Just-in-time (JIT) provisioning
The user's account is created automatically the first time they sign in through the company's SSO.
What it is
Just-in-time provisioning creates a local user and membership the first time a person completes SSO. After the SAML assertion or OpenID Connect ID token has been verified, the app uses trusted claims such as NameID or sub, email, and name to create the records it needs. Okta exposes it as a just-in-time provisioning setting on an inbound identity provider, and most B2B apps expose it as a per-connection toggle in their own SSO setup.
Reach for it when a customer wants employees to start using the product without an admin preloading a roster. It is lighter than SCIM and gets someone through the door at exactly the moment an account is needed. Keep the identity key tied to the issuer and provider subject, not just the email address.
The gotcha is the other end of the lifecycle: first login can create an account, but no login event arrives when an employee leaves. JIT alone cannot deprovision dormant users, so pair it with SCIM or an explicit admin process. Treat role and group claims as allowlisted input, and do not let an arbitrary email domain choose its own workspace.
Ask AI for it
Add just-in-time provisioning to the SAML 2.0 and OpenID Connect login callbacks. Verify the signature, issuer, audience, nonce, and time claims before any write. Key OIDC identities on issuer plus sub and SAML identities on the configured IdP plus NameID, then create the user and organization membership in one database transaction protected by unique constraints. Copy only allowlisted profile claims, map only approved IdP groups to app roles, and permit JIT enrollment only for an organization with that IdP explicitly configured. Record the creation in the auth audit log, refuse suspended memberships, and document that SCIM is still required for automatic deprovisioning.