Organizations that have stricter security requirements can configure SAML SSO. Learn more about SAML SSO in Figma →

You can use Okta as your identity provider to authenticate and provision users. Figma supports SAML SSO initiated from both Okta (identity provider) and Figma (service provider).

Add the Figma app to Okta

To connect Figma and Okta, you will first need to add the Figma app to your Okta account. This will generate a IdP Metadata URL, which you'll need to configure SAML SSO in Figma.

1. Log in to your Okta account and head to the Applications page.
2. Select Add Application from the options.
3. Search for Figma and click the Add button to add Figma to your account.
4. Once installed, go to the Sign On page.
5. Right click on the Identity Provider Metadata link and choose Copy link address. The link should look like this: https://example.okta.com/app/abc123/sso/saml/metadata

Set up SAML SSO in Figma

1. From the file browser, click Admin.
2. Select Settings at the top of the screen.
3. In the Login and provisioning section, click SAML SSO.
4. Click Configure SAML and select Okta from the options.
5. Enter the IdP Metadata IRL from Okta and click Review.
6. Check the box to confirm This information is correct... and click Configure SAML SSO.
7. Click the Copy link next to your Tenant ID. You'll need this to complete the set up process in Okta.

Set up Figma in Okta

Now you have your Tenant ID, you can complete the configuration process in Okta. You will need to configure the Figma app and mapping user attributes between applications.

Configure SAML SSO

1. Open the Figma app in Okta.
2. Go to Sign On tab and click Edit.
3. Scroll down to the Advanced Sign-On Settings section.
4. Enter your Tenant ID in the field provided.
5. In the Application username format field, select Email from the options.
6. Click Save to complete the process.

Assign users to the application

Now you can start assigning users to the application. As part of this process, you may be asked to provide additional information about each user.

Figma supports some basic attributes, as well as attributes only available to SCIM Enterprise users.

Start adding users to the application in the Assignments tab on the far right.

Supported Basic Attributes

Supported SCIM Enterprise User Attributes

Set up automatic provisioning with SCIM

Okta supports automatic provisioning with SCIM. To set up SCIM you will need to generate an API token in Figma then add this to Okta.

Generate an API token in Figma

1. From the file browser, click Admin .
2. Select Settings at the top of the screen.
3. In the Login and provisioning section, click SCIM provisioning.
4. Click Generate API Token in the dialog.
5. Copy the API token to your clipboard. You'll need this to complete the process in Okta.

Configure automatic provisioning in Okta

Make sure the following functions are enabled in Okta:

• Create users
• Update user attributes
• Deactivate users

1. Open the Figma app in Okta.
2. Go to the Provisioning tab in the Figma app.
3. Click the Configure API Integration button.
4. Check the box next to Enable API Integration.
5. Enter the API Token in the field provided.
6. Click Test API Credentials to ensure it's set up correctly.
7. When you get a success message, click Save to apply.
8. A few more options will now appear under the Provisioning section. Select To App in the left-hand menu.
9. Click Save to apply.

Let your users know about the change

The first time a user logs into Figma using SSO, or after they are provisioned via SCIM, they'll receive a verification email from SendGrid. This email contains a unique 6-digit pin, which they'll use just once as an additional security measure during their initial login.

To make sure users don't mistake the email for spam or a phishing attempt, you may wish to let them know about this extra step in advance.