Manage seats via SCIM using Okta

Who can use this feature

Available on the Enterprise plan

Organization admins only

In this guide, you'll learn how to manage seats in Figma using Okta, including how to:

1. Configure Okta Groups for provisioning
2. Add custom attribute mappings
3. Map custom attributes to Okta assignment groups
4. Test user provisioning

Configure Okta Groups for provisioning

1. Under Directory > Groups, you will need to create 6 different groups that represent all seat-type license combinations that are possible between Figma, Figjam, and Dev Mode.

2. Here’s what each of these access groups represent:

Add custom attribute mappings

1. Navigate to Applications > Figma > Provisioning > Figma Attribute Mappings.
2. Click Go To Profile Editor.

3. Click Add Attribute.
4. You will need to create an attribute representing each of Figma’s licenses for each product. Use the following table below to create an attribute for each of Figma’s products. You will repeat this step as well as step 5 for each Figma Product.

5. For each custom attribute, each will need a defined list of Enumerated Values.Use the following table to define each Display Name | Value pair under Attribute Members.

6. All other custom attribute settings can be left as their default values. Click Save.

Map custom attributes to Okta assignment groups

1. Navigate to the Assignments tab within your Figma Application.

2. Under the Groups filter. You will see assignment groups that will assign Figma for SSO (if configured) as well as for SCIM provisioning. Click the Assign drop-down menu and click Assign to Groups.
3. Add the 6 groups you created in the Configure Okta Groups for Provisioning step.
4. For each of the 6 groups, click the pencil icon and set the custom attributes figmaPermission, figjamPermission, and devModePermission to the following values:

5. Click Save for each value.
6. Within the Assignments view, set the Priority by dragging/dropping the Okta app assignment groups into the same order as mentioned in the table above. This will ensure in the edge case that a user is assigned to multiple groups, the top-most level group assigns the most permissive combination of licenses. (Note that the assignment group model used in this guide assumes an Okta user will be assigned to one Okta Group that assigns Figma at a time).

Test user provisioning

1. Assign a test user to one of your Okta assignment groups.

2. Navigate to Applications > Figma > Provisioning
   1. Ensure Provisioning to App: Create Users and Update Users are Enabled, at minimum. 
   2. Under Figma Attribute Mappings click Force Sync – this will push any test SCIM users you have assigned to access groups to Figma.
   3. You can validate a successful push SCIM event under Applications > Figma > View Logs.

3. Within Admin in Figma, navigate to Members. You should see your test user reporting “Pending SCIM” with the appropriate license combination associated with that Okta App Assignment Group.

4. You may repeat the above test for other test cases, for example: Remove that test user from one Okta App Assignment Group and add to another. This should update the user’s licenses in Figma.