Set up MCP enterprise-managed auth with Okta Cross App Access (XAA)

Normally, the Figma MCP server requires each user to follow an OAuth login flow to get access. However, you may want to manage this access centrally, so members sign in once through your identity provider and aren't interrupted by repeated login and consent prompts.

You can do this with Cross App Access (XAA). XAA enables enterprise-managed authorization, a way to centralize MCP access in Okta and remove sign-in friction. Instead of each member authorizing the Figma connector on their own, access is brokered by Okta: a member signs in once through Okta, and Claude can then work across approved MCP servers without asking that member to authorize again.

To set up enterprise-managed auth with Okta XAA:

1. Set up SAML SSO with Okta for your organization.
2. Follow Okta's guide to set up enterprise-managed auth. 
3. In Figma, from the file browser, click Admin.
4. Select Settings in the left sidebar.
5. In the Login and provisioning section, click OIDC Issuer URL.
6. Enter your Okta base tenant URL.
7. Click Save.