Restrict access to personal Figma accounts on a corporate network

Related Videos

• Disable cursor chat

  Before you begin

  Available on the Enterprise plan.

  Organization admins only.

  By default, people can send messages in Figma design and FigJam files using cursor chat.

  Figma doesn’t keep a record of these messages, so turning off cursor chat can help regulated customers use Figma in a way that meets their compliance needs.

  Disable cursor chat

  When cursor chat is disabled, users won’t be able to start a cursor chat in both Figma design and FigJam files.

  1. From the file browser, select Admin settings.
  2. Select the Settings tab.
  3. Under Other, find Cursor chat and move the toggle to the off position.
• Deploy Figma via Microsoft Installer

  Figma provides a Microsoft Installer (MSI) for Windows. This helps IT admins deploy Figma to multiple machines simultaneously and control software updates.

  Download the latest installer

  The MSI will install Figma in Program Files for all users of a machine.

  1. From the file browser, select Admin settings.
  2. Click the Settings tab.
  3. Under Other, select Enterprise installer and click Download.

  Tip: The installer supports msiexec commands.

  Get notified about available MSI updates

  Figma will not automatically update when you deploy the app using the MSI installer. You can get notified about updates by subscribing to this RSS feed: https://desktop.figma.com/win/releases.xml

• Guide to merging organizations

  Before you start

  Who can use this feature

  Available on the Organization and Enterprise plans

  Only organization admins can request merges

  Working with Figma’s support team, you can merge the users, files, projects, teams, and plugins from one Figma organization into another.

  During a merge, one organization becomes the parent, and the other the child.

  • The parent organization keeps its existing users, content and settings.
  • All users and content from the child organization move into the parent organization. At the end of the process, Figma removes the child organization.

  What happens during a merge?

  • All domains associated with the child organization are added to the parent organization
  • Figma automatically prefixes teams from the child organization with the child organization name (for example: Acme-[team name])
  • All users from the child organization keep their existing roles when joining the parent organization, unless they are explicitly restricted in the parent organization
  • Organization admins in the child organization become members in the parent organization
  • Activity logs from the child organization are not included in the merge and are deleted after the merge is complete
  • Shared fonts from the child organization are not included in the merge and will need to be re-added to the parent organization
  • Deleted users’ drafts from the child organization are not included in the merge and should be moved to a team beforehand

  What happens after a merge is complete?

  • The parent organization’s settings will apply, including those for domain capture, SAML, SCIM, public links, and approved plugins.
  • Users from the child organization will need to login with the parent organization’s identity provider and will use the parent organization moving forward.

  Things to check before requesting a merge

  • Will users from the child organization be able to authenticate using the parent organization’s identity provider?
  • Will you need to bulk update users’ email addresses as part of this process?

  Request a merge

  To request a merge, please email admin-support@figma.com with the following:

  • Any questions about the merge behavior detailed above
  • An organization admin from both organizations copied on the thread
  • The URL and name of both organizations and which is the parent organization and child organization
  • Will users from the child organization be able to authenticate using the parent organization’s identity provider?
  • Will you need to bulk update users’ email addresses as part of this process?

  Please note we need approval from organization admins at both organizations to start a merge.

  Tip: Here’s how to get the URL of your organization:

  1. Log in to your organization in a web browser.
  2. From the file browser, click All teams or All workspaces.
  3. Copy the entire URL in your browser address bar.
• Guide to managing a Figma organization

  Before you begin

  This guide is for customers on the Organization and Enterprise plans.

  Organization admins only.

  Organization admins have an extra item in their file browser sidebar called Admin settings. This is where you can manage high-level settings for your Figma organization, including:

  • Access
  • Members and guests
  • Workspaces (Enterprise plan only)
  • Teams
  • Resources like fonts, plugins, and libraries
  • Additional security and privacy controls
  • Billing

  Understanding admins in Figma

  Figma has three types of admins, with cascading levels of permissions.

  • Organization admins have the highest level of permissions, and can do everything a workspace admin and team admin can do. Organization admins control settings that affect everyone in the organization, such as authentication, billing, and security.
  • Workspace admins are only available on the Enterprise plan with workspaces enabled. Workspace admins are assigned by organization admins and manage workspaces where they are an admin.
  • Team admins help manage teams within an organization, including people, resources, and access to the team within the organization. Team admins are assigned to teams by organization or workspace admins.

  This guide focuses on organization-wide settings, but organization admins can also manage workspaces and teams.

  Manage access to the organization

  Claiming domains

  With domain capture, you can make sure any new users who sign up are automatically added to your organization. This helps admins keep all users at the company within a single Figma organization.

  • Domains and domain capture
  • Enable or disable domain capture
  • Add or remove organization domains

  Login and authentication

  You can enable single sign-on (SSO) with an identity provider (IdP), and choose how users authenticate themselves.

  • Set login and authentication method
  • Guide to SAML SSO

  Provisioning with SCIM

  Figma supports SCIM provisioning, making it easier to manage large teams or changes in team membership. With SCIM, you can synchronize user data, such as names and emails, between your IdP and Figma. On the Enterprise plan, you can also set user roles using SCIM, which gives admins more control over cost changes between billing cycles.

  • Set up automatic provisioning via SCIM
  • Set member roles via SCIM*

  *Only available on the Enterprise plan

  Manage members and guests

  The Members tab is where you can view activity, manage access, and review paid licenses for every member and guest in your organization.

  Manage members and guests

  • View members and guests
  • Manage roles in organization
  • Set default roles*
  • Manage drafts of deleted members
  • Remove people from an organization
  • Make someone an organization admin
  • Add or remove workspace admins

  Manage guest-specific controls

  • Invite guests to organization resources
  • View guest access
  • Restrict or prevent guest access*
  • Accept guest access requests*

  *Only available on the Enterprise plan

  Tip: Use the Activity log to review how people in the organization interact with files and resources.

  Manage workspaces

  Workspaces are collections of teams, people, and resources within a Figma organization. They help companies with many business units, sub-brands, or design systems add structure to their Figma organization. Workspaces are only available on the Enterprise plan and can only be enabled by an organization admin.

  • Launch workspaces in your organization*
  • Manage workspaces in an organization*

  *Only available on the Enterprise plan

  Manage teams

  Organization admins can manage all open and closed teams, as well as any secret teams they have been invited to.

  • Manage teams in an organization
  • Manage who can create a team in an organization*

  *Only available on the Enterprise plan

  Manage resources

  Resources like plugins, widgets, libraries, and fonts help streamline design and collaboration. You can control how these resources are used to match your company’s security and privacy requirements.

  Plugins and widgets

  Plugins and widgets are third-party scripts or applications that extend the functionality of Figma design and FigJam.

  • Create private organization plugins
  • Approve plugins in an organization
  • Approve organization widgets
  • Save plugins for the organization

  Libraries

  Organization admins can make libraries available to all teams in the organization. This helps people access a library’s components and styles in their Figma design and FigJam files, without having to manually search for and add the library.

  • Manage default libraries for an organization
  • Manage default libraries for a workspace*

  Tip: Every member of an organization, including organization admins, can view library analytics to understand how libraries are used across the organization.

  *Only available on the Enterprise plan

  Fonts

  Figma organizations can upload and share custom fonts to specific teams or across the organization. This removes the need to share, install, or update fonts for individual users. It also allows people using Chromebooks and Linux to access custom fonts.

  • Upload custom fonts to an organization

  Additional security and privacy controls

  The security and privacy of your organization is extremely important to us. Figma has different controls for keeping your data secure:

  • Restrict access to personal Figma accounts on a corporate network*
  • Restrict access to content from outside your organization*
  • Manage public link sharing
  • Require password protection on files*
  • Enable or disable audio for organization
  • Disable cursor chat
  • Disable open sessions

  *Only available on the Enterprise plan

  Manage billing

  In Figma, every admin, member, and guest has a designated role within our two products: Figma design and FigJam. Their role, as either a Viewer or an Editor, determines whether they are a free or paid user of that product. Keep in mind that when you change someone’s role, you might also be changing their billing status.

  • Guide to billing at Figma
  • How free users become paid users
  • Manage billing on the Organization and Enterprise plans
• Privacy and security in organizations

  Before you start

  Who can use this feature

  Applies to the Organization and Enterprise plans

  Only organization admins can manage an organization's security settings.

  Organizations give you greater control over what's shared within your business.

  Privacy and security by design

  Security is part of everything we do. It’s top of mind in how we work, treat customer data, and develop our product.

  Figma has completed a SOC 2 Type II audit. SOC 2 is a security compliance standard for software companies in the United States. Its guidelines and policies help businesses, like Figma, protect customer data.

  Learn more about Figma's Privacy and Security policies.

  File and draft ownership

  The organization has ownership over all the files created within the organization. This includes files within a member's drafts, or external teams. When you remove a member, all their teams, files and projects will stay in the organization.

  Figma will also move files a deleted member's drafts to a shared folder in the organization. Organization admins can access these files and delete or redistribute them.

  Control link sharing

  There are a few ways members can get access to files in an organization:

  • A member invites them to the file
  • They are a member of the team or project
  • They open a link to a Figma file (link sharing)

  Use link sharing settings to define who can open the file, and whether they have view or edit access. This includes members of the organization and guests outside of the organization.

  You can update the link sharing settings for each file. The default settings are Anyone at organization with link and can view.

  Discover files

  Choose how members of your organization can share and access files via links. Guests of an organization can only access files and teams to which they have been invited.

  • Choose Anyone with the link to allow people inside and outside the organization to access the file. This includes both members of the organization and Guests who have the link.
  • Choose Anyone at organization with the link: organization members will need to have a link to the file to access it. When they open the link, they can view the file.
  • Choose Anyone at organization to allow anyone in the organization to access the file. Use this setting for library files you want to share with the whole organization. Guests of the organization won't be able to access these files unless you invite them to the file or team.
  • Choose Only people invited to this file if you only want team members or people you explicitly invite to the file to access it.

  Interact with files

  Choose what level of access other members of the organization have, once they open the file.

  This setting applies to anyone who opens the file, unless they're a member of the team or have an explicit role on the file.

  • Choose can edit to give anyone who opens the file the option to edit.
  • Choose can view to allow people to view the file without being able to make any edits.
  • Choose can view prototypes only to only allow them to access the prototype, and not the designs in the file itself.

  

  It's possible to disable public link sharing in an organization. This prevents anyone outside the organization from accessing files via the file link.

  Organization admins can turn link sharing off and on on the Settings tab of the organization's Admin settings. Learn more about organization admin →

  Permissions

  In a team, permissions determine how members can interact with files and projects in the team.

  In an organization, every member of an organization has a role and an account type. This controls what they can access, and how they interact with the organization.

  • Register official company domains for email addresses
  • Invite members to your organization as members or guests. Guests can only access resources you invite them to.
  • Set and update permissions at any time. Downgrade members to Viewer restricted to restrict their access.
  • Set different levels of organization access levels for teams.

  Learn more about permissions in an organization →

  Activity logs

  Activity Logs provide a record of how users are interacting with files and resources. This allows you to track what's happening within your organization:

  • See who is accessing, copying and sharing Files
  • Track changes made to teams, projects and file permissions
  • View activity for individual members
  • Track changes made by organization admins
  • Identify and prevent misuse of organization Resources

  Learn more about activity logs →.

  SAML SSO

  Organizations that need enhanced security requirements can configure SAML SSO.

  Security Assertion Markup Language (SAML) is a security standard for logging into applications.

  Single Sign On (SSO) allows users to log into many applications or websites via one set of login details.

  Figma has integrations with the following providers:

  • Azure Active Directory
  • Okta
  • OneLogin
  • Google SSO

  You can also set up a custom SAML configuration with a provider that isn't on this list.

  Learn more about SAML SSO →.

  Two-factor authentication

  If you don't have SAML or Google SSO enabled, members of your organization can add extra security via two-factor authentication (2FA).

  When enabled, members will need to confirm their identity every time they log in to Figma.

  Members will need to set this up individually, in their account Settings. There isn't a way to enable 2FA or make it mandatory across an entire organization.

  If you're using SAML SSO, you may be able to enable 2FA with your identity provider.

  Learn more about two-factor authentication →

  Restricted access

  Enterprise organizations have several options to restrict access and prevent data loss.

  • Restrict access on a corporate network
  • Restrict access to external content
• Domains and domain capture

  Before you start

  Who can use this feature

  Supported on the Organization and Enterprise plans.

  Only organization admins can add and remove domains.

  In this article, we’ll explore two key concepts of organization membership: domains ↓ and domain capture ↓

  Domains

  Domains and domain names identify entities online. We can view a domain name in an entity’s website address www.figma.com or email address support@figma.com.

  Domains let Figma know who is a member of an organization, and who is a guest. Members versus guests →

  ACME Corp has three domains registered to their organization: acme.org, acmecorp.org, and dev.acme.org.

  Anyone with an acme.org, acmecorp.org, or dev.acme.org email address is a member.

  Anyone without one of those emails is a guest. For example: name@gmail.com or name@notyourdomain.com

  Organizations can have multiple domains, including subdomains. Organization admins can add or remove organization domains.

  Domain capture

  Domain capture affects how Figma handles accounts registered to organization domains. When domain capture is on, any accounts with a company domain are added to the organization.

  New members (people with company emails) will join the existing organization and can’t create separate company accounts. This applies to existing and future accounts.

  Domain capture doesn’t apply to guests—anyone without a company email. Guests must be invited to teams, projects, or files to access the organization. Members versus guests →

  Domain capture impacts how you add members, what happens to their drafts when they join the organization, and what happens when they’re removed.

  Organization admins can request to enable or disable domain capture.

  

  How do I tell if domain capture is on? Usually, the way you signed up for your organization plan will determine if domain capture is active:

  • Sales team: domain capture is on by default.
  • Upgrade in Figma: domain capture is off. Reach out to the Figma support team to turn this on for your organization.

  Add members

  There are a number of ways to add members and guests to an organization. An organization's domain capture settings determine which options are available.

  Method	Domain capture on	Domain capture off
  Company accounts added to organization by default	✓	✕
  Add a member to your organization	Figma adds all company accounts to the organization by default	✓
  Invite members to an organization team	Figma adds all company accounts to the organization by default	✓
  Invite guests to teams	✓	✓
  Invite guests to files or projects	✓	✓
  Add members to your identity provider (SAML SSO)	✓	✓

  Note: If you are on the Enterprise plan, organization admins can restrict or control guest access. Inviting guests to organization resources may be blocked or require admin approval.

  Domain capture on

  ACME Corp has two domains registered to their organization: acme.org and dev.acme.org. They want everyone with an ACME email to be a part of the same organization, so they turn on domain capture.
  
  Figma will now add anyone with a verified company email to the existing organization. This includes anyone that:

  • Uses an email address with an acme.org or dev.acme.org domain
  • Already has a Figma account registered under their company email
  • Creates a new Figma account using their company email

  Domain capture off

  ACME is an international company with offices around the globe. They want each a separate organization for each region: North America; Asia Pacific; and Europe, the Middle East and Africa.

  • The North America organization registers domains for acme.org and na.acme.org
  • The Asia Pacific organization registers domains for acme.org and apac.acme.org
  • The EMEA organization registers domains for acme.org and emea.acme.un

  Anyone with an acme.org email can join any of the three organizations. Members can also create new teams or organizations separate to the existing organizations.

  Anyone with a location-specific email can join the organization for their specific location. For example: Anyone with an emea.acme.org address can access the London-based organization.

  Draft ownership

  Organizations usually have extra requirements or restrictions around privacy and security. If you're a part of an organization, your account includes any organizations linked to your account as well as any external teams. Explore organizations →

  • Organizations: teams, files, and resources inside the organization. Everything within the organization is owned by the organization and can be manage by organization admins.
  • External teams: any teams they're a member of that aren’t in an organization. This could be teams excluded from the upgrade, as well as teams outside the company they joined with a work email. These are outside the organization and can't easily be accessed if the member leaves.

  When members are added to an organization, a person’s drafts come with them. The location of their existing drafts folder is determined by the organization's domain capture settings.

  Location of drafts folder based on domain capture setting:

  Domain capture on	Domain capture off
  Find migrated drafts in the organization	When the member joins the organization dictates where their existing drafts will live: At upgrade: In organization. After upgrade: in external teams

  Remove members

  Everything within the organization is owned by the organization and can be manage by organization admins. When you remove a member from your organization, Figma will:

  • Remove their access to the organization and prevent them from accessing any teams, files or libraries in the organization.
  • Transfer ownership of any teams to the member with the highest permissions on that team. If they also own individual files and projects, Figma will transfer ownership to an existing Editor.
  • Move any Drafts from the organization space to the organization's Shared projects folder. Files in the Shared projects folder are locked for all other collaborators. Organization admins can claim ownership of the project to unlock files and assign them a new owner.

  Domain capture will determine if members can access to their account outside the organization.

  Account access based on domain capture setting:

  Domain capture on	Domain capture off
  Members or guests will lose access to their Figma account. This includes drafts, teams, and shared files or projects in external teams.	Figma detaches their email address from the organization. If they still have access to that email address, they may be able to access their external teams.

  Note: If you have SAML SSO enabled, you’ll need to de-provision them with your identity provider. This will prevent them from logging in to their Figma account, regardless of domain capture settings.

• Add or remove organization domains

  Who can use this feature

  Supported on the Organization and Enterprise plans.

  Only organization admins can request changes to organization domains.

  Domains are the way we identify entities on the internet. We can view domains in a website's URL www.figma.com or email address support@figma.com. In Figma, domains determine who is member of an organization, and who is a guest.

  Organizations can have multiple domains registered to their business, including subdomains. You need to add any domains you want to use in Figma. Especially if you want to authenticate members using SAML SSO.

  View or update domains

  Organization admins let Figma know which domains they have, as part of the upgrade process. You can submit requests to add and remove domains, as needed.

  Organization admins can view domains in the organization's Admin settings:

  1. Open the organization in Figma.
  2. Click Admin Settings in the sidebar.
  3. Select the Settings tab.
  4. View the current domains in the Domains section.
  5. Click Contact support to request a change to your settings.
• Set default roles

  Who can use this feature

  Supported on the Enterprise plan.

  Only organization admins can adjust default roles.

  On the Enterprise plan, organization admins can set default roles for anyone joining the organization. This helps organization admins to better control and manage new editor seats.

  Default roles apply to both members and guests. You can set default roles for both Figma design files and FigJam files.

  What are roles?

  Every member or guest in an organization has a Figma design role and a FigJam role. People can have different roles on each file type.

  These roles determine the highest level of access they can get on each product. There are three roles: viewer, viewer - restricted, and editor. Roles in Figma →

  Roles also determine a person’s billing status. Figma only includes editor roles— otherwise known as seats or licenses—in the organization's billing.

  For example: a Product Manager (PM) has an editor role on FigJam but only a viewer - restricted role on Figma design. They will only contribute to a paid editor seat for FigJam; a FigJam seat on the Enterprise plan is $5/month or $60/year.

  Note: On the Enterprise plan, you can also set member roles via SCIM. If you set member roles via SCIM, Figma will honor the SCIM provisioned role over the default role. If you have SAML and basic SCIM enabled, but don't use SCIM to set roles, Figma will use the default role setting.

  You can identify members with roles set by SCIM with the next to their role in the Members tab.

  Set default role

  Organization admins can set default roles in the organization's admin settings.

  1. Open the organization in Figma.
  2. Select Admin settings in the left sidebar.
  3. Select Settings from the menu bar.
  4. In the Login and provisioning section, select the Default role setting.
  5. Select default roles for both Figma design and FigJam using the fields. Choose from:
     • Viewer: Admins and other editors can upgrade them to an editor role. Viewers can also upgrade themselves to a paid status by taking an upgrade action. (default)
     • Viewer restricted: Only an organization or workspace admin can upgrade them to an editor role.
     • Editor: They join with a paid editor seat on that product. New editors are included in your quarterly true-up.
  6. Select Save to apply your changes.

  Monitor related activity

  Organization admins can monitor activity related to roles and upgrades in the organization's activity logs. There are three types of events related to roles and licenses:

  • Default role: When an organization admin sets or changes the default role for the organization. Figma records separate events for each file type.
  • Org role changed: When a member or guest’s role is explicitly changed by an organization or workspace admin. This includes any upgrades and downgrades outside of user-initiated requests.
  • Upgrade requests and activity: Any activity related to member or guest-initiated upgrade requests. This includes any of the following events:
    • A user requested access or upgrade
    • Workspace admin approved request
    • Organization admin approved request
    • Workspace admin rejects request
    • Organization admin rejected request

  Monitor activity →

• Deploy Figma on Mac OS

  Who can use this feature

  Supported on any team or plan.

  This article is for IT administrators installing Figma on employee machines.

  To install Figma on your own device, please visit Figma's downloads page. Learn more about the Figma desktop app →

  Install directory

  • /Applications for system wide installation. All users will have access to Figma.
  • ~/Applications for a single user installation.

  Auto-update policy

  If you install to ~/Applications, users should be able to auto-update to the Figma app without needing special permissions. If you install to /Applications, users need to have write access to the Figma.app bundle directory for auto-updates.

  We recommend creating a permission group containing all relevant users and then making app directory writable by that group.

  For example: if you were to have a group called figma_group, you could use:

  chown -R :figma_group /Applications/Figma.app && chmod -R 755 /Applications/Figma.app

  Choose a deploy method

  You have two options for deployment:

  • If you allow write access to the Figma.app bundle, you can use the universal stub installer.
  • If you don't allow write access, you can download architecture specific builds.

  Universal stub installer

  The universal stub installer supports both Intel and Apple Silicon machines. Place the stub installer Figma.app in the Applications directory and it will automatically download and install the latest version of Figma on first launch.

  Download here: https://desktop.figma.com/mac-installer/Figma.zip

  Architecture specific builds

  If you don't allow write access to the Figma.app bundle, or can't use the stub installer for any reason, you can fetch architecture-specific builds instead.

  Here is the shell script to obtain the URLs:

  latest_version=$(curl -fsSL "https://desktop.figma.com/mac/version.txt")
  intel_url="https://desktop.figma.com/mac/Figma-${latest_version}.zip"
  apple_silicon_url="https://desktop.figma.com/mac-arm/Figma-${latest_version}.zip"

  The Figma app will not try to auto-update if the app directory is unwritable by the user. In this case, please note that we support desktop app versions only for up to 2 months. You must make sure to manually deploy updates to users in a timely manner. You can check the latest available version of the desktop app from version.txt.

• Restrict or prevent guest access

  Who can use this feature

  Supported on the Enterprise plan.

  Only organization admins can manage guest membership settings.

  The guest memberships setting allows organizations to determine if existing members and guests can share organization files, projects, and teams with external users.

  This setting applies to guest invitations, as well as guests who open and access files using a shared link.

  What are guests?

  Guests are external users with email addresses that don't match any of the organization's domains. They could be contractors, agencies, clients, or external collaborators. Members versus guests →

  Guest membership settings

  The guest membership setting offers greater control over who is joining the organization, and extra peace of mind when it comes to privacy and security.

  There are three available options:

  • Guests can join the organization without restrictions
  • Guests can only join the organization with admin approval
  • Guest's can't join your organization

  Allow guest access

  Existing member or guests can invite guests to files, projects, or teams without restrictions. Guests can still only access the resources you specifically invite them to.

  If public link sharing is enabled, guests can also open organization files if an existing member or guest shares the file link with them. 

  When you invite an external user to an organization resource, Figma lets you know that the invitee is a guest:

  Require admin approval

  Existing member or guests can invite the external user from the share modal. When the inviter clicks Send, Figma informs them that admin approval is required.

  

  When the guest first opens an organization resource they can Ask to be added to the organization. They won't be able to access the file, project, or team their request is accepted.

  

  Requests are sent to the relevant workspace admin to accept or ignore. If the file or invitee is outside of a workspace, Figma sends the request to an organization admin.

  Note: Figma only requires approval the first time you invite the guest to an organization resource. Once approved, people won’t need further approval to invite that guest to other resources.

  Prevent guest access

  Existing members and guests aren't able to invite external users to the organization. When someone tries to invite an external user to an organization resource, Figma informs them guest access is disabled.

  Note: If public link sharing is enabled, external users may still be able to view content through a link if the individual file permissions allow it. Organization admins can disable public link sharing settings.

  

  Adjust guest membership setting

  Organization admins can control guest membership from the organization's Admin settings.

  1. Open the organization in Figma and select Admin settings in the sidebar.
  2. Select Settings from the header.
  3. In the External access section, select Guest membership.
  4. Select who can invite external users to files, projects, and teams:
     • External users can join the organization (default)
     • External users can only join with admin approval
     • No external users can join the organization
       
  5. Select Save to apply your changes.