SAML SSO with Okta

Before you start

Who can use this feature

Available on the Organization and Enterprise plans.

Organization admins only.

You will need to have an existing Okta account to set up SAML SSO with Okta.

Organizations that have stricter security requirements can configure SAML SSO. Learn more about SAML SSO in Figma →

You can use Okta as your identity provider to authenticate and provision users. Figma supports SAML SSO initiated from both Okta (identity provider) and Figma (service provider).

Add the Figma app to Okta

To connect Figma and Okta, you will first need to add the Figma app to your Okta account. This will generate a IdP Metadata URL, which you'll need to configure SAML SSO in Figma.

1. Log in to your Okta account and head to the Applications page.
2. Select Add Application from the options.
3. Search for Figma and click the Add button to add Figma to your account.
4. Once installed, go to the Sign On page.
5. Right click on the Identity Provider Metadata link and choose Copy link address. The link should look like this: https://example.okta.com/app/abc123/sso/saml/metadata

Set up SAML SSO in Figma

Next you'll need to set up SAML SSO in your Organization's Admin Settings.

1. From the file browser, click Admin settings.
2. Select Settings at the top of the screen.
3. In the Login and provisioning section, click SAML SSO.
4. Click Configure SAML and select Okta from the options.
5. Enter the IdP Metadata IRL from Okta and click Review.
6. Check the box to confirm This information is correct... and click Configure SAML SSO.
7. Click the Copy link next to your Tenant ID. You'll need this to complete the set up process in Okta.

Set up Figma in Okta

Now you have your Tenant ID, you can complete the configuration process in Okta. You will need to configure the Figma app and mapping user attributes between applications.

Configure SAML SSO

1. Open the Figma app in Okta.
2. Go to Sign On tab and click Edit.
3. Scroll down to the Advanced Sign-On Settings section.
4. Enter your Tenant ID in the field provided.
5. In the Application username format field, select Email from the options.
6. Click Save to complete the process.

Assign users to the application

Now you can start assigning users to the application. As part of this process, you may be asked to provide additional information about each user.

Figma supports some basic attributes, as well as attributes only available to SCIM Enterprise users.

Start adding users to the application in the Assignments tab on the far right.

Supported Basic Attributes

Variable Name	External Name	External Namespace	Suggested Mapping
givenName	givenName	urn:ietf:params:scim:schemas:core:2.0:User	user.firstName
familyName	familyName	urn:ietf:params:scim:schemas:core:2.0:User	user.lastName
displayName	displayName	urn:ietf:params:scim:schemas:core:2.0:User	user.displayName
title	title	urn:ietf:params:scim:schemas:core:2.0:User	user.title

Supported SCIM Enterprise User Attributes

Variable Name	External Name	External Namespace	Suggested Mapping
employeeNumber	employeeNumber	urn:ietf:params:scim:schemas:extension:enterprise:2.0:User	user.employeeNumber
costCenter	costCenter	urn:ietf:params:scim:schemas:extension:enterprise:2.0:User	user.costCenter
organization	organization	urn:ietf:params:scim:schemas:extension:enterprise:2.0:User	user.organization
division	division	urn:ietf:params:scim:schemas:extension:enterprise:2.0:User	user.division
department	department	urn:ietf:params:scim:schemas:extension:enterprise:2.0:User	user.department
managerValue	manager.value	urn:ietf:params:scim:schemas:extension:enterprise:2.0:User	user.managerId
managerDisplayName	manager.displayName	urn:ietf:params:scim:schemas:extension:enterprise:2.0:User	user.manager

Set up automatic provisioning with SCIM

Okta also supports automatic provisioning with SCIM. To set up SCIM you will need to generate an API token in Figma then add this to Okta.

We recommend having both windows open to make copying between the two easier.

Generate an API token in Figma

1. From the file browser, click Admin settings .
2. Select Settings at the top of the screen.
3. In the Login and provisioning section, click SCIM provisioning.
4. Click Generate API Token in the dialog.
5. Copy the API token to your clipboard. You'll need this to complete the process in Okta.

Configure automatic provisioning in Okta

Make sure the following functions are enabled in Okta:

• Create users
• Update user attributes
• Deactivate users

1. Open the Figma app in Okta.
2. Go to the Provisioning tab in the Figma app.
3. Click the Configure API Integration button.
4. Check the box next to Enable API Integration.
5. Enter the API Token in the field provided.
6. Click Test API Credentials to ensure it's set up correctly.
7. When you get a success message, click Save to apply.
8. A few more options will now appear under the Provisioning section. Select To App in the left-hand menu.
9. Click Save to apply.