SAML SSO – Erro de certificado de assinatura no Figma com Microsoft Entra ID

HI ​@Djalma Gabriel, thanks for reaching out! 

I understand how this must be slowing down your workflow. Good news for your first questions: running two independent Figma Enterprise orgs from the same Microsoft Entra ID tenant is fully supported, and each org should have its own Entra Enterprise Application. There's no limitation or cross-org conflict there, and the certificate on App 1 has no bearing on Org 2. Each Entra Enterprise App generates its own SAML signing certificate, so the cert uploaded to Org 2 must be the one from App 2; they don't need to match, and they shouldn't. auth.error.saml_invalid_signature almost always means the cert stored in Figma for that org isn't the one currently signing assertions from that app.

A few things worth checking in Org 2:

• Cert source and format: In Entra, under SAML Signing Certificate, download Certificate (Base64) from App 2 (not the Federation Metadata XML, and not a copy of App 1's cert). If the cert was ever reassembled or edited by hand in a text editor, re-download a clean copy — stray line breaks or missing header/footer lines will fail validation.
• Active vs. inactive cert: If Entra has more than one certificate listed, confirm the one you uploaded is the Active one. Entra sometimes creates a new cert during setup.
• Force the update in Figma: Figma won't always pick up a rotated cert on its own. Go to Admin → Settings → Log in and provisioning → SAML SSO → Edit configuration, select "Other" as the identity provider, re-enter the IdP Entity ID and IdP SSO Target URL from App 2, and re-upload the Base64 cert. Full steps here: Set up a custom SAML configuration.
• Cross-check the basics against Org 2's own values: The Identifier (Entity ID), Reply URL (ACS) and Sign-on URL in App 2 must match what Org 2's SAML SSO page shows (not Org 1's), and NameID format should be urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress. Guide to SAML SSO
• Keep a fallback while testing: Leave the org's authentication set to allow email/password so an admin can always get back in if a config change goes sideways, then test SSO in an incognito window. Set login and authentication method

On your question 5, verifying the stored certificate against your specific Tenant ID: that needs account-level access, so we can't do it here in the public forum, and please don't post Tenant IDs, metadata, or cert details in this thread. Could you open a support request as an Org Admin of the second org? Attach the Tenant ID, App 2's SAML metadata, and the Base64 cert, and link back to this thread; our Enterprise team can compare the stored cert against your assertion directly.

One question that'll help either way: is the error hitting every user in Org 2, or just some? If it's org-wide it points squarely at the cert/config; if it's isolated to a few people it's usually an app assignment or duplicate-account issue instead.

Please note these are general best-practice guidelines; depending on your IdP configuration additional steps may be required, and Figma can't guarantee they'll work for every setup. IdP implementation is undertaken at the customer's own risk. But let us know how it goes, I can also help connect you with our support team, as needed.