Adobe Acrobat Sign Identity Authentication Methods

Identity authentication

Authenticating a recipient's identity is a critical element of the Acrobat Sign system to obtain a legal signature and improve non-repudiation.

However, different business purposes have different demands on identity authentication. Consider the different levels of identity assurance you would demand for the following transactions:

• Time off request at work
• A child's grade card from school
• Private event registration
• Membership in a gym
• Medical records access
• CFR 21 part 11 compliant documents

Acrobat Sign provides a control set that allows authentication types to be defined at the account and group level with definable default values to streamline the sender's experience and better ensure compliance with company signature policies.

Keeping in mind that the more robust authentication methods insert more "friction" to the signature process, admins should configure the account or group defaults to support the most common authentication requirement, opting for the least complex option where possible and allowing editable options if some transactions demand more complex solutions.

Key terminology

Internal vs. External Recipients

Authentication controls make specific accommodations to configure authentication methods for two types of recipients, Internal and External:

• Internal recipients include every active user (as identified by the email address) within the same Acrobat  Sign account from which the agreement was sent
  
  • A list of every user in your account is a list of all internal users
  • It does not matter what group the recipient is in as long as the user is in the same account structure
• External recipients include every recipient email address not attached to an internal user
  • Every email address not included in an account-level user list is an external user

Delineating the recipients in this manner allows workflows to leverage high-level authentication for external recipients while using more cost-effective authentication for internal users.

Single-factor recipient authentication methods

Acrobat Sign Authentication

Acrobat Sign Authentication prompts the recipient to authenticate to the Acrobat Sign system.

This method is primarily used as a "low-friction" counter-signature option for your internal recipients when you have signature requirements requiring a logged and authenticated event.

Recipients are asked to authenticate to Acrobat Sign before they can interact with the agreement contents:

More details for Adobe Sign Authentication can be found here >

One-Time Password via email  

The One Time Password via email (OTPvEm) authentication method supplies a single-factor authentication, providing some protection with minimum user friction.

Because the one-time passcode is delivered to the same email address as the original signature link, the OTPvEm authentication method is considered a single-factor authentication method. However, the OTPvEm does not require users to create an account or log in to another application. They only need access to their email, making this method lower friction.

And using OTPvEm provides some additional security that simply relying on the email link does not. For example:

• Access to an email does not mean that the email box is compromised. The OTMvEm authentication will maintain the agreement's security if an email link is exposed, but the email box is secured.
  
• Suppose an agreement email is improperly forwarded (vs. proper delegation). In that case, the OTPvEm challenge will prevent the agreement from being accessed, preserving the audit report integrity regarding the identified signer's email and the actual signer.

The recipient must enter the passcode within 60 seconds of asking for the code. Once the code is successfully entered, the recipient can interact with the agreement.

More details for One Time Password via Email authentication can be found here >

Second-Factor Authentication (2FA)

Acrobat Sign supports several second-factor authentication methods for higher-value transactions that demand more than single-factor verification.

The method of authentication is usually dictated by the type of document or industry of the involved parties. It is incumbent on the admin to understand their internal signature policies and possible compliance demands.

Below is a summary of the available second-factor authentication options with links to more detailed descriptions:

"Premium" signer authentication methods

Phone, KBA, Government ID, and Cloud-based digital signatures are "premium" authentication methods.

Premium authentication methods are a metered resource that must be purchased prior to use. Contact your success manager or sales agent for details.

Automatic cancelation thresholds

All second-factor authentication methods have configurable thresholds that cancel the agreement when a recipient fails to authenticate an unacceptable number of times.

• The agreement owner (sender) will be notified that the agreement is canceled
  • Only the sender is notified.
  • Canceled agreements cannot be returned to active status. A new agreement must be created.

Digital Identity verification

Digital Identity verification leverages a Federated identity provider (IdP) that is licensed externally to the Acrobat Sign service and must be configured prior to becoming accessible when composing agreements.

Full details of the Digital Identity solution can be found here >

The details of the recipient experience vary based on the identity provider that the sender uses. At a high level, the recipient is informed that identity verification is to be resolved through a federated IdP, with a Verify Identity button available to trigger the verification process.

How senders select an authentication method

When configuring an agreement, senders can select an authentication method from a drop-down menu just to the right of the recipient's email address.

Most authentication methods can be configured to be the selected default value to simplify the sending process. Only the Digital Identity options can not be configured as a default authentication value.

The recipient experience

Typically, a recipient is first made aware of an agreement awaiting their attention via email.

• If the agreement is sent with no (None) authentication, selecting the Review and sign button in the email opens the agreement for viewing and action.
• If the agreement has an additional authentication method configured, selecting the Review and sign button in the email opens the authentication challenge page.
  • Once the challenge is satisfied, the agreement is opened for interaction.
    

Audit Report events

Each second-factor authentication method has an explicit success message that identifies the method used.

If no (None) authentication is selected, the audit report only indicates that the document was signed:

Configurable options and defaults

Admin controls

The account-level settings can be accessed by logging in as an Adobe Sign account-level admin and navigating to Account Settings > Send Settings > Signer Identification Options

All controls can also be configured at the group level. Remember that:

• All groups inherit the account level settings by default.
• Group-level configurations override the account-level settings.
• All options available on the Send page are derived from the settings of the group the agreement is being sent from.

The controls are divided into two sections:

• Signer Identification Options - The primary set of identity authentication settings. These values are applied to all recipients of all agreements created in the sending group with these exceptions:
  • API-based processes, which can restrict the sender's options (Integrations, workflows, custom applications).
    
  • When Enable different identity authentication methods for internal recipients is enabled (see below).
    
• Identity Authentication for Internal Recipients - This subset of settings allows the group to define a different set of identity authentication methods for internal recipients. This provides the benefit of:
  • Less frustration for internal signers.
  • A less complex signature process accelerates signing for recipients that might have to counter-sign many agreements.
  • The costs for premium authentication can be obviated for internal recipients.

Identity Authentication Methods

The primary authentication controls:

• Require senders to specify one of the enabled authentication methods - When enabled, senders are required to select an authentication method other than None as the default authentication method. None may not be selected.
  
• Allow Acrobat Sign to auto-populate the Signers email address for each authentication challenge - This setting only applies to the Acrobat Sign authentication method. When enabled, the recipient's email address is automatically inserted where needed for authentication.
• Don't challenge the signer to re-authenticate if they are already logged in to Acrobat Sign - When enabled, signers are not challenged to re-authenticate if they are currently logged in to Acrobat Sign.
• Allow Senders to download a Signer Identity Report for agreements containing Verified Signatures - Signer Identity Reports (SIR) are available for the Government ID and Digital Identity authentication methods. This setting, when enabled, allows the sender of the agreement to download the SIR from their Manage page.
  
• Enable the following identity authentication methods - This prefaces the list of authentication options available to the senders.  Select one or more according to your security and compliance needs.
• By default, use the following method - Establishes the default authentication method inserted when a recipient is added to a new agreement.
• Allow senders to change the default authentication method - If enabled, the sender has the option to select any method enabled.
  
  • When disabled, only the default method of authentication can be used.

Identity Authentication for Internal Recipients

The internal recipient controls provide the options you would like to apply to internal recipients:

• Enable different identity authentication methods for internal recipients - When enabled, internal recipients are treated as an exception to the primary authentication rules and instead are presented with the default authentication options defined in the Identity Authentication for Internal Recipients section.
  
• Enable the following identity authentication methods - This prefaces the list of options available for internal recipient authentication.  Select one or more according to your security and compliance needs.
  • Adobe Sign authentication provides a low-cost/low-friction authentication method when your senders are also countersigners.
    
• By default use the following method - Establishes the default method inserted for internal recipients when a new agreement is created.
  
• Allow senders to change the default authentication method - This grants the sender the authority to change the default authentication method to any other option enabled by the admin.

Web Form exception to identity authentication

Web forms are employed in a multitude of unique use cases, and frequently there is a diminished demand for enforced identity authentication.  

For accounts/groups that do not need to authenticate web form signatures, the option to disable email verification can be configured by:

• Navigating to: Account Settings > Global Settings > Web Forms (for account-level settings).
  
  • Edit Group: {Group Name} > Group Settings > Web Forms (for group-level settings).
• Uncheck the option to Require Signer to verify their email address to accept web form signatures without verification.
  • Removing the requirement to verify the web form signature does not remove the requirement for the signer to provide an email address.

Best practices and considerations

• All authentication methods and options can be configured at the account and group levels.
• All groups inherit their default setting values from the account-level settings. Design your account-level settings to best leverage the automatic property inheritance, minimizing group configuration later.
• Agreements derive their authentication options from the group the agreement is sent from. If you aren't seeing the options you expect, check your group-level settings.
  
• Evaluate your identity authentication requirements for the types of documents you are sending and if they are subject to any compliance regulations. If "premium" authentication is required, ensure that sufficient volume for your expected traffic has been purchased.
• Government ID Authentication: (i) is not intended for regulated or high-value electronic signature workflows and use cases; (ii) cannot identify all fraudulent or “fake” identification documents; and (iii) may not replace the need for human review.
• Determine if there are signature flows that may require second-factor authentications, like:
  • Hosted Signatures
  • Custom solutions designed to suppress email notifications (e.g., Workday)
    
  • Signature flows that seek to get legal signatures from two or more recipients using the same (shared) email address
    
• Identify if/where having different authentication standards for internal recipients is valuable.
• Accounts with access to Custom Workflows can define very precise authentication methods for each of your signature flows, allowing a lower friction (and potentially higher volume) default value, while ensuring compliance in critical signature processes.
• Be aware that the individual authentication methods must be enabled before they become available to other services. Enabling a method exposes it for:
  • Other administrative controls, such as the Security Settings for second-factor authentication methods
    
  • Users to select during the standard Send process
  • Custom workflows as built in the Workflow designer
  • API-driven send events
  • Integration access (Dynamics, Salesforce)