Skip to main content
Connect DocuSign to Oleria to see who has access to your DocuSign accounts, templates, and folders, and who can send on behalf of whom. Oleria also flags risks such as admins without single sign-on (SSO) and shadow users who aren’t in your organization directory. A single Oleria connection covers your entire DocuSign organization - Oleria discovers every account the connection can reach and inventories each one.

​
What Oleria discovers

​
Prerequisites

  • A DocuSign organization with organization administration enabled (DocuSign Admin). One account can belong to only one organization; an organization can contain many accounts.
  • A DocuSign user who is an organization administrator and whose permission profile grants account administration in each account - this is the user Oleria will act as (the “impersonated user”) for both reads and remediation. A dedicated service account is recommended over an employee account.
  • The ability for that specific user to sign in to DocuSign during the one-time connection step below.
DocuSign uses Individual Consent for this integration: whichever DocuSign user completes the sign-in step during setup becomes the user Oleria acts as going forward - it is not a separate “any org admin approves for everyone” step, so sign in as the exact account you want Oleria to impersonate, not just any administrator. That user must be an organization administrator, not just an account admin. Skipping this doesn’t break setup - the connection still completes and syncs - but Oleria silently falls back to only the accounts that user belongs to instead of the whole organization, and shadow-user detection and the SSO/federation risk signals in What Oleria discovers below produce nothing, with no error surfaced anywhere. Use a dedicated service account rather than an employee account so the connection doesn’t break if that person leaves or changes their password.

​
Connect DocuSign to Oleria

DocuSign authentication is fully OAuth-based and Oleria-managed - there is no DocuSign app to create, no RSA key to generate, and no user GUID to look up. You only choose an environment and sign in once to grant consent.
1

Open the integration

Sign in to your Oleria workspace and navigate to Integrations -> DocuSign -> Connect.
2

Choose your environment

Select Production or Demo (DocuSign’s developer sandbox), then select Authenticate with DocuSign.
3

Sign in and approve access

You’re redirected to DocuSign. Sign in as the exact user you want Oleria to act as (see Prerequisites above), then approve the requested permissions. DocuSign redirects you back to Oleria automatically.
4

Complete the connection

Oleria captures the signed-in user’s identity, validates the connection, discovers your DocuSign accounts, and begins the first sync.

​
Verify the integration

Confirm DocuSign appears on the Connected tab of your Oleria Integrations page. After the first sync completes, you can review the discovered users, groups, permission profiles, and access in your Oleria workspace.

​
Permissions for remediation (optional)

During setup, DocuSign asks the signed-in user to approve these scopes: signature, impersonation, organization_read, account_read, user_read, permission_read, group_read. impersonation lets Oleria act as this user without further sign-ins; signature is DocuSign’s eSignature API scope, used for inventory reads and, if permitted, remediation writes. What remediation can actually do is bounded by the impersonated user’s permission profile, not by these scopes. Oleria checks these permissions before offering an action - an under-privileged connection shows the action as unavailable rather than failing mid-run.

​
Remediation actions

  • Disable / Enable user - closes or reactivates the user’s membership across every account they belong to in the organization. Reactivation sends the user a DocuSign activation email, which they must click to become fully active.
  • Add / Remove from group - targets the specific group you selected in its owning account. Does not affect same-named groups in other accounts.
  • Assign / Remove role - changes the user’s permission profile in the account that owns that role.

​
Known limitations

  • Credential management: Oleria owns and rotates the OAuth credentials behind this integration - there is no integration key, RSA key, or client secret for you to create, store, or rotate.
  • Changing the impersonated user: editing the existing connection and re-authenticating does not change who Oleria acts as - the original impersonated user is retained. To change which DocuSign user Oleria acts as, delete this connection and create a new one, signed in as the new user.
  • Multi-account: one connection manages the entire organization. Disable/enable is organization-wide by design - a user is closed in each account they belong to. Per-account-only disable is not currently supported.
  • Activity requires the DocuSign Monitor add-on. Without it, activity data is empty; all other data remains unaffected.
  • Resources: templates and folders are treated as durable, ACL-governed resources and are inventoried with their access grants. DocuSign envelopes are transactional documents and are not inventoried.

​
Contact us

For questions about this integration, contact us at support@oleria.com.