Before you start
Who can use this feature
Supported on the Organization plan.
Only organization admins can configure SAML SSO.
SAML SSO only applies to organization members.
Security Assertion Markup Language (SAML) is a security standard for logging into applications. Single Sign On (SSO) allows users to log into many applications or websites via one set of login details.
In a SAML SSO set up, the identity provider manages the organization's user accounts and credentials. The service provider (Figma) is the app or website that provides services to the user or organization.
When using SAML SSO, Figma won't store passwords for any accounts managed by Single Sign On. Members log in to the organization via their identity provider.
SAML SSO only applies to members of an organization. Guests can log in via Google SSO or their email and unique password, regardless of an organization's SAML SSO settings.
How SAML SSO works:
- Member attempts to log in to Figma via SAML SSO
- Figma sends a SAML request to the identity provider
- The identity provider checks this member's credentials
- The identity provider sends a response to Figma to verify the member's identity
- Figma accepts the response and logs the member into their Figma account
Note: Figma uses SAML 2.0 for all SAML SSO configurations. This includes configurations with supported identity providers and any custom configurations.
Set up SAML SSO
The process for configuring SAML will depend on your specific identity provider. We've outlined the general process for implementing SAML SSO below.
Confirm your company domain(s)
Domains are the way we identify entities on the internet. We can view domains in a website's URL
www.figma.com or email address
Organization admins define any organization domains as part of the set up process. Organizations can have more than one domain, including subdomains. Domains and domain capture →
Domains let Figma know who to treat as a member and who to treat as a guest. Only members of the organization can log in using SAML SSO. Guests can login using Google SSO, or their email address and a unique password. Log in to Figma →
For example: ACME Corp has three domains registered to their organization: acme.org, acmecorp.org, and
- Anyone with an
dev.acme.orgemail address is a member.
- Anyone with an email address that doesn't match those domains is a guest and can't log in via SAML. For example:
Note: If you plan on using SAML SSO, you need to register every domain you want to use in Figma with your identity provider. Email aliases do not work with SAML SSO.
Caution: To make sure members can access existing files and projects, they need to use their company email for their Figma account. We recommend making sure everyone is using their company email in Figma before you set up SAML SSO.
Add Figma app to your identity provider
This usually involves adding an app to your identity provider. Your identity provider will provide you with a Metadata URL during this process. This is an XML link that Figma uses to connect your identity provider, and authenticate users when they login.
Figma supports dedicated integrations with the following identity providers:
- Azure Active Directory (Azure AD)
- Google SSO*
- Active Directory Federation Services (AD FS)
Note: You can also set up a custom SAML configuration with a provider that isn't on this list. This will involve setting up a custom app with your identity provider. Set up a custom SAML configuration →
*If you want to use Google SAML SSO and SCIM, you need to set up a custom SAML configuration instead of using the Google SSO option. Learn more about Google SAML SSO →
Turn on SAML SSO in Figma
Next, you'll need to set up SAML SSO in Figma. This will:
- Turn on SAML SSO for your organization
- Connect your identity provider to your Figma account
- Let you choose what methods members can use to log in
Figma provides you with a Tenant ID, which you'll need to complete the configuration process with your provider.
You also need to decide if logging in via SAML SSO is mandatory, or if users can still login via email address and password. This only applies to members, guests can login via Google SSO or email and unique password.
If you want to set up Google SSO, all users must login via Google SSO. There is no way to make this optional or enable this for only some users. Set login or authentication method →
Set up SAML SSO in your identity provider
Complete the rest of the set up process with your identity provider. The articles below cover this process in detail.
- SAML SSO with Okta
- SAML SSO with Azure Active Directory
- SAML SSO with OneLogin
- SAML SSO for ADFS
- Set up a custom SAML configuration
For supported providers, you'll only need your Tenant ID. For custom configurations, you need both the SP Entity ID and SP ACS URL.
Set up SCIM provisioning (optional)
All SAML SSO configurations support "Just In Time" (JIT) or manual provisioning. JIT provisioning allows Figma to create and update users in Figma. JIT only applies any changes to a user's profile when they next log into their account, not when the admin first makes the changes.
You can choose to enable automatic provisioning via SCIM. SCIM pushes any changes you make to Figma, as soon as they happen. SCIM gives you greater control as it allows you to also import and deactivate users.
- Supported identity providers: you can enable provisioning via SCIM. We include instructions for setting up automatic provisioning via SCIM in each provider's article.
- Custom SAML configuration: you can set up SCIM with your chosen identity provider.Learn more about setting up a custom SCIM configuration →
Users can now access Figma using their company email address and password. If they have already been using Figma, they can log in to their account. If they are new to Figma, they can create a new account.
When you provision a user with your identity provider, Figma will add them to your Organization as a Viewer. This is a provisional Role, which means there are no restrictions around upgrading.
It's not possible to define a user's permissions via your identity provider. You can only manage a user's permissions in Figma. Learn more about managing members →
Edit a SAML configuration
Organization admins can make changes to the SAML SSO settings at any time. This is perfect when you need to fix errors, update an expired certificate, or switch to another provider.
You will need to update your Authentication settings to Members may log in with any method, including email and password to edit your configuration. This allows members to log in with email address and password, while you make any changes.
- Open the organization in Figma.
- Select Admin settings in the sidebar.
- Select the Settings tab.
- In the Login and provisioning section, click Authentication.
- Select Members may log in with any method, including email and password.
- Click Done to return to the screen.
- Click on the SAML SSO option to adjust your settings.