once you've set up SSO, your next step is to set up automated user provisioning to authorize, create, modify, or delete your users' identity once in G Suite, and have the changes to that identity reflected in DocuSign.

Set up user provisioning for the DocuSign application

Note: Before you can set up user provisioning for DocuSign, you need two pieces of information from your DocuSign account, the account ID and the account instance.

  • The account ID is available in your DocuSign account. Sign in to your account, then click the user icon at top right to view your account information, including account ID.
  • Request your account instance from DocuSign support.
  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in @gmail.com).

  2. From the Admin console Home page, go to Apps and then SAML Apps.

    To see Apps on the Home page, you might have to click More controls at the bottom. 

  3. Click the DocuSign application.
  4. Click User provisioning.
  5. Click Set up user provisioning.
  6. Click Authorize. DocuSign opens in the same tab.

    Important:  You'll be asked for an authorization by DocuSign. This is a one-time step. If you've authorized Google in the past, your DocuSign application won't ask for your approval again. However, if you've revoked access and haven't reauthorized since, you'll be asked for authorization.

    If you haven't signed into your DocuSign administrator account before clicking Authorize, you'll be prompted to sign in. If you can't access your DocuSign application, click Re-authorize app, then sign in.

  7. Click Next.
  8. In the Provide DocuSign endpoint URL field, edit the default URL, replacing {instance} and {AccountId} with the values for your DocuSign account. (See the note at the start of this procedure about how to get these values.)
  9. Click Next.
  10. In the Map attributes dialog box:
    1. Verify that all mandatory DocuSign attributes (those marked with an *) are mapped to Cloud Directory attributes. If not, click the Down arrow Down Arrow and map to the appropriate attribute. 
    2. Click Next.
  11. (Optional) You can use the Set provisioning scope dialog box to restrict provisioning to particular groups of users.
    1. Click the underscore and begin typing your group name. 
      A list of available groups appears.
    2. Selecting one adds it and opens another underscore to use to add another. 
    3. Click Edit Edit next to any group you've added to remove it.
  12. Once you’re done, click Finish.
    A new Provisioning summary dialog box appears.
  13. Review the information, then click OK.
  14. Click Activate provisioning.

    Note: If you added groups using the Set provisioning scope dialog box you must choose a scope or the Activate Provisioning button remains grayed out. You must set the app to On for everyone or On for some organizations and refresh the page before activating provisioning. If the app is set to Off, this choice is grayed out.

  15. In the confirmation dialog box, click Activate.
Display user provisioning

Once provisioning is enabled, Google begins collecting usage information. Next to User Provisioning, you see the usage information section.There aren't any numbers next to the event names until you enable provisioning.

The following event names provide the usage information for the last 30 days:

  • Users created
  • Users hard deleted
  • User failures

For more information, see Monitor user provisioning.

Edit provisioning scope

You may want to restrict the scope of provisioning to members of groups you define.

  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in @gmail.com).

  2. From the Admin console Home page, go to Apps and then SAML Apps.

    To see Apps on the Home page, you might have to click More controls at the bottom. 

  3. Click the DocuSign application.
  4. Select User provisioning.
  5. Under User provisioning, click Edit provisioning scope
  6. In the Set provisioning scope dialog box, add a group to restrict provisioning to members of groups you define:
    1. Click the underscore and begin typing your group name. 
      A list of available groups appears.
    2. Selecting one adds it and opens another underscore to use to add another. Add more groups, if necessary. 
    3. To remove any group you've added, click Edit Edit next to it.
  7. Click Save to save all the groups you've added.

The next time you click Edit provisioning scope, the groups you added appear in the Set provisioning scope window. If you've turned on the DocuSign application for a set of organizational units, the provisioning scope will be restricted to those users in the added groups who are also members of those organizations.

Deactivate user provisioning

To disable user provisioning for the DocuSign application without losing all the configuration information:

  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in @gmail.com).

  2. From the Admin console Home page, go to Apps and then SAML Apps.

    To see Apps on the Home page, you might have to click More controls at the bottom. 

  3. Click the DocuSign application.
  4. Select User provisioning.
  5. Under User provisioning, click Deactivate provisioning.
  6. In the Deactivate provisioning dialog box, click Deactivate.
Define deprovisioning timeframes

To define how long deprovisioning actions should be delayed before taking effect:

  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in @gmail.com).

  2. From the Admin console Home page, go to Apps and then SAML Apps.

    To see Apps on the Home page, you might have to click More controls at the bottom. 

  3. Click the DocuSign application.
  4. Select the User provisioning section.
  5. Under User provisioning, click Edit deprovisioning config.
  6. In the Deprovisioning configuration dialog box, define how long deprovisioning actions should be delayed before taking effect by selecting one or more of the following choices:
    • When an app is turned off for the user, hard delete their account, after the number of days you choose.
    • When a user is suspended on Google, hard delete their account, after the number of days you choose.
    • When a user is deleted from Google, hard delete their account, after the number of days you choose.

      The amount of time before deprovisioning takes effect can be set to within 24 hours, after 1 day, after 7 days, or after 30 days. The default for each is to suspend the account within 24 hours.

  7. Click Save.
Remove user provisioning

To disable user provisioning for the DocuSign application and remove all the configuration information:

  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in @gmail.com).

  2. From the Admin console Home page, go to Apps and then SAML Apps.

    To see Apps on the Home page, you might have to click More controls at the bottom. 

  3. Click the DocuSign application.
  4. Select User provisioning.
  5. Under User provisioning, click Delete provisioning.
  6. In the Delete provisioning config dialog box, click Delete to deactivate user provisioning and remove all configuration information.

    Existing users on DocuSign are not deprovisioned.

Was this article helpful?
How can we improve it?