Dropbox Sign SAML SSO configuration

SAML SSO on Dropbox Sign

Admins on a Premium plan can turn on Security Assertion Markup Language (SAML) single sign-on (SSO) in their account settings or in the admin console.

To complete setup, you need the following information from your Identity Provider (IdP):

• Identity Provider Single Sign-On URL
• Identity Provider Issuer
• X.509 Certificate

How to turn on SAML SSO 

To turn on SAML SSO in the admin console:

1. Log in to your Dropbox Sign admin account.
2. Click your initials.
3. Click Admin console.
4. Click Security.
5. Locate SSO.
6. Enter the information from your IDP.
7. Click Save. 

Optional settings

Allow standard logins for admins (recommended while testing)

Even after SAML SSO is turned on, admins can continue to log in to Dropbox Sign with their username and password. This is recommended during testing. Once the SAML SSO connection is verified to function properly, you can turn this off for optimal security.

IDP Side Setup

IDP setup flows and default values vary. See the following steps for an example using Okta:

1. Create a new SAML 2.0 web application and name it “Dropbox Sign”.

2. Your IdP will require the following information exactly as shown:
   • Signon URL (ACS URL): https://app.hellosign.com/account/ssoLogIn
   • Audience URI (SP Entity ID): https://app.hellosign.com
   • Name ID Format: EmailAddress
   • Application username: Email
   • Attributes Statements:
   • - FirstName --> user.firstName
   • - LastName --> user.LastName

3. (Optional) Encrypt the SAML assertion and upload the PEM certificate file. You can find the PEM certificate file in this article under PEM certificate file.  You can leave the standard defaults as displayed in the screenshot.

OneLogin

If OneLogin is your organization's SAML SSO provider, ensure the following information is filled out:

• ACS Consumer URL and Recipient fields: https://app.hellosign.com/account/ssoLogIn
• The ACS(Consumer) URL Validator field: ^https:\/\/app\.hellosign\.com\/account\/ssoLogIn$

Microsoft Entra ID

If Microsoft EntraID is your organization's SAML SSO provider, ensure the following information is filled out:

Dropbox Sign Settings

• Identity Provider Single Sign-On URL: https://login.microsoftonline.com/xxxxxxx-xxxx-xxxx-xxxx-xxxxxx/saml2 
  • Referred to as "Login URL" in Entra ID
• Identity Provider Issuer:
  • Referred to as “Entra ID Identifier" in Entra ID
• X.509 Certificate: Use "Certificate (Base64)"
  • WITHOUT "-----BEGIN CERTIFICATE-----" and "-----END CERTIFICATE-----" as single line string (no line breaks)

Entra ID Settings

• Identifier (Entity ID): https://app.hellosign.com 
• Reply URL (Assertion Consumer Service URL): https://app.hellosign.com/account/ssoLogIn
• Sign on URL: [empty]
• Relay State: [empty]
• User Attributes & Claims:

Testing

When both setups are complete, navigate to your IdP and assign the newly created Dropbox Sign application to the Dropbox Sign admin who initially set up SAML as follows:

1. Open the Dropbox Sign app in a new tab.
2. Ensure you’re logged out. 
3. Go back to the IdP.
4. Click the SSO link for Dropbox Sign. You should be automatically logged into Dropbox Sign as that admin account.

You can repeat the process for other test member accounts. When your testing has concluded and you’re ready to switch over, you can uncheck the Allow standard logins for admins checkbox and save your SSO settings.

PEM certificate file

prod-hellosign-saml-cert-20250609.pem