What's New
Get Started
- Quick start guide for administrators
- Quick start guide for users
- For Developers
- Video tutorial library
- FAQ
Administer
- Admin Console Overview
- User Management
- Adding users
- Create function-focused users
- Check for users with provisioning errors
- Change Name/Email Address
- Edit a user's group membership
- Edit a user's group membership through the group interface
- Promote a user to an admin role
- User Identity Types and SSO
- Switch User Identity
- Authenticate Users with MS Azure
- Authenticate Users with Google Federation
- Product Profiles
- Login Experience
- Account/Group Settings
- Settings Overview
- Global Settings
- Account tier and ID
- New Recipient Experience
- Self Signing Workflows
- Send in Bulk
- Web Forms
- Custom Send Workflows
- Power Automate Workflows
- Library Documents
- Collect form data with agreements
- Limited Document Visibility
- Attach a PDF copy of the signed agreement
- Include a link in the email
- Include an image in the email
- Files attached to email will be named as
- Attach audit reports to documents
- Merge multiple documents into one
- Download individual documents
- Upload a signed document
- Delegation for users in my account
- Allow external recipients to delegate
- Authority to sign
- Authority to send
- Power to add Electronic Seals
- Set a default time zone
- Set a default date format
- Users in Multiple Groups (UMG)
- Group Administrator Permissions
- Replace recipient
- Audit Report
- In Product Messaging and Guidance
- Accessible PDFs
- New authoring experience
- Healthcare customer
- Account Setup
- Add logo
- Customize company Hostname/URL
- Add company name
- Post agreement URL redirect
- Signature Preferences
- Well formatted signatures
- Allow recipients to sign by
- Signers can change their name
- Allow recipients to use their saved signature
- Custom Terms of Use and Consumer Disclosure
- Navigate recipients through form fields
- Decline to sign
- Allow Stamps workflows
- Require signers to provide their Title or Company
- Allow signers to print and place a written signature
- Show messages when e-signing
- Require signers to use a mobile device to create their signature
- Request IP address from signers
- Exclude company name and title from participation stamps
- Digital Signatures
- Electronic Seals
- Digital Identity
- Report Settings
- New report experience
- Classic report settings
- Security Settings
- Single Sign-on settings
- Remember-me settings
- Login password policy
- Login password strength
- Web session duration
- PDF encryption type
- API
- User and group info access
- Allowed IP Ranges
- Account Sharing
- Account sharing permissions
- Agreement sharing controls
- Signer identity verification
- Agreement signing password
- Document password strength
- Block signers by Geolocation
- Phone Authentication
- Knowledge-Based Authentication (KBA)
- Allow page extraction
- Document link expiration
- Upload a client certificate for webhooks/callbacks
- Timestamp
- Send settings
- Show Send page after login
- Require recipient name when sending
- Lock name values for known users
- Allowed recipient roles
- Allow e-Witnesses
- Recipient groups
- Required fields
- Attaching documents
- Field flattening
- Modify Agreements
- Agreement name
- Languages
- Private messages
- Allowed signature types
- Reminders
- Signed document password protection
- Send Agreement Notification through
- Signer identification options
- Content Protection
- Enable Notarize transactions
- Document Expiration
- Preview, position signatures, and add fields
- Signing order
- Liquid mode
- Custom workflow controls
- Upload options for the e-sign page
- Post-sign confirmation URL redirect
- Message Templates
- Bio-Pharma Settings
- Workflow Integration
- Notarization Settings
- Payments Integration
- Signer Messaging
- SAML Settings
- SAML Configuration
- Install Microsoft Active Directory Federation Service
- Install Okta
- Install OneLogin
- Install Oracle Identity Federation
- SAML Configuration
- Data Governance
- Time Stamp Settings
- External Archive
- Account Languages
- Email Settings
- Migrating from echosign.com to adobesign.com
- Configure Options for Recipients
- Guidance for regulatory requirements
- Accessibility
- HIPAA
- GDPR
- 21 CFR part 11 and EudraLex Annex 11
- Healthcare customers
- IVES support
- "Vaulting" agreements
- EU/UK considerations
- Download Agreements in Bulk
- Claim your domain
- Report Abuse links
Send, Sign, and Manage Agreements
- Recipient Options
- Cancel an email reminder
- Options on the e-signing page
- Overview of the e-sign page
- Open to read the agreement without fields
- Decline to sign an agreement
- Delegate signing authority
- Restart the agreement
- Download a PDF of the agreement
- View the agreement history
- View the agreement messages
- Convert from an electronic to a written signature
- Convert from a written to an electronic signature
- Navigate the form fields
- Clear the data from the form fields
- E-sign page magnification and navigation
- Change the language used in the agreement tools and information
- Review the Legal Notices
- Adjust Acrobat Sign Cookie Preferences
- Send Agreements
- Authoring fields into documents
- In-app authoring environment
- Create forms with text tags
- Create forms using Acrobat (AcroForms)
- Fields
- Authoring FAQ
- Sign Agreements
- Manage Agreements
- Manage page overview
- Delegate agreements
- Replace Recipients
- Limit Document Visibility
- Cancel an Agreement
- Create new reminders
- Review reminders
- Cancel a reminder
- Access Power Automate flows
- More Actions...
- How search works
- View an agreement
- Create a template from an agreement
- Hide/Unhide agreements from view
- Upload a signed agreement
- Modify a sent agreement's files and fields
- Edit a recipient's authentication method
- Add or modify an expiration date
- Add a Note to the agreement
- Share an individual agreement
- Unshare an agreement
- Download an individual agreement
- Download the individual files of an agreement
- Download the Audit Report of an agreement
- Download the field content of an agreement
- Audit Report
- Reporting and Data exports
- Overview
- Grant users access to reporting
- Report charts
- Data Exports
- Rename a report/export
- Duplicate a report/export
- Schedule a report/export
- Delete a report/export
- Check Transaction Usage
Advanced Agreement Capabilities and Workflows
- Webforms
- Reusable Templates (Library templates)
- Transfer ownership of web forms and library templates
- Power Automate Workflows
- Overview of the Power Automate integration and included entitlements
- Enable the Power Automate integration
- In-Context Actions on the Manage page
- Track Power Automate usage
- Create a new flow (Examples)
- Triggers used for flows
- Importing flows from outside Acrobat Sign
- Manage flows
- Edit flows
- Share flows
- Disable or Enable flows
- Delete flows
- Useful Templates
- Administrator only
- Agreement archival
- Webform agreement archival
- Save completed web form documents to SharePoint Library
- Save completed web form documents to OneDrive for Business
- Save completed documents to Google Drive
- Save completed web form documents to Box
- Agreement data extraction
- Agreement notifications
- Send custom email notifications with your agreement contents and signed agreement
- Get your Adobe Acrobat Sign notifications in a Teams Channel
- Get your Adobe Acrobat Sign notifications in Slack
- Get your Adobe Acrobat Sign notifications in Webex
- Agreement generation
- Generate document from Power App form and Word template, send for signature
- Generate agreement from Word template in OneDrive, and get signature
- Generate agreement for selected Excel row, send for review and signature
- Custom Send workflows
- Share users and agreements
Integrate with other products
- Acrobat Sign integrations overview
- Acrobat Sign for Salesforce
- Acrobat Sign for Microsoft
- Other Integrations
- Partner managed integrations
- How to obtain an integration key
Acrobat Sign Developer
- REST APIs
- Webhooks
Support and Troubleshooting
Obtaining signatures and approvals from recipients can require varying levels of authentication depending on the document involved. Adobe Acrobat Sign supports a full range of authentication methods, from simple, single-factor verification to sophisticated, two-factor authentication based on government-issued documents.
Identity authentication
Authenticating a recipient's identity is a critical element of the Acrobat Sign system to obtain a legal signature and improve non-repudiation.
However, different business purposes have different demands on identity authentication. Consider the different levels of identity assurance you would demand for the following transactions:
- Time off request at work
- A child's grade card from school
- Private event registration
- Membership in a gym
- Medical records access
- CFR 21 part 11 compliant documents
Acrobat Sign provides a control set that allows authentication types to be defined at the account and group level with definable default values to streamline the sender's experience and better ensure compliance with company signature policies.
Keeping in mind that the more robust authentication methods insert more "friction" to the signature process, admins should configure the account or group defaults to support the most common authentication requirement, opting for the least complex option where possible and allowing editable options if some transactions demand more complex solutions.
Key terminology
Internal vs. External Recipients
Authentication controls make specific accommodations to configure authentication methods for two types of recipients, Internal and External:
- Internal recipients include every active user (as identified by the email address) within the same Acrobat Sign account from which the agreement was sent
- A list of every user in your account is a list of all internal users
- It does not matter what group the recipient is in as long as the user is in the same account structure
- External recipients include every recipient email address not attached to an internal user
- Every email address not included in an account-level user list is an external user
Delineating the recipients in this manner allows workflows to leverage high-level authentication for external recipients while using more cost-effective authentication for internal users.
One company (email domain) can have multiple Acrobat Sign accounts.
Only the users resident in each discrete account are internal to each other. External accounts house external recipients in all cases.
Single-factor recipient authentication methods
Acrobat Sign Authentication
Acrobat Sign Authentication prompts the recipient to authenticate to the Acrobat Sign system.
This method is primarily used as a "low-friction" counter-signature option for your internal recipients when you have signature requirements requiring a logged and authenticated event.
Care should be taken before assigning Acrobat Sign Authentication to external recipients:
- Acrobat Sign Authentication is not a second-factor authentication method.
- External recipients may or may not have an active Acrobat Sign user. They must register and verify a user before authenticating if they don't.
- Internal recipients (by definition) are known to be active Acrobat Sign users, so it's known that they can authenticate without issue.
Recipients are asked to authenticate to Acrobat Sign before they can interact with the agreement contents:
One-Time Password via email
The One Time Password via email (OTPvEm) authentication method supplies a single-factor authentication, providing some protection with minimum user friction.
Because the one-time passcode is delivered to the same email address as the original signature link, the OTPvEm authentication method is considered a single-factor authentication method. However, the OTPvEm does not require users to create an account or log in to another application. They only need access to their email, making this method lower friction.
And using OTPvEm provides some additional security that simply relying on the email link does not. For example:
- Access to an email does not mean that the email box is compromised. The OTMvEm authentication will maintain the agreement's security if an email link is exposed, but the email box is secured.
- Suppose an agreement email is improperly forwarded (vs. proper delegation). In that case, the OTPvEm challenge will prevent the agreement from being accessed, preserving the audit report integrity regarding the identified signer's email and the actual signer.
The recipient must enter the passcode within 60 seconds of asking for the code. Once the code is successfully entered, the recipient can interact with the agreement.
Second-Factor Authentication (2FA)
Acrobat Sign supports several second-factor authentication methods for higher-value transactions that demand more than single-factor verification.
The method of authentication is usually dictated by the type of document or industry of the involved parties. It is incumbent on the admin to understand their internal signature policies and possible compliance demands.
Below is a summary of the available second-factor authentication options with links to more detailed descriptions:
Signer password authentications require the sender to type in the password (twice)
- Passwords are Alpha/Numeric only. No special characters
- The sender must communicate the password to the recipient through some external channel
- The password is not stored in clear text anywhere in the application. If the password is lost, it cannot be recovered, and the sender will have to reset it
Recipients are asked to enter the password before they can view the agreement contents:
Phone authentication delivers a six-digit code to the recipient which must be entered for the agreement to be exposed.
- The recipient's phone number must be entered during the creation of the agreement by the sender.
- If the recipient delegates their signature authority, they are asked to provide a valid phone number for the new recipient. A correct phone number must be provided, or authentication will ultimately fail.
- The recipient has the option to select a Text Message (for smartphones that can receive text messages) or a Voice Call (if a text-enabled phone isn't available).
- The authentication code is valid for ten minutes after it is delivered.
The recipient requests the code, and must enter it prior to viewing the agreement content:
Knowledge-Based Authentication is a high-level authentication method used mainly in financial institutions and other scenarios that demand a strong assertion of the signer's identity.
The recipient is prompted to enter personal information, which is used to gather several nontrivial questions from their past (using public databases). Each question must be answered correctly to gain access to the agreement.
KBA is valid only for recipients in the USA.
Government ID authentication instructs the recipient to supply an image of a government-issued document (Driver's license, Passport) and a selfie to establish a strong verification record.
Recipients are challenged to provide a phone number to a smartphone initially and then are walked through the process of uploading the document and selfie images:
Cloud-based digital signatures require that a signer authenticates to a third-party identity provider to apply a digital signature.
Acrobat Sign supports a wide range of signature providers in multiple countries. Administrators can configure their account (or specific groups) to accept digital signatures from one or more providers.
In most cases, customers enter into an agreement with the identity provider to accommodate their volume of signatures. Acrobat Sign acts only as a platform for the digital signature to be requested and provided, with no additional costs added by Adobe. Accounts with a VIP license can purchase Aadhaar identity transactions through Adobe as an add-on and track their consumption in the admin menu.
"Premium" signer authentication methods
Phone, KBA, Government ID, and Cloud-based digital signatures are "premium" authentication methods.
Premium authentication methods are a metered resource that must be purchased prior to use. Contact your success manager or sales agent for details.
New enterprise and business-level accounts are given 50 free Phone and KBA transactions when the account is launched.
Automatic cancelation thresholds
All second-factor authentication methods have configurable thresholds that cancel the agreement when a recipient fails to authenticate an unacceptable number of times.
- The agreement owner (sender) will be notified that the agreement is canceled
- Only the sender is notified.
- Canceled agreements cannot be returned to active status. A new agreement must be created.
Digital Identity verification
Digital Identity verification leverages a Federated identity provider (IdP) that is licensed externally to the Acrobat Sign service and must be configured prior to becoming accessible when composing agreements.
Full details of the Digital Identity solution can be found here >
The details of the recipient experience vary based on the identity provider that the sender uses. At a high level, the recipient is informed that identity verification is to be resolved through a federated IdP, with a Verify Identity button available to trigger the verification process.
How senders select an authentication method
When configuring an agreement, senders can select an authentication method from a drop-down menu just to the right of the recipient's email address.
Most authentication methods can be configured to be the selected default value to simplify the sending process. Only the Digital Identity options can not be configured as a default authentication value.
The recipient experience
Typically, a recipient is first made aware of an agreement awaiting their attention via email.
- If the agreement is sent with no (None) authentication, selecting the Review and sign button in the email opens the agreement for viewing and action.
- If the agreement has an additional authentication method configured, selecting the Review and sign button in the email opens the authentication challenge page.
- Once the challenge is satisfied, the agreement is opened for interaction.
- Once the challenge is satisfied, the agreement is opened for interaction.
A user authenticated into Acrobat Sign can typically view agreements waiting for their signature on their Manage page without authenticating. The authentication challenge is presented to the recipient when using the Review and sign link to interact with the agreement (sign, fill form fields, etc).
Accounts that enable the Don’t challenge the signer to re-authenticate if they are already logged in to Acrobat Sign setting will skip authentication when accessing the agreement from their Manage page.
Audit Report events
Each second-factor authentication method has an explicit success message that identifies the method used.
If no (None) authentication is selected, the audit report only indicates that the document was signed:
Configurable options and defaults
Admin controls
The account-level settings can be accessed by logging in as an Adobe Sign account-level admin and navigating to Account Settings > Send Settings > Signer Identification Options
All controls can also be configured at the group level. Remember that:
- All groups inherit the account level settings by default.
- Group-level configurations override the account-level settings.
- All options available on the Send page are derived from the settings of the group the agreement is being sent from.
The controls are divided into two sections:
- Signer Identification Options - The primary set of identity authentication settings. These values are applied to all recipients of all agreements created in the sending group with these exceptions:
- API-based processes, which can restrict the sender's options (Integrations, workflows, custom applications).
- When Enable different identity authentication methods for internal recipients is enabled (see below).
- API-based processes, which can restrict the sender's options (Integrations, workflows, custom applications).
- Identity Authentication for Internal Recipients - This subset of settings allows the group to define a different set of identity authentication methods for internal recipients. This provides the benefit of:
- Less frustration for internal signers.
- A less complex signature process accelerates signing for recipients that might have to counter-sign many agreements.
- The costs for premium authentication can be obviated for internal recipients.
Identity Authentication Methods
The primary authentication controls:
- Require senders to specify one of the enabled authentication methods - When enabled, senders are required to select an authentication method other than None as the default authentication method. None may not be selected.
- Allow Acrobat Sign to auto-populate the Signers email address for each authentication challenge - This setting only applies to the Acrobat Sign authentication method. When enabled, the recipient's email address is automatically inserted where needed for authentication.
- Don't challenge the signer to re-authenticate if they are already logged in to Acrobat Sign - When enabled, signers are not challenged to re-authenticate if they are currently logged in to Acrobat Sign.
- Allow Senders to download a Signer Identity Report for agreements containing Verified Signatures - Signer Identity Reports (SIR) are available for the Government ID and Digital Identity authentication methods. This setting, when enabled, allows the sender of the agreement to download the SIR from their Manage page.
- Enable the following identity authentication methods - This prefaces the list of authentication options available to the senders. Select one or more according to your security and compliance needs.
- By default, use the following method - Establishes the default authentication method inserted when a recipient is added to a new agreement.
- Allow senders to change the default authentication method - If enabled, the sender has the option to select any method enabled.
- When disabled, only the default method of authentication can be used.
Identity Authentication for Internal Recipients
The internal recipient controls provide the options you would like to apply to internal recipients:
- Enable different identity authentication methods for internal recipients - When enabled, internal recipients are treated as an exception to the primary authentication rules and instead are presented with the default authentication options defined in the Identity Authentication for Internal Recipients section.
- Enable the following identity authentication methods - This prefaces the list of options available for internal recipient authentication. Select one or more according to your security and compliance needs.
- Adobe Sign authentication provides a low-cost/low-friction authentication method when your senders are also countersigners.
- Adobe Sign authentication provides a low-cost/low-friction authentication method when your senders are also countersigners.
- By default use the following method - Establishes the default method inserted for internal recipients when a new agreement is created.
- Allow senders to change the default authentication method - This grants the sender the authority to change the default authentication method to any other option enabled by the admin.
Web Form exception to identity authentication
Web forms are employed in a multitude of unique use cases, and frequently there is a diminished demand for enforced identity authentication.
For accounts/groups that do not need to authenticate web form signatures, the option to disable email verification can be configured by:
- Navigating to: Account Settings > Global Settings > Web Forms (for account-level settings).
- Edit Group: {Group Name} > Group Settings > Web Forms (for group-level settings).
- Uncheck the option to Require Signer to verify their email address to accept web form signatures without verification.
- Removing the requirement to verify the web form signature does not remove the requirement for the signer to provide an email address.
Best practices and considerations
- All authentication methods and options can be configured at the account and group levels.
- All groups inherit their default setting values from the account-level settings. Design your account-level settings to best leverage the automatic property inheritance, minimizing group configuration later.
- Agreements derive their authentication options from the group the agreement is sent from. If you aren't seeing the options you expect, check your group-level settings.
- Evaluate your identity authentication requirements for the types of documents you are sending and if they are subject to any compliance regulations. If "premium" authentication is required, ensure that sufficient volume for your expected traffic has been purchased.
- Government ID Authentication: (i) is not intended for regulated or high-value electronic signature workflows and use cases; (ii) cannot identify all fraudulent or “fake” identification documents; and (iii) may not replace the need for human review.
- Determine if there are signature flows that may require second-factor authentications, like:
- Hosted Signatures
- Custom solutions designed to suppress email notifications (e.g., Workday)
- Signature flows that seek to get legal signatures from two or more recipients using the same (shared) email address
- Identify if/where having different authentication standards for internal recipients is valuable.
- Accounts with access to Custom Workflows can define very precise authentication methods for each of your signature flows, allowing a lower friction (and potentially higher volume) default value, while ensuring compliance in critical signature processes.
- Be aware that the individual authentication methods must be enabled before they become available to other services. Enabling a method exposes it for:
- Other administrative controls, such as the Security Settings for second-factor authentication methods
- Users to select during the standard Send process
- Custom workflows as built in the Workflow designer
- API-driven send events
- Integration access (Dynamics, Salesforce)
- Other administrative controls, such as the Security Settings for second-factor authentication methods