Related Videos

• Privacy and security in organizations

  Before you start

  Who can use this feature

  Applies to the Organization and Enterprise plans

  Only organization admins can manage an organization's security settings.

  Organizations give you greater control over what's shared within your business.

  Privacy and security by design

  Security is part of everything we do. It’s top of mind in how we work, treat customer data, and develop our product.

  Figma has completed a SOC 2 Type II audit. SOC 2 is a security compliance standard for software companies in the United States. Its guidelines and policies help businesses, like Figma, protect customer data.

  Learn more about Figma's Privacy and Security policies.

  File and draft ownership

  The organization has ownership over all the files created within the organization. This includes files within a member's drafts, or external teams. When you remove a member, all their teams, files and projects will stay in the organization.

  Figma will also move files a deleted member's drafts to a shared folder in the organization. Organization admins can access these files and delete or redistribute them.

  Control link sharing

  There are a few ways members can get access to files in an organization:

  • A member invites them to the file
  • They are a member of the team or project
  • They open a link to a Figma file (link sharing)

  Use link sharing settings to define who can open the file, and whether they have view or edit access. This includes members of the organization and guests outside of the organization.

  You can update the link sharing settings for each file. The default settings are Anyone at organization with link and can view.

  Discover files

  Choose how members of your organization can share and access files via links. Guests of an organization can only access files and teams to which they have been invited.

  • Choose Anyone with the link to allow people inside and outside the organization to access the file. This includes both members of the organization and Guests who have the link.
  • Choose Anyone at organization with the link: organization members will need to have a link to the file to access it. When they open the link, they can view the file.
  • Choose Anyone at organization to allow anyone in the organization to access the file. Use this setting for library files you want to share with the whole organization. Guests of the organization won't be able to access these files unless you invite them to the file or team.
  • Choose Only people invited to this file if you only want team members or people you explicitly invite to the file to access it.

  Interact with files

  Choose what level of access other members of the organization have, once they open the file.

  This setting applies to anyone who opens the file, unless they're a member of the team or have an explicit role on the file.

  • Choose can edit to give anyone who opens the file the option to edit.
  • Choose can view to allow people to view the file without being able to make any edits.
  • Choose can view prototypes only to only allow them to access the prototype, and not the designs in the file itself.

  

  It's possible to disable public link sharing in an organization. This prevents anyone outside the organization from accessing files via the file link.

  Organization admins can turn link sharing off and on on the Settings tab of the organization's Admin settings. Learn more about organization admin →

  Permissions

  In a team, permissions determine how members can interact with files and projects in the team.

  In an organization, every member of an organization has a role and an account type. This controls what they can access, and how they interact with the organization.

  • Register official company domains for email addresses
  • Invite members to your organization as members or guests. Guests can only access resources you invite them to.
  • Set and update permissions at any time. Downgrade members to Viewer restricted to restrict their access.
  • Set different levels of organization access levels for teams.

  Learn more about permissions in an organization →

  Activity logs

  Activity Logs provide a record of how users are interacting with files and resources. This allows you to track what's happening within your organization:

  • See who is accessing, copying and sharing Files
  • Track changes made to teams, projects and file permissions
  • View activity for individual members
  • Track changes made by organization admins
  • Identify and prevent misuse of organization Resources

  Learn more about activity logs →.

  SAML SSO

  Organizations that need enhanced security requirements can configure SAML SSO.

  Security Assertion Markup Language (SAML) is a security standard for logging into applications.

  Single Sign On (SSO) allows users to log into many applications or websites via one set of login details.

  Figma has integrations with the following providers:

  • Azure Active Directory
  • Okta
  • OneLogin
  • Google SSO

  You can also set up a custom SAML configuration with a provider that isn't on this list.

  Learn more about SAML SSO →.

  Two-factor authentication

  If you don't have SAML or Google SSO enabled, members of your organization can add extra security via two-factor authentication (2FA).

  When enabled, members will need to confirm their identity every time they log in to Figma.

  Members will need to set this up individually, in their account Settings. There isn't a way to enable 2FA or make it mandatory across an entire organization.

  If you're using SAML SSO, you may be able to enable 2FA with your identity provider.

  Learn more about two-factor authentication →

  Restricted access

  Enterprise organizations have several options to restrict access and prevent data loss.

  • Restrict access on a corporate network
  • Restrict access to external content
• Domains and domain capture

  Before you start

  Who can use this feature

  Supported on the Organization and Enterprise plans.

  Only organization admins can add and remove domains.

  In this article, we’ll explore two key concepts of organization membership: domains ↓ and domain capture ↓

  Domains

  Domains and domain names identify entities online. We can view a domain name in an entity’s website address www.figma.com or email address support@figma.com.

  Domains let Figma know who is a member of an organization, and who is a guest. Members versus guests →

  ACME Corp has three domains registered to their organization: acme.org, acmecorp.org, and dev.acme.org.

  Anyone with an acme.org, acmecorp.org, or dev.acme.org email address is a member.

  Anyone without one of those emails is a guest. For example: name@gmail.com or name@notyourdomain.com

  Organizations can have multiple domains, including subdomains. Organization admins can add or remove organization domains.

  Domain capture

  Domain capture affects how Figma handles accounts registered to organization domains. When domain capture is on, any accounts with a company domain are added to the organization.

  New members (people with company emails) will join the existing organization and can’t create separate company accounts. This applies to existing and future accounts.

  Domain capture doesn’t apply to guests—anyone without a company email. Guests must be invited to teams, projects, or files to access the organization. Members versus guests →

  Domain capture impacts how you add members, what happens to their drafts when they join the organization, and what happens when they’re removed.

  Organization admins can request to enable or disable domain capture.

  

  How do I tell if domain capture is on? Usually, the way you signed up for your organization plan will determine if domain capture is active:

  • Sales team: domain capture is on by default.
  • Upgrade in Figma: domain capture is off. Reach out to the Figma support team to turn this on for your organization.

  Add members

  There are a number of ways to add members and guests to an organization. An organization's domain capture settings determine which options are available.

  Method	Domain capture on	Domain capture off
  Company accounts added to organization by default	✓	✕
  Add a member to your organization	Figma adds all company accounts to the organization by default	✓
  Invite members to an organization team	Figma adds all company accounts to the organization by default	✓
  Invite guests to teams	✓	✓
  Invite guests to files or projects	✓	✓
  Add members to your identity provider (SAML SSO)	✓	✓

  Note: If you are on the Enterprise plan, organization admins can restrict or control guest access. Inviting guests to organization resources may be blocked or require admin approval.

  Domain capture on

  ACME Corp has two domains registered to their organization: acme.org and dev.acme.org. They want everyone with an ACME email to be a part of the same organization, so they turn on domain capture.
  
  Figma will now add anyone with a verified company email to the existing organization. This includes anyone that:

  • Uses an email address with an acme.org or dev.acme.org domain
  • Already has a Figma account registered under their company email
  • Creates a new Figma account using their company email

  Domain capture off

  ACME is an international company with offices around the globe. They want each a separate organization for each region: North America; Asia Pacific; and Europe, the Middle East and Africa.

  • The North America organization registers domains for acme.org and na.acme.org
  • The Asia Pacific organization registers domains for acme.org and apac.acme.org
  • The EMEA organization registers domains for acme.org and emea.acme.un

  Anyone with an acme.org email can join any of the three organizations. Members can also create new teams or organizations separate to the existing organizations.

  Anyone with a location-specific email can join the organization for their specific location. For example: Anyone with an emea.acme.org address can access the London-based organization.

  Draft ownership

  Organizations usually have extra requirements or restrictions around privacy and security. If you're a part of an organization, your account includes any organizations linked to your account as well as any external teams. Explore organizations →

  • Organizations: teams, files, and resources inside the organization. Everything within the organization is owned by the organization and can be manage by organization admins.
  • External teams: any teams they're a member of that aren’t in an organization. This could be teams excluded from the upgrade, as well as teams outside the company they joined with a work email. These are outside the organization and can't easily be accessed if the member leaves.

  When members are added to an organization, a person’s drafts come with them. The location of their existing drafts folder is determined by the organization's domain capture settings.

  Location of drafts folder based on domain capture setting:

  Domain capture on	Domain capture off
  Find migrated drafts in the organization	When the member joins the organization dictates where their existing drafts will live: At upgrade: In organization. After upgrade: in external teams

  Remove members

  Everything within the organization is owned by the organization and can be manage by organization admins. When you remove a member from your organization, Figma will:

  • Remove their access to the organization and prevent them from accessing any teams, files or libraries in the organization.
  • Transfer ownership of any teams to the member with the highest permissions on that team. If they also own individual files and projects, Figma will transfer ownership to an existing Editor.
  • Move any Drafts from the organization space to the organization's Shared projects folder. Files in the Shared projects folder are locked for all other collaborators. Organization admins can claim ownership of the project to unlock files and assign them a new owner.

  Domain capture will determine if members can access to their account outside the organization.

  Account access based on domain capture setting:

  Domain capture on	Domain capture off
  Members or guests will lose access to their Figma account. This includes drafts, teams, and shared files or projects in external teams.	Figma detaches their email address from the organization. If they still have access to that email address, they may be able to access their external teams.

  Note: If you have SAML SSO enabled, you’ll need to de-provision them with your identity provider. This will prevent them from logging in to their Figma account, regardless of domain capture settings.

• Add or remove organization domains

  Who can use this feature

  Supported on the Organization and Enterprise plans.

  Only organization admins can request changes to organization domains.

  Domains are the way we identify entities on the internet. We can view domains in a website's URL www.figma.com or email address support@figma.com. In Figma, domains determine who is member of an organization, and who is a guest.

  Organizations can have multiple domains registered to their business, including subdomains. You need to add any domains you want to use in Figma. Especially if you want to authenticate members using SAML SSO.

  View or update domains

  Organization admins let Figma know which domains they have, as part of the upgrade process. You can submit requests to add and remove domains, as needed.

  Organization admins can view domains in the organization's Admin settings:

  1. Open the organization in Figma.
  2. Click Admin Settings in the sidebar.
  3. Select the Settings tab.
  4. View the current domains in the Domains section.
  5. Click Contact support to request a change to your settings.
• Set default roles

  Who can use this feature

  Supported on the Enterprise plan.

  Only organization admins can adjust default roles.

  On the Enterprise plan, organization admins can set default roles for anyone joining the organization. This helps organization admins to better control and manage new editor seats.

  Default roles apply to both members and guests. You can set default roles for both Figma design files and FigJam files.

  What are roles?

  Every member or guest in an organization has a Figma design role and a FigJam role. People can have different roles on each file type.

  These roles determine the highest level of access they can get on each product. There are three roles: viewer, viewer - restricted, and editor. Roles in Figma →

  Roles also determine a person’s billing status. Figma only includes editor roles— otherwise known as seats or licenses—in the organization's billing.

  For example: a Product Manager (PM) has an editor role on FigJam but only a viewer - restricted role on Figma design. They will only contribute to a paid editor seat for FigJam; a FigJam seat on the Enterprise plan is $5/month or $60/year.

  Note: On the Enterprise plan, you can also set member roles via SCIM. If you set member roles via SCIM, Figma will honor the SCIM provisioned role over the default role. If you have SAML and basic SCIM enabled, but don't use SCIM to set roles, Figma will use the default role setting.

  You can identify members with roles set by SCIM with the next to their role in the Members tab.

  Set default role

  Organization admins can set default roles in the organization's admin settings.

  1. Open the organization in Figma.
  2. Select Admin settings in the left sidebar.
  3. Select Settings from the menu bar.
  4. In the Login and provisioning section, select the Default role setting.
  5. Select default roles for both Figma design and FigJam using the fields. Choose from:
     • Viewer: Admins and other editors can upgrade them to an editor role. Viewers can also upgrade themselves to a paid status by taking an upgrade action. (default)
     • Viewer restricted: Only an organization or workspace admin can upgrade them to an editor role.
     • Editor: They join with a paid editor seat on that product. New editors are included in your quarterly true-up.
  6. Select Save to apply your changes.

  Monitor related activity

  Organization admins can monitor activity related to roles and upgrades in the organization's activity logs. There are three types of events related to roles and licenses:

  • Default role: When an organization admin sets or changes the default role for the organization. Figma records separate events for each file type.
  • Org role changed: When a member or guest’s role is explicitly changed by an organization or workspace admin. This includes any upgrades and downgrades outside of user-initiated requests.
  • Upgrade requests and activity: Any activity related to member or guest-initiated upgrade requests. This includes any of the following events:
    • A user requested access or upgrade
    • Workspace admin approved request
    • Organization admin approved request
    • Workspace admin rejects request
    • Organization admin rejected request

  Monitor activity →

• Enterprise deployment of Figma desktop app

  Who can use this feature

  Supported on any team or plan.

  This article is for IT administrators installing Figma on employee machines.

  To install Figma on your own device, please visit Figma's downloads page. Learn more about the Figma desktop app →

  MacOS

  Install directory

  • /Applications for system wide installation. All users will have access to Figma.
  • ~/Applications for a single user installation.

  Auto-update policy

  If you install to ~/Applications, users should be able to auto-update to the Figma app without needing special permissions. If you install to /Applications, users need to have write access to the Figma.app bundle directory for auto-updates.

  We recommend creating a permission group containing all relevant users and then making app directory writable by that group.

  For example: if you were to have a group called figma_group, you could use:

  chown -R :figma_group /Applications/Figma.app && chmod -R 755 /Applications/Figma.app

  Deploy Figma app

  You have two options for deployment:

  • If you allow write access to the Figma.app bundle, you can use the universal stub installer.
  • If you don't allow write access, you can download architecture specific builds.

  Universal stub installer

  The universal stub installer supports both Intel and Apple Silicon machines. Place the stub installer Figma.app in the Applications directory and it will automatically download and install the latest version of Figma on first launch.

  Download here: https://desktop.figma.com/mac-installer/Figma.zip

  Architecture specific builds

  If you don't allow write access to the Figma.app bundle, or can't use the stub installer for any reason, you can fetch architecture-specific builds instead.

  Here is the shell script to obtain the URLs:

  latest_version=$(curl -fsSL "https://desktop.figma.com/mac/version.txt")
  intel_url="https://desktop.figma.com/mac/Figma-${latest_version}.zip"
  apple_silicon_url="https://desktop.figma.com/mac-arm/Figma-${latest_version}.zip"

  The Figma app will not try to auto-update if the app directory is unwritable by the user. In this case, please note that we support desktop app versions only for up to 2 months. You must make sure to manually deploy updates to users in a timely manner. You can check the latest available version of the desktop app from version.txt.

  Windows

  Currently, Figma only supports enterprise deployment for macOS machines. Support for Windows deployment and detailed instructions coming soon!

  In the meantime, you could use the Windows installer. This installs the app into the %APPDATA%/Figma and makes sure it updates automatically.

  Download the Windows installer for 64-bit Intel/AMD systems:: https://desktop.figma.com/win/FigmaSetup.exe

  Please contact us if you need 64-bit ARM builds.

• Restrict or prevent guest access

  Who can use this feature

  Supported on the Enterprise plan.

  Only organization admins can manage guest membership settings.

  The guest memberships setting allows organizations to determine if existing members and guests can share organization files, projects, and teams with external users.

  This setting applies to guest invitations, as well as guests who open and access files using a shared link.

  What are guests?

  Guests are external users with email addresses that don't match any of the organization's domains. They could be contractors, agencies, clients, or external collaborators. Members versus guests →

  Guest membership settings

  The guest membership setting offers greater control over who is joining the organization, and extra peace of mind when it comes to privacy and security.

  There are three available options:

  • Guests can join the organization without restrictions
  • Guests can only join the organization with admin approval
  • Guest's can't join your organization

  Allow guest access

  Existing member or guests can invite guests to files, projects, or teams without restrictions. Guests can still only access the resources you specifically invite them to.

  If public link sharing is enabled, guests can also open organization files if an existing member or guest shares the file link with them. 

  When you invite an external user to an organization resource, Figma lets you know that the invitee is a guest:

  Require admin approval

  Existing member or guests can invite the external user from the share modal. When the inviter clicks Send, Figma informs them that admin approval is required.

  

  When the guest first opens an organization resource they can Ask to be added to the organization. They won't be able to access the file, project, or team their request is accepted.

  

  Requests are sent to the relevant workspace admin to accept or ignore. If the file or invitee is outside of a workspace, Figma sends the request to an organization admin.

  Note: Figma only requires approval the first time you invite the guest to an organization resource. Once approved, people won’t need further approval to invite that guest to other resources.

  Prevent guest access

  Existing members and guests aren't able to invite external users to the organization. When someone tries to invite an external user to an organization resource, Figma informs them guest access is disabled.

  Note: If public link sharing is enabled, external users may still be able to view content through a link if the individual file permissions allow it. Organization admins can disable public link sharing settings.

  

  Adjust guest membership setting

  Organization admins can control guest membership from the organization's Admin settings.

  1. Open the organization in Figma and select Admin settings in the sidebar.
  2. Select Settings from the header.
  3. In the External access section, select Guest membership.
  4. Select who can invite external users to files, projects, and teams:
     • External users can join the organization (default)
     • External users can only join with admin approval
     • No external users can join the organization
       
  5. Select Save to apply your changes.
• Restrict access to personal Figma accounts on a corporate network

  Before you begin

  Only available on the Enterprise plan.

  Organization admins only.

  Organization admins can use the Restrict personal access on this network setting to prevent access to personal or unauthorized Figma accounts while on a corporate network.

  When enabled, users can only access Figma on a corporate network when:

  • They are logged in with an account from the organization's domain
  • They are guests in the organization

  Note: If a guest has a pending invite to join the organization, they won’t be able to accept the invitation while on the corporate network.

  If someone tries to use an unauthorized Figma account while they're on the corporate network, they'll be prompted to switch to their work account:

  

  When the person rejoins a non-corporate network, they can resume access to their other Figma accounts.

  Enable or disable network access restrictions

  Organization admins can turn on this setting by getting in touch with our support team. In your request, please provide the IP range for your corporate network and proof of ownership, such as a letter, email, or invoice from your ISP confirming the IP range assignment.

  The process will take about two weeks to complete. You can find this setting by following the instructions below.

  1. From the file browser, click Admin settings.
  2. Select the Settings tab.
  3. Navigate to Restrict personal access on this network under External access and click Contact support.
• Restrict access to content from outside your organization

  Before you begin

  Only available on the Enterprise plan.

  Organization admins only.

  This feature requires domain capture. To turn on domain capture, please contact our support team.

  By default, members of a Figma organization can create and edit files outside the organization. For example, they can join files shared with them from people at other companies, or create new files in External teams.

  By restricting access to external content, organization admins can keep everyone’s work inside the company Figma organization. When access to external content is disabled, members can’t:

  • Create new files or projects outside your organization.
  • Edit files they’ve created outside your organization.
  • Edit or comment on files shared with them from people outside your company.
  • Accept new invites to join files, projects, or teams from outside your company. The exceptions are open sessions in FigJam, public files, and password protected files. In these cases, people can join the files with view-only permissions.

  Note: When this setting is enabled, everyone's permissions will change to view-only in files they have access to outside of your Figma organization. This includes drafts they’ve made in other organizations or in External teams.

  

  Let people know about the change in advance

  Before limiting access to content outside your organization, we recommend telling people in advance what they can expect. Here’s a customizable message template you can use to prepare everyone for the change.

  Hi team,

  On [date], we're going to change an important setting in our Figma organization. In an effort to keep [company name]’s creative work inside our organization, we're going limit editing access to content from outside our company.

  Here's what you can expect on [date]:

  • Any existing files, projects, and teams shared from outside our company will switch to view-only.
  • You won't be able to accept new invites to join files, projects, or teams shared outside our company.
  • You won't be able to create drafts, files, or projects outside of the [company] organization.
  • Any drafts you've made outside of the organization will become view-only.
  • You can still create and edit drafts within the [company] organization.
  • You can still join open sessions in FigJam, public files, and password protected files from outside our organization with view-only permissions.

  Before [date], please review any content you have access to outside our organization. You can click on the name of our Figma organization at the top left of the file browser to view other organizations you have access to, or content within External teams.

  If you have content you need to move into our Figma organization, export or save a local copy of each file, then import the files by dragging and dropping them in Figma’s file browser.

  If you have questions about this change, please reach out to [person or process].

  Enable or disable access to external content

  Access to external content is enabled by default. You can disable or re-enable access at any time by following the instructions below.

  1. From the file browser, click Admin settings.
  2. Select the Settings tab.
  3. Under External access, click Access to external content.
  4. Change the setting and press Save.
• Enable or disable domain capture

  Who can use this feature

  Supported on the Organization and Enterprise plans.

  Only organization admins can enable or disable domain capture.

  Domain capture affects how Figma handles accounts registered to organization domains. When domain capture is on, any accounts with a company domain are added to the organization.

  New members (people with company emails) will join the existing organization and can’t create separate company accounts. This applies to existing and future accounts.

  Domain capture doesn’t apply to guests—anyone without a company email. Guests must be invited to teams, projects, or files to access the organization. Members versus guests →

  Domain capture impacts how you add members, what happens to their drafts when they join the organization, and what happens when they’re removed. We recommend exploring domains and domain capture before turning this on.

  

  You can enable (turn on) or disable domain capture (turn off) to suit your needs.

  • Turn on domain capture to prevent people from creating company accounts outside the organization.
  • Turn on domain capture so you don’t have to manually add members to the organization.
  • Temporarily turn on domain capture when your first set up your organization. This allows you to import any existing company accounts. You can then turn it off once you’re up and running.
  • Turn off domain capture if you want to create separate Figma organizations that share the same registered domains.

  Update domain capture settings

  Caution: Only one organization can capture a domain. If you have Figma organizations that use the same registered domains, you can’t enable domain capture in either organization.

  Due to the impact of domain capture, this setting can only be updated by Figma. An organization admin can request updates to domains from the Admin support team.

  If you want to add a new domain and enable domain capture, you’ll need to:

  • Confirm the organization has ownership over the domains you want to add
  • Attest that you have the authority to make the decision for the company
  • Approve domain capture for all registered domains

  You can start this request from the organization’s admin settings:

  1. Open the organization in Figma.
  2. Select Admin settings in the sidebar.
  3. Select Settings in the menu bar.
  4. Under Domains, select Contact support.