Skip to main content
Connect Figma to Oleria to see who has access to your Figma organization: its users, their seat types, its admins, and the groups that grant workspace and billing group access. Oleria reads identity data from the Figma SCIM API and, optionally, audit events from the Figma activity log, so you can see where access is over-provisioned and take action directly from Oleria.

​
What Oleria discovers

Once connected, Oleria continuously discovers and maps the following from your Figma organization:
  • Accounts - every user provisioned through SCIM, with their name, email address, status, title, and department. Deactivated users stay listed and are marked as disabled.
  • Roles - each user’s seat type (Full seat, Dev seat, Collab seat, or View seat) and the Org Admin role for organization admins. Figma has no role catalog, so Oleria derives these from each user’s seat type and admin flag.
  • User groups - every SCIM group and its members. In Figma, each SCIM group is linked by name to a workspace or billing group, and its members get access to that workspace or billing group.
  • Activity - audit events from the Figma activity log, if you provide an activity log token.
Oleria refreshes this data on its regular sync schedule.
Oleria doesn’t import teams, projects, or files. This integration covers identity and access governance for people and groups only.

​
Prerequisites

  • A Figma Organization or Enterprise plan. SCIM isn’t available on the Starter or Professional plans.
  • A Figma organization admin account to find the SCIM tenant ID and generate the SCIM API token.
  • Admin access to the Oleria workspace.
  • Optional: a Figma Enterprise plan, if you want seat types, organization admins, and activity. On the Organization plan, Figma doesn’t return seat types or the admin flag, and the activity log isn’t available. Oleria still imports users, groups, and group membership.
Dormant account detection needs the activity log token, which requires the Enterprise plan. On the Organization plan, Oleria can’t detect dormant Figma accounts.

​
Get your SCIM credentials from Figma

1

Copy the SCIM tenant ID

Sign in to Figma as an organization admin, go to Admin -> Settings -> Login and provisioning -> SAML SSO, and copy the Tenant ID.
2

Generate a SCIM API token

Go to Admin -> Settings -> Login and provisioning -> SCIM provisioning, then select Generate API token. Copy the token somewhere secure.
Figma shows the token only once, and generating a new token invalidates the previous one. If your identity provider already provisions Figma through SCIM, reuse its token. If you generate a new token instead, your identity provider’s provisioning stops working until you update the token there too.
The exact location of these settings can change over time. If the steps above don’t match what you see, refer to Figma’s own SCIM provisioning documentation.

​
Optional: get an activity log token

To collect the Figma activity log, Oleria needs an OAuth access token with the org:activity_log_read scope. The activity log is available only on the Enterprise plan, and only to organization admins.
1

Create a private OAuth app

As an organization admin, create an OAuth app in Figma that’s owned by your organization. Add a callback URL that you control, such as https://localhost/callback, and note the app’s client ID and client secret. See Figma’s OAuth apps documentation.
2

Authorize the app

While signed in to Figma as an organization admin, open the following URL in your browser, replacing the placeholders:
Approve the request. Figma redirects to your callback URL. Copy the value of the code parameter from the address bar. The page itself may not load, and that’s expected.
3

Exchange the code for an access token

Run the following command right away, because the code expires quickly:
Copy the access_token value from the response. This is the activity log token.
Figma OAuth access tokens expire after 90 days, and Oleria doesn’t refresh them. Replace the token in Oleria before it expires, or activity collection stops.

​
Connect Figma to Oleria

1

Open the integration

Go to your Oleria workspace, select Integrations -> select Figma.
2

Complete the connection form

Select Continue and provide the following:
3

Confirm the connection

Select Authenticate. Oleria checks the tenant ID and SCIM token, and checks the activity log token if you entered one. Find the newly connected organization on the Connected tab of your Oleria Integrations page.
You can connect each Figma organization to Oleria once. To connect a different organization, add a new integration.

​
Verify the integration

Confirm the Figma organization appears on the Connected tab of your Oleria Integrations page. After the first sync completes, you can review the discovered accounts, roles, and groups in your Oleria workspace. To rotate a token, edit the integration and enter the new token. To keep an existing token when you edit other settings, leave its field empty. To stop collecting activity, edit the integration and select Stop collecting activity logs and remove the stored activity log token.
If you revoke the SCIM token in Figma, the sync fails until you enter a new one. If the activity log token expires, only activity collection fails. Accounts, roles, and groups keep syncing.

​
Reconnect a SCIM-based Figma connection

If you connected Figma before the native integration was available, your connection used a SCIM base URL and token. That connection stops syncing and must be reconnected:
1

Edit the integration

On the Connected tab of your Oleria Integrations page, edit the Figma integration.
2

Enter the SCIM credentials

Enter the SCIM Tenant ID and a SCIM API Token. Oleria doesn’t reuse the token from the earlier connection.
3

Confirm the connection

Select Authenticate.

​
Remediation actions

Oleria can take these actions in Figma using the SCIM API token:
  • Deactivate a user and reactivate a user. Figma removes a deactivated user from the organization but keeps the user’s record, so you can reactivate the same user later.
  • Add a user to a group and remove a user from a group. The user gains or loses access to the workspace or billing group linked to that group.
Keep these limits in mind when you use these actions:
  • Your identity provider owns Figma’s SCIM users and groups. If it still assigns the user or group membership, it may undo the change on its next provisioning cycle. Make lasting changes in your identity provider.
  • If Figma rejects a request to remove a user from a group, the action fails and no group members are removed.
  • Oleria doesn’t change seat types or organization admin status.

​
Known limitations

  • Oleria doesn’t currently import MFA or single sign-on settings for Figma users.
  • Figma’s SCIM API doesn’t return when a user last signed in. Oleria uses each user’s most recent activity log event for dormant account detection, so it needs an activity log token.
  • Oleria imports only groups that your identity provider provisions through SCIM. Workspaces and billing groups without a linked SCIM group don’t appear.
  • Guests and other users not provisioned through SCIM don’t appear in Oleria.
  • Figma for Government isn’t supported.

​
Contact us

For questions about this integration, contact us at support@oleria.com.