Obtaining signatures and approvals from recipients can require varying levels of authentication depending on the document involved. Adobe Acrobat Sign supports a full range of authentication methods, from simple, single-factor email verification to sophisticated, two-factor authentication based on government-issued documents.
Identity authentication
Authenticating a recipient's identity is a key element of the Acrobat Sign system to obtain a legal signature and improve non-repudiation.
However, different business purposes have different demands on identity authentication. Consider the different levels of identity assurance you would demand for the below transactions:
- Time off request at work
- Child's grade card from school
- Private event registration
- Membership to a gym
- Medical records access
- CFR 21 part 11 compliant documents
Acrobat Sign provides a control set that allows authentication types to be defined at the account and group level with definable default values to streamline the sender's experience and better ensure compliance with company signature policies.
Keeping in mind that the more robust authentication methods insert more "friction" to the signature process, admins should configure the account or group defaults to support the most common authentication requirement, opting for the least complex option where possible, and allowing editable options if some transactions demand more complex solutions.
Key terminology
Internal vs. External Recipients
Authentication controls make specific accommodations to configure authentication methods for two types of recipients, Internal and External:
- Internal recipients include every active user (as identified by the email address) within the same Acrobat Sign account from which the agreement was sent
- A list of every user in your account is a list of all internal users
- It does not matter what group the recipient is in, as long as the user is in the same account structure
- External recipients include every recipient email address not attached to an internal user
- Every email address not included in an account-level user list is an external user
Delineating the recipients in this manner allows workflows to leverage high-level authentication for external recipients while using more cost-effective authentication for internal users.
It is possible for one company (email domain) to have multiple Acrobat Sign accounts.
Only the users resident in each discrete account are internal with each other. External accounts house external recipients in all cases.
Recipient authentication methods
Email authentication
Acrobat Sign uses email as the default first-factor authentication method, fulfilling the requirements for a legal electronic signature under the ESIGN Act. For many customers, this is sufficient for most needs.
Email verification requires that the recipient:
- Access the agreement from their email box
- Click the link in the email to access the agreement view
- Complete any designated actions (Filling form fields, signature) on the agreement
- Click the final Click to Sign button to finalize the recipient's action
Access to the email link establishes a reasonable measure of identification, as all email addresses are unique, and access to email is password authenticated.
Integrations or actions that bypass the email notification to a recipient should include a suitable second-factor authentication method for non-repudiation.
Second-Factor Authentication (2FA)
Acrobat Sign supports several second-factor authentication methods for higher value transactions that demand more than simple email verification.
The method of authentication is usually dictated by the type of document or industry of the involved parties. It is incumbent on the admin to understand their internal signature policies and possible compliance demands.
Below is a summary of the available second-factor authentication options with links to more detailed descriptions:
Signer password authentications require the sender to type in the password (twice)
- Passwords are Alpha/Numeric only. No special characters
- The sender must communicate the password to the recipient through some external channel
- The password is not stored in clear text anywhere in the application. If the password is lost, it cannot be recovered, and the sender will have to reset it
Recipients are asked to enter the password before they can view the agreement contents:
Acrobat Sign Authentication prompts the recipient to authenticate to the Acrobat Sign system.
This method is primarily used as a "low-friction" counter-signature option for your internal recipients when you have signature requirements that require a logged/authenticated event for each signature.
Care should be taken before assigning Acrobat Sign Authentication to external recipients:
- Internal recipients (by definition) are known to be active Acrobat Sign users, so it is known that they can authenticate without issue
- External recipients may or may not have an active Acrobat Sign user. If they do not, they would be required to register and verify a user prior to authenticating
Recipients are asked to authenticate to Acrobat Sign before they can view the agreement contents:
Phone authentication delivers a six-digit code to the recipient which must be entered for the agreement to be exposed.
- The recipient's phone number must be entered during the creation of the agreement by the sender
- If the recipient delegates their signature authority, they are asked to provide a valid phone number for the new recipient. A correct phone number must be provided, or authentication will ultimately fail
- The recipient has the option to select a Text Message (for smartphones that can receive text messages) or a Voice Call (if a text-enabled phone isn't available)
- The authentication code is valid for ten minutes after it is delivered
The recipient requests the code, and must enter it prior to viewing the agreement content:
Knowledge Based Authentication is a high-level authentication method used mainly in financial institutions and other scenarios that demand a strong assertion of the signer's identity.
The recipient is prompted to enter personal information, which is used to gather several nontrivial questions from their past (using public databases). Each question must be answered correctly to gain access to the agreement.
KBA is valid only for recipients in the USA.
Government ID authentication instructs the recipient to supply an image of a government-issued document (Driver's license, Passport) and a selfie to establish a strong verification record.
Recipients are challenged to provide a phone number to a smartphone initially and then are walked through the process of uploading the document and selfie images:
"Premium" signer authentication methods
Phone, KBA, and Government ID are "premium" authentication methods.
Premium authentication methods are a metered resource that must be purchased prior to use. Contact your success manager or sales agent for details.
New enterprise and business-level accounts are given 50 free Phone and KBA transactions when the account is launched.
Automatic cancelation thresholds
All second-factor authentication methods have configurable thresholds that cancel the agreement when a recipient fails to authenticate an unacceptable number of times.
- The agreement owner (sender) will be notified that the agreement is canceled
- Only the sender is notified.
- Canceled agreements cannot be returned to active status. A new agreement must be created.
How senders select an authentication method
When configuring an agreement, senders can select an authentication method from a drop-down menu just to the right of the recipient's email address.
The default authentication method can be configured by an admin to simplify the sending process. Other options can be made available if needed.
The recipient experience
Typically, a recipient is first made aware of an agreement awaiting their attention via email.
- If the agreement is sent with only Email authentication, clicking the Review and sign button in the email opens the agreement for viewing and action
- If the agreement has second-factor authentication configured, clicking the Review and sign button in the email opens the second-factor authentication challenge page
- Once the second-factor challenge is satisfied, the agreement is opened for viewing and action
- Once the second-factor challenge is satisfied, the agreement is opened for viewing and action
Audit Report events
Each second-factor authentication method has an explicit success message that identifies the method used.
Email authentication simply indicates that the document was signed:
Configurable options and defaults
Admin controls
The account-level settings can be accessed by logging in as an Adobe Sign account-level admin and navigating to Account Settings > Send Settings > Identity Authentication Methods
The controls are divided into two sections:
- Identity Authentication Methods - The primary set of identity authentication settings. These values are applied to all recipients of all agreements created in the sending group with these exceptions:
- API-based processes, which can restrict the sender's options (Integrations, workflows, custom applications)
- When different identity authentication methods for internal recipients is enabled (see below)
- API-based processes, which can restrict the sender's options (Integrations, workflows, custom applications)
- Identity Authentication for Internal Recipients - This subset of settings allows the group to define a different set of identity authentication methods for internal recipients. This provides the benefit of:
- Less frustration for internal signers
- A less complex signature process accelerates signing for recipients that might have to counter-sign many agreements
- The costs for premium authentication can be obviated for internal recipients
Identity Authentication Methods
The primary authentication controls:
- Require senders to specify one of the enabled authentication methods - When enabled, you are required to select a second-factor method as the default authentication method. Email may not be selected.
- Allow Acrobat Sign to auto-populate the Signers email address for each authentication challenge - This setting only applies to the Adobe Sign authentication method. When enabled, the recipient's email address is automatically inserted where needed for authentication.
- Don't challenge the signer to re-authenticate if they are already logged in to Acrobat Sign - This setting only applies to the Acrobat Sign authentication method. When enabled, signers are not challenged to re-authenticate if they are currently logged in to Acrobat Sign.
- Enable the following identity authentication methods - This prefaces the list of second-factor authentication options available to the senders. Select one or more according to your security/compliance needs.
- By default, use the following method - Establishes the default authentication method inserted when a recipient is added to a new agreement.
- Allow senders to change the default authentication method - If enabled, the sender has the option to select any method enabled for the group they are sending from.
- When disabled, only the default method of authentication can be used.
Identity Authentication for Internal Recipients
The internal recipient controls provide the options you would like to apply to internal recipients:
- Enable different identity authentication methods for internal recipients - When enabled, internal recipients are treated as an exception to the primary authentication rules, and instead are presented with the default value/authentication options defined in the Identity Authentication for Internal Recipients section.
- Enable the following identity authentication methods - This prefaces the list of options available for internal recipient authentication. Select one or more according to your security/compliance needs.
- Adobe Sign authentication provides for a low-cost/low-friction authentication method when your senders are also countersigners.
- Adobe Sign authentication provides for a low-cost/low-friction authentication method when your senders are also countersigners.
- By default use the following method - Establishes the default method inserted for internal recipients when a new agreement is created.
- Allow senders to change the default authentication method - Grants the sender the authority to change the default authentication method to any other option enabled by the admin.
Group-level configuration
Each group in an account inherits the default authentication settings from the account-level settings.
Every group has the ability to override the inherited account settings to tune the default values and available options for the agreements generated in that group.
The group-level admin controls for identity authentication can be accessed by logging in as an Acrobat Sign admin:
For group-level admins that do not have account-level access:
- Navigate to My User Group > Send Settings
- Check the box to Override account settings for this page.
- Checking this box allows the group to break inheritance from the account-level settings, and substitutes the values explicitly selected for the group. Updates to account-level setting values will no longer be inherited.
- If you don't have the option to override the settings, your account-level admin settings have suppressed the group edit authority.
- Scroll down the page to the Identity Authentication Methods section and configure as needed.
- Navigate to the Groups tab.
- Click the group to expose the action links at the top of the list.
- Click the Group Settings link.
- The settings menu for the group loads.
- The settings menu for the group loads.
- Select Send Settings from the left menu options.
- Check the box to Override account settings for this page.
- Checking this box allows the group to break inheritance from the account-level settings, and substitutes the values explicitly selected for the group. Updates to account-level setting values will no longer be inherited.
- If you don't have the option to override the settings, your account-level admin settings have suppressed the group edit authority.
- Scroll down the page to the Identity Authentication Methods section and configure as needed.
Web Form exception to identity authentication
Web forms are employed in a multitude of unique use cases, and frequently there is a diminished demand for enforced identity authentication.
For accounts/groups that do not need to authenticate web form signatures, the option to disable email verification can be configured by:
- Navigating to: Account Settings > Global Settings > Web Forms (for account-level settings).
- Edit Group: {Group Name} > Group Settings > Web Forms (for group-level settings).
- Uncheck the option to Require Signer to verify their email address to accept web form signatures without verification.
- Removing the requirement to verify the web form signature does not remove the requirement for the signer to provide an email address.
Best practices and considerations
- All authentication methods and options can be configured at the account and group level.
- All groups inherit their default setting values from the account-level settings. Design your account-level settings to best leverage the automatic property inheritance, minimizing group configuration later.
- Agreements derive their authentication options from the group the agreement is sent from. If you aren't seeing the options you expect, check your group-level settings.
- Evaluate your identity authentication requirements for the types of documents you are sending and if they are subject to any compliance regulations. If "premium" authentication is required, ensure that sufficient volume for your expected traffic has been purchased.
- Determine if there are signature flows that may require second-factor authentications, like:
- Hosted Signatures
- Custom solutions designed to suppress email notifications (e.g., Workday)
- Signature flows that seek to get legal signatures from two or more recipients using the same (shared) email address
- Identify if/where having different authentication standards for internal recipients is valuable.
- Accounts with access to Custom Workflows can define very precise authentication methods for each of your signature flows, allowing a lower friction (and potentially higher volume) default value, while ensuring compliance in critical signature processes.
- Be aware that the individual authentication methods must be enabled before they become available to other services. Enabling a method exposes it for:
- Other administrative controls, such as the Security Settings for second-factor authentication methods
- Users to select during the standard Send process
- Custom workflows as built in the Workflow designer
- API driven send events
- Integration access (Dynamics, Salesforce)
- Other administrative controls, such as the Security Settings for second-factor authentication methods
Увійдіть до облікового запису