Figma files hold unreleased product designs, prototypes, brand assets and sometimes screenshots of internal systems, and every Figma organisation allows public link sharing until an admin changes it. The controls that decide exposure are spread across sign-in, sharing, external access, extensions and tokens, and most of them sit with organisation admins. This guide explains how to secure Figma from the customer side: SAML SSO and domain capture, SCIM, admin roles, public link and open session controls, external collaboration and guests, plugin and widget approval, personal access tokens and API scopes, and activity logs. It is written for Figma organisation admins, design operations leads and SaaS security teams. If a token has already leaked, use the Work SaaS API tokens response guide; this page covers configuration and prevention.
This is an independent guide from NHI Mgmt Group, based on Figma's public documentation as of November 2026. It is not sponsored or reviewed by Figma. Product features change, so confirm settings against Figma's current documentation.
Key takeaways
- Set SAML to mandatory after testing. Allow any login method during setup, then make SAML mandatory for members; verified domains decide who is a member and who is a guest.
- Govern guests separately. SAML applies to members only, and guests sign in with Google or email and password, so review guest access and use guest expiration where licensed.
- Set public link policy deliberately. Public sharing is on by default; turn it off, or on Enterprise require passwords (optionally autogenerated) and link expiry of 1 hour to 60 days.
- Require plugin and widget approval. By default members can use any Community plugin or widget; switch both to admin-approved only, with a request option.
- Use granular token scopes. Personal access tokens act as the user who made them; choose specific scopes such as
file_content:readinstead of the deprecatedfiles:read.
How identity and access work in Figma
Figma organisation settings live under Admin in the file browser sidebar. Verified domains define members; anyone else invited in is a guest. Enterprise adds workspaces, which group teams and can carry their own sharing settings.
| Control | Availability (Figma docs) | What it does | Recommended use |
|---|---|---|---|
| SAML SSO | Education (K-12), Organization, Government, Enterprise; organisation admins | SAML 2.0 with dedicated integrations for Microsoft Entra ID, Okta, OneLogin, Google Workspace and AD FS, or custom SAML; mandatory or optional | Mandatory for members after a test period with any login method allowed |
| Google SSO | Separate option | All users must log in through Google; cannot be optional or partial | Use only where Google Workspace is your identity provider and SAML is not used |
| Domain verification and capture | Organisation admins | Verified domains set member status; domain capture adds people with matching email domains automatically | Verify every corporate domain and register each with your identity provider (email aliases do not work with SAML) |
| JIT provisioning | All SAML configurations | Creates and updates users at login | On, with SCIM for deactivation |
| SCIM | Optional; Enterprise adds seat types and group sync | Imports and deactivates users | Use for leavers; see the SCIM Provisioning Guide |
| Idle session timeout | Enterprise | Logs inactive members out sooner | Our view: 8 to 12 hours for most organisations |
| Multiple identity providers | Enterprise with Governance+ | More than one IdP for SAML | For groups of companies with separate directories |
Members on unverified domains must enter a six-digit verification code on each new device or browser; verifying the domain removes that step and brings them under SAML. Activity logs record SSO changes, SCIM token events and the setting for 2FA for guests, so changes to sign-in policy are traceable. See the SAML Security Guide and SaaS deprovisioning.
Leavers: Figma notes that activity logs for a member cannot be reviewed after that person is removed from the organisation, so export the logs you need for an investigation before removal.
Admin roles and privileged access
| Role | Scope (Figma docs) | Least-privilege guidance |
|---|---|---|
| Organisation admin | Organisation-wide settings: authentication, SCIM, domains, sharing, extensions, activity logs, Activity Logs API (Enterprise) | Two or three named people; quarterly review (our cadence) |
| Workspace admin (Enterprise) | Responsibilities within the assigned workspace | Delegate to business unit design leads |
| Billing group admin (Enterprise) | Seats and billing within the assigned billing group | Finance or procurement, no security settings |
| Team admin | Individual team settings and membership | Team leads |
Organisation admins alone can read activity logs and change public sharing, so protect those accounts with SAML and your identity provider's strongest MFA. See the SaaS Admin Account Protection guide.
Link sharing and open sessions
| Control | Plan and path (Figma docs) | Effect | Recommended baseline |
|---|---|---|---|
| Public link sharing | Organization: Settings > Content > Sharing and publishing. Enterprise: Settings > External access > Public sharing | Off makes all files private to members and invited people | Off, unless public sharing is a business need |
| Require passwords | Enterprise | Removes "Anyone with the link"; viewers need a password | On where public sharing stays on |
| Autogenerated passwords only | Enterprise | Passwords generated from four random words | On |
| Require file links to expire | Enterprise | Maximum 1 hour to 60 days; expired links revert to private; also disables public link sharing in FigJam | Our recommendation: 30 days or less |
| Custom settings for workspaces | Enterprise | Workspace settings override organisation defaults for its teams and folders | Stricter settings for workspaces handling unreleased products |
| FigJam open sessions | Organization and Enterprise, organisation-wide only | Open sessions end after 24 hours | Off unless used for workshops |
Figma's article does not state whether new password or expiry requirements change links that already exist, so after tightening policy, review public links in the activity log and confirm behaviour in Figma's current documentation.
External collaboration and guests
- Connected folders: collaborate with other organisations through connected folders, where host admins control security settings and either side can disconnect.
- External plan creation: on Enterprise with verified domains, restrict members from creating plans outside your organisation.
- External content and guest expiration: with Governance+, restrict access to external content and set guest access to expire.
- Guest review: Admin lists members and guests, so remove guests whose project has ended. Guest logins are not recorded in the activity log, which makes periodic review the main control.
Integrations, API tokens and service accounts
Plugins, widgets, OAuth apps and personal access tokens (PATs) all reach Figma data. Each is a non-human identity that needs an owner and the narrowest access that works.
Plugins and widgets
- Approval mode: Admin > Settings > Extensions > Plugin approval and Widget approval, set to admin-approved only. Tick Allow members to request plugins/widgets.
- Review requests: the review window shows security and network information, licensing and request history, with Try it out in a draft outside the organisation before you approve.
- Scope approvals: on Enterprise, approve for the whole organisation or selected workspaces, and adjust with Edit approvals.
- Updates: updates to approved items do not need re-approval, but admins are emailed if an update changes network access or the security disclosure. Re-review on that email.
- Private plugins: plugins and widgets published privately within the organisation skip approval, so control who can publish them through your development process.
Personal access tokens and scopes
PATs are created under account Settings > Security > Personal access tokens with Generate new token, shown once, and revoked with Revoke access. A PAT acts as the user who generated it, and Figma recommends one token per integration.
| Scope (Figma REST API) | Allows | Handling |
|---|---|---|
file_content:read, file_metadata:read | Read file contents or metadata | Prefer metadata only where content is not needed |
file_comments:write, file_dev_resources:write, file_variables:write | Write comments, dev resources, variables | Grant only to integrations that write |
webhooks:write | Create and manage webhooks | Treat as privileged: webhooks send events to external endpoints |
org:activity_log_read | Read activity logs (Enterprise, org admins) | SIEM collector only |
org:developer_log_read, org:discovery_read | Developer logs and text event data (Governance+) | Restrict to security and eDiscovery tooling |
files:read (deprecated) | Broad read across files, users, comments and more | Replace with granular scopes |
Scopes do not override permissions set by the organisation or by file, folder and team owners. Our recommendation: run integrations from a dedicated account owned by the platform team, keep tokens in a secrets manager, and confirm current PAT expiry options in Figma's developer documentation when you create each token. The Activity Logs API, Discovery API and Embed API require an OAuth app. See the SaaS API Token Security Guide and the SaaS and OAuth App Governance Guide.
Logging and detection
Activity logs are available on Education (K-12), Organization, Government and Enterprise plans to organisation admins, under Admin > Activity. Logging starts on upgrade and cannot be backfilled. Entries include event, member, UTC time, product, team and IP address. Get CSV emails all events for a date range; the Activity Logs API (Enterprise) supports continuous collection.
| Category (Figma docs) | Examples | What to watch for |
|---|---|---|
| Members | Sign-ins and sign-outs | Unusual IP addresses for admins |
| Files, branches, folders, teams | Create, move, share, export, delete, permission changes | Bulk exports; sharing to outside addresses |
| Organisations | Membership, SCIM tokens, SSO, 2FA for guests, AI feature settings | Any change to authentication policy |
| External access | Guest invites, public links, viewing external files | Public links on files in sensitive workspaces |
| Plugins, widgets, integrations, webhooks | Approval and configuration events | New webhooks; approvals outside review |
| Identity provider | SCIM provisioning, deprovisioning and profile updates | Deprovisioning failures |
Retention is not stated in Figma's activity log article, so collect continuously into your SIEM. See the SaaS Audit Log Retention and Licensing Guide.
Metrics that show it is working:
- Share of members signing in through SAML (target 100% on verified domains).
- Public links created per month, and the share with passwords and expiry.
- Guests with no activity in 90 days.
- Approved plugins and widgets with a named owner; requests reviewed within a target time.
- Integrations using granular scopes rather than
files:read. - Number of organisation admins (trend down).
Hardening baseline
A phased rollout. Turning off public link sharing makes files private at once and can be reverted by turning it back on; switching SAML to mandatory affects sign-in at once, so test first. Tell design teams before you change sharing or extension settings, because members are not always warned when a link stops working or a plugin is no longer available. A short note in your design channel with the new rules, the request route for plugins and the contact for exceptions saves most of the support load in the first week.
- Inventory: export activity logs, list organisation, workspace and team admins, guests, approved plugins and integrations.
- Verify domains and decide on domain capture.
- Configure SAML with any login method allowed, test, then make it mandatory for members.
- Connect SCIM and set idle session timeout (Enterprise).
- Set public sharing policy: off, or passwords, autogenerated passwords and link expiry; add workspace overrides; turn off FigJam open sessions if unused.
- Set external collaboration rules and guest expiration where licensed; remove stale guests.
- Turn on plugin and widget approval with requests allowed; approve those in active use first.
- Move integrations to granular scopes and a dedicated account; revoke unused PATs.
- Connect the Activity Logs API and alert on authentication and sharing policy changes.
- Schedule reviews: quarterly admin, guest and plugin reviews (our cadence).
| Organisation profile | Priority choices |
|---|---|
| Organization plan | SAML mandatory, public link sharing off or limited, plugin and widget approval, CSV log exports |
| Enterprise | Passwords and expiry on links, workspace overrides, idle session timeout, SCIM group sync, Activity Logs API |
| Enterprise with Governance+ | All of the above plus guest expiration, external content restriction, developer and discovery logs |
Common misconfigurations
- Public sharing left at the default: decide on it explicitly.
- Assuming SAML covers guests: it covers members only; review guests.
- Unverified domains: members on them sit outside SAML; verify every corporate domain.
- Open extension use: require approval for plugins and widgets, and re-review on network access change emails.
- Broad legacy scopes: replace
files:readwith granular scopes. - Removing a member before exporting their logs: export first, then remove.
Apply Figma's product updates and security notices as published.
Framework mapping
| Figma control | NIST SP 800-53 Rev 5 | NIST CSF 2.0 | ATT&CK technique it helps address |
|---|---|---|---|
| SAML, domain verification, idle session timeout | IA-2, AC-12 | PR.AA-01 | T1078.004 Cloud Accounts |
| SCIM and guest review | AC-2 | PR.AA-01 | T1078.004 Cloud Accounts |
| Public link policy, workspace overrides | AC-3, AC-6 | PR.AA-05, PR.DS-01 | T1213 Data from Information Repositories |
| Plugin approval, token scopes | CM-7, SA-9 | GV.SC-07 | T1528 Steal Application Access Token |
| Activity logs to SIEM | AU-6 | DE.CM-03, PR.PS-04 | T1567 Exfiltration Over Web Service |
Practitioner checklist
- All corporate domains verified and registered with the identity provider.
- SAML mandatory for members; SCIM connected.
- Organisation admins limited to named people; workspace and billing group roles used for delegation.
- Public link sharing off, or passwords and expiry required.
- FigJam open sessions off unless needed.
- Guests reviewed quarterly, with expiration where licensed.
- Plugin and widget approval on, with requests reviewed.
- Integrations on granular scopes, one token per integration, unused PATs revoked.
- Activity logs collected continuously, with alerts on sign-in and sharing policy changes.
Standards and references
- Figma: Guide to organization administration
- Figma: Guide to single sign-on (SSO)
- Figma: Manage public link sharing and open sessions
- Figma: Manage plugins and widgets in an organization
- Figma: View and export activity logs
- Figma: Manage personal access tokens
- Figma Developers: Scopes
- Figma Developers: Authentication
Related NHI Mgmt Group resources: Work SaaS API tokens, Secure File Sharing Guide, SaaS and OAuth App Governance Guide, SCIM Provisioning Guide, SaaS Security Guide.