Manage seats via SCIM using Microsoft Entra ID

Who can use this feature

Available on the Enterprise plan

Organization admins only

In this guide, you'll learn how to manage seats in Figma using Microsoft Entra ID (formerly Azure Active Directory or Azure AD). To get started, follow the steps below:

1. Configure App roles for Figma Entra Gallery app
2. Add custom attributes
3. Map custom attributes to App roles
4. Setup security groups for member role setting
5. Test user provisioning

Configure App roles for Figma Entra Gallery app

1. Open the Figma Enterprise App Template in Entra ID under App registrations. You may have to select the ‘All applications’ tab to find Figma.

2. Navigate to the App Roles section.

3. Create a new App Role called Figma Full | FigJam Viewer Restricted.
4. Set the Allowed member types to Users/Groups.
5. Set the Value to FigmaFullFigJamViewerRestricted.
6. Add a description.

7. Click Apply to save the app role.
8. Repeat this process for the other five roles for a total of six new app roles.

Display name	Value	Description
Figma Full | FigJam Viewer Restricted	FigmaFullFigJamViewerRestrictedDevModeFull	Figma Full permission and Figjam Viewer Restricted (Dev Mode Inherited)
Figma Full | FigJam Full	FigmaFullFigJamFullDevModeFull	Figma Full, Figjam Full and Dev Mode Full
Figma Viewer Restricted | FigJam Full | Dev Mode Viewer Restricted	FigmaViewerRestrictedFigJamFullDevModeViewerRestricted	Figma Viewer Restricted, Figjam Full and DevMode Viewer Restricted
Figma Viewer Restricted | FigJam Viewer Restricted | Dev Mode Full	FigmaViewerRestrictedFigJamViewerRestrictedDevModeFull	Figma Viewer Restricted, FigJam Viewer Restricted and Dev Mode Full
Figma Viewer Restricted | FigJam Full | Dev Mode Full	FigmaViewerRestrictedFigJamFullDevModeFull	Figma Viewer Restricted, FigJam Full and Dev Mode Full
Figma Viewer Restricted | FigJam Viewer Restricted | Dev Mode Viewer Restricted	FigmaViewerRestrictedFigJamViewerRestrictedDevModeViewerRestricted	Figma Viewer Restricted, Figjam Viewer Restricted and Dev Mode Viewer Restricted

Add custom attributes

1. You must enable the creation of custom attributes for the Figma Application on Microsoft Entra ID. To do so, use the following link to open the Microsoft Entra ID portal with the schema full enabled: https://portal.azure.com/?Microsoft_AAD_Connect_Provisioning_forceSchemaEditorEnabled=true#view/Microsoft_AAD_IAM/StartboardApplicationsMenuBlade/~/AppAppsPreview/menuId~/null
2. Open the Figma Enterprise App.

3. Navigate to the Provisioning section.

4. Click Edit attribute mappings.

5. Ensure the Tenant URL and Secret Token are working by entering the correct values and clicking Test Connection.
6. Expand the Mappings section and select Provision Microsoft Entra ID Users.
7. Scroll to the bottom of the page and select Show advanced options.

8. Select Edit attribute list for Figma . If these options are not available to you, open the Microsoft Entra ID portal using the following URL: Microsoft Entra ID portal with schema full enabled.
9. Add a custom attribute called urn:ietf:params:scim:schemas:extension:figma:enterprise:2.0:User:figmaPermission and set the data type to string.

10. Add a custom attribute called urn:ietf:params:scim:schemas:extension:figma:enterprise:2.0:User:figjamPermission and set the data type to string.

11. Add a custom attribute called urn:ietf:params:scim:schemas:extension:figma:enterprise:2.0:User:devModePermission and set the data type to string.

12. Save the new configuration and click Save then Yes.

Map custom attributes to App roles using expression language

Configure the member role for Figma

1. Open the Figma Enterprise App.
2. Navigate to the Provisioning section.

3. Click Edit attribute mappings
4. Expand Mappings and select Provision Microsoft Entra ID Users.
5. Click Add New Mapping.

6. Set the Mapping type to Expression and set the Expression to Switch(SingleAppRoleAssignment([appRoleAssignments]), "", "Figma Full | FigJam Viewer Restricted", "full", "Figma Full | FigJam Full", "full", "Figma Viewer Restricted | FigJam Viewer Restricted | Dev Mode Viewer Restricted", "viewerRestricted", "Figma Viewer Restricted | FigJam Viewer Restricted | Dev Mode Full", "viewerRestricted", "Figma Viewer Restricted | FigJam Full | Dev Mode Full", "viewerRestricted", "Figma Viewer Restricted | FigJam Full | Dev Mode Viewer Restricted", "viewerRestricted")

7. Set the Target attribute to urn:ietf:params:scim:schemas:extension:figma:enterprise:2.0:User:figmaPermission and set Apply this mapping to Always.

8. Click OK to save.

Configure the member role for FigJam

9. Add a new mapping.
10. Set the Mapping type to Expression and set the Expression to Switch(SingleAppRoleAssignment([appRoleAssignments]), "", "Figma Full | FigJam Viewer Restricted", "viewerRestricted", "Figma Full | FigJam Full", "full", "Figma Viewer Restricted | FigJam Viewer Restricted | Dev Mode Viewer Restricted", "viewerRestricted", "Figma Viewer Restricted | FigJam Viewer Restricted | Dev Mode Full", "viewerRestricted", "Figma Viewer Restricted | FigJam Full | Dev Mode Full", "full", "Figma Viewer Restricted | FigJam Full | Dev Mode Viewer Restricted", "full")

11. Set the Target attribute to:  urn:ietf:params:scim:schemas:extension:figma:enterprise:2.0:User:figjamPermission and set Apply this mapping to Always.

12. Click OK to save.

Configure the member role for Dev Mode

13. Add a new mapping.
14. Set the Mapping type to Expression and set the Expression to: Switch(SingleAppRoleAssignment([appRoleAssignments]), "", "Figma Full | FigJam Viewer Restricted", "full", "Figma Full | FigJam Full", "full", "Figma Viewer Restricted | FigJam Viewer Restricted | Dev Mode Viewer Restricted", "viewerRestricted", "Figma Viewer Restricted | FigJam Viewer Restricted | Dev Mode Full", "full", "Figma Viewer Restricted | FigJam Full | Dev Mode Full", "full", "Figma Viewer Restricted | FigJam Full | Dev Mode Viewer Restricted", "viewerRestricted")
15. Set the Target attribute to:  urn:ietf:params:scim:schemas:extension:figma:enterprise:2.0:User:devModePermission and set Apply this mapping to Always.

16. Click OK to save.

17. Back on the Attribute Mapping page, click Save to confirm your changes.

Set up security groups for member role setting

1. Navigate to AD Groups.

2. Create a New group called Figma Full | FigJam Viewer Restricted.

3. Click Create to save the security group.
4. Open the Figma Enterprise App.
5. Navigate to Users and groups.

6. Click Add user/group.
7. Set the Group name to the group Figma Full | FigJam Viewer Restricted.

8. Set the Select a role to the app role Figma Full | FigJam Viewer Restricted.

9. Click Assign.
10. Create five additional groups with corresponding app roles for a total of six groups.

Group name	App role
Figma Full | FigJam Viewer Restricted	Figma Full | FigJam Viewer Restricted
Figma Full | FigJam Full	Figma Full | FigJam Full
Figma Viewer Restricted | FigJam Viewer Restricted | Dev Mode Viewer Restricted	Figma Viewer Restricted | FigJam Viewer Restricted | Dev Mode Viewer Restricted
Figma Viewer Restricted | FigJam Viewer Restricted | Dev Mode Full	Figma Viewer Restricted | FigJam Viewer Restricted | Dev Mode Full
Figma Viewer Restricted | FigJam Full | Dev Mode Full	Figma Viewer Restricted | FigJam Full | Dev Mode Full
Figma Viewer Restricted | FigJam Full | Dev Mode Viewer Restricted	Figma Viewer Restricted | FigJam Full | Dev Mode Viewer Restricted

Test user provisioning

1. Open the Figma Enterprise App.
2. Navigate to the Provisioning section.

3. Click Provision on demand.
4. Select a user to test provisioning with.

Click Provision.