How to restrict DocuSign access to specific IP addresses using Conditional Access

Securing access to DocuSign is crucial. Many organizations use it to manage electronic signatures, handle contracts, agreements, and other sensitive business information.  

This is high-value data for attackers.  

Restricting DocuSign access to specific IP addresses adds an additional layer of security ensuring only approved users connecting from approved devices are able to access these sensitive documents.  

This article walks through restricting DocuSign access to one or more approved IP addresses using Conditional Access in Microsoft Entra ID.

Why you should restrict DocuSign access by IP address

Controlling where users can access DocuSign from is critical for preventing unauthorized activity. This is commonly used to ensure DocuSign can only be accessed from a corporate network or VPN, reducing the risk of unauthorized document signing or access from personal devices on untrusted networks.

Key benefits include: 

• Block sign-ins from untrusted networks where credentials may be compromised.  
• Ensure documents are only accessed within controlled, trusted environments.
• Limit access to corporate networks or VPN connections. 
• Add an additional security layer beyond passwords and MFA.
• Many security frameworks require restricting access to sensitive systems based on network location. 

Step-by-step: Restricting DocuSign access to specific IP addresses using Conditional Access

The approach uses two components working together:

• Named Locations: A saved list of trusted IP addresses or CIDR ranges defined in Entra ID.
• Conditional Access policy: A policy that blocks DocuSign sign-ins originating from any IP not on the trusted list.

NOTE: This configuration requires DocuSign to be integrated with Microsoft Entra ID via SAML SSO, and your organization domain must be claimed in DocuSign. If SSO is not yet configured, complete that setup first before proceeding. Refer to the DocuSign SSO KB article for setup instructions.

IMPORTANT: DocuSign SSO is enforced at the domain level. Users whose email domains are claimed in DocuSign will be redirected through SSO automatically. Users with unclaimed domains can still sign in directly with a DocuSign username and password, bypassing Entra ID entirely. Confirm all user domains are claimed in DocuSign before relying on this policy for full coverage.

Prerequisites

Before proceeding, confirm the following are in place:

• Microsoft Entra ID P1 or P2 license — required for Conditional Access.
• Conditional Access Administrator role or higher in Microsoft Entra ID.
• DocuSign enterprise app (SAML SSO) registered in your Entra ID tenant with SSO configured and your organization domain claimed in the DocuSign admin portal.
• Security Defaults disabled — Security Defaults and Conditional Access cannot run simultaneously.
• Known static IP address — the public IP address or CIDR range of each approved location.
• Break-glass admin account — must be excluded from this policy to prevent administrative lockout.

IMPORTANT: If your approved IP address is dynamic, this approach will not work reliably.
You must use a static IP before implementing IP-based Conditional Access.

Step 1: Create a Named Location for your trusted IP(s)

A Named Location defines the trusted IP addresses that Entra ID will use as a condition in the policy.

1. Sign in to the Microsoft Entra admin center at entra.microsoft.com.
2. Navigate to Protection > Conditional Access > Named locations.
3. Select + IP ranges location.
4. Name the location — for example:
   Trusted - Corporate Office
5. Check the Mark as trusted location checkbox.
6. Click + and enter your approved IP address or CIDR range. Examples:
   
   • Single IP address: 203.0.113.10/32
   • IP range (CIDR): 203.0.113.0/24
   • Multiple sites: Create a separate Named Location for each site then reference all of them in the policy.
7. Click Create.

Step 2: Create the Conditional Access policy

Create a policy that blocks DocuSign access from any location not on your trusted list.

• In the Entra admin center, navigate to Protection > Conditional Access > Policies.
• Select + New policy.
• Name the policy — for example: Block DocuSign - Outside Trusted IPs

Assignments: Users

1. Under Assignments > Users, select All users.
2. Under Exclude, add your break-glass admin account and any service or integration accounts that authenticate from dynamic IPs.

Assignments: Target Resources

1. Under Target Resources, select Cloud apps > Select apps.
2. Search for and select DocuSign.

Conditions: Locations

1. Under Conditions > Locations, set Configure to Yes.
2. Under Include, select Any location.
3. Under Exclude, select Selected locations, then choose your Named Location from Step 1.

TIP: This configuration reads: apply this policy to sign-ins from any location, except the trusted named location. Any DocuSign sign-in originating outside the trusted IP will be blocked before Entra ID issues a SAML assertion to DocuSign.

Access Controls: Grant

1. Under Access Controls > Grant, select Block access.
2. Click Select to confirm.

Enable policy

1. Set Enable policy to Report-only.
2. Click Create.

IMPORTANT: Do not set this policy to On immediately. A block policy applied to All users that is misconfigured will lock all users out of DocuSign instantly. Validate in Report-only mode first.

Step 3: Validate the policy

Before enabling enforcement, confirm the policy is evaluating sign-ins correctly.

1. In the Entra admin center, navigate to Identity > Monitoring & health > Sign-in logs.
2. Filter by the DocuSign application.
3. Open a sign-in from a user on your trusted IP and confirm the Conditional Access tab shows Would succeed.
4. If available, review a sign-in from an untrusted IP and confirm it shows Would fail with the location condition as the reason.
5. Investigate any unexpected Would fail entries for users on trusted IPs — this typically indicates the office is presenting a different egress IP than what is entered in the Named Location.

TIP: Use the What If tool under Protection > Conditional Access to simulate how a specific user signing in from a specific IP would be evaluated without waiting for a real sign-in event.

Step 4: Enable the policy

1. In the Entra admin center, navigate to Protection > Conditional Access > Policies.
2. Select the policy created in Step 2.
3. Change Enable policy from Report-only to On.
4. Click Save.

From this point forward, any DocuSign sign-in attempt from an IP address not included in your Named Location will be blocked. Entra ID will not issue a SAML assertion to DocuSign, and the user will be denied access at the identity provider level before reaching the DocuSign application.  

NOTE: Users who are already signed in to DocuSign when the policy is enabled will not be immediately signed out. The block takes effect on the next sign-in or token refresh, typically within one hour.  

Summary

The following summarizes the full configuration process:

Prerequisites

Confirm license, DocuSign SAML SSO configured with domain claimed, Security Defaults disabled, static IP(s) identified

Step 1

Create a Named Location with your trusted IP address(es)

Step 2

Create a CA policy targeting DocuSign, excluding the Named Location, with Block access

Step 3  

Validate in Report-only mode using sign-in logs and the What If tool  

Step 4  

Switch Enable policy to On

FAQs

Does this block all access to DocuSign from untrusted IPs? 
It blocks SAML-based authentication through Entra ID. However, users with unclaimed domains may still sign in directly with a DocuSign username and password, bypassing SSO. 

What happens if my organization hasn’t claimed all domains in DocuSign? 
Users with unclaimed domains can bypass Entra ID and authenticate directly with DocuSign credentials. This means Conditional Access policies will not apply to them. 

Can this work with dynamic IP addresses? 
No. This configuration requires static IP addresses. Dynamic IPs will result in unreliable enforcement. 

What is a Named Location? 
A Named Location is a list of trusted IP addresses or CIDR ranges defined in Microsoft Entra ID and used as a condition in Conditional Access policies. 

Why should I use Report-only mode first? 
Report-only mode allows you to validate policy behavior without enforcing it, helping prevent accidental lockouts due to misconfiguration. 

Do I need to exclude any accounts? 
Yes. Always exclude a break-glass (emergency) admin account and any service or integration accounts that authenticate from dynamic IPs. 

Will this immediately sign users out of DocuSign? 
No. Existing sessions are not terminated immediately. The policy takes effect on the next sign-in or token refresh, typically within about one hour. 

What happens if the policy is misconfigured and enabled? 
Because the policy targets all users, a misconfiguration can lock all users out of DocuSign. This is why validation in Report-only mode is strongly recommended before enabling.