> ## Documentation Index
> Fetch the complete documentation index at: https://docs.userpilot.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Just-in-Time (JIT) Provisioning

> Automatically create Userpilot teammates the first time they sign in with SSO, using your verified identity-provider domains.

<Note>
  This feature is available on the Enterprise plan and requires [SSO](/configure/team-and-roles/sso) to be enabled.
</Note>

### Overview

Just-in-Time (JIT) provisioning creates a Userpilot account for a teammate the first time they sign in through SSO. No manual invite or prior sync is required. Without JIT, a person who signs in with SSO but has no account is turned away. With JIT, their account is created during sign-in and given a default role.

JIT is the simplest way to onboard a team. It works alongside the other provisioning methods:

* **JIT** handles individual first-time sign-ins.
* **[SCIM](/configure/team-and-roles/scim)** keeps whole groups of users and their roles in sync with your identity provider.
* **[CSV import](/configure/team-and-roles/csv-import)** invites a known list of teammates in bulk.

JIT and SCIM work well together. JIT gives a teammate immediate access on first login, and a later SCIM sync can move them into a mapped group and update their role.

### Requirements

* [SSO](/configure/team-and-roles/sso) enabled for the organization.
* An Account Owner role, or a role with the Manage SSO permission.

## Enabling JIT provisioning

JIT is configured on the **Just-in-time provisioning** card under **Settings > Team > [Authentication](https://run.userpilot.io/settings/team/authentication)**. The card appears once SSO is enabled.

<Steps>
  <Step title="Turn JIT on">
    Switch on **Create teammates automatically on first SSO login**.
  </Step>

  <Step title="Choose a default role">
    Set **Default role on first SSO login**. This role is granted when a teammate signs in via SSO for the first time, until SCIM assigns them a mapped role. The available roles are Admin, Publisher, Analyst, and Account Owner. Because this role applies to everyone JIT creates, pick Account Owner only if every teammate who signs in through your verified SSO domains should have full ownership.

    <Info>
      JIT stays off until you choose a default role.
    </Info>
  </Step>

  <Step title="Choose a default application">
    Set **Default application**. This is where auto-created teammates land on their first SSO login, and on logins started from your IdP tile.
  </Step>
</Steps>

<Frame>
  <img src="https://mintcdn.com/userpilot/o9MX9rURnW9bs0V7/images/jit-provisioning.png?fit=max&auto=format&n=o9MX9rURnW9bs0V7&q=85&s=5aad2a3d20f4b560718e675c24626a53" alt="Just-in-time provisioning settings" width="2000" height="414" data-path="images/jit-provisioning.png" />
</Frame>

## How it works

The first time a teammate signs in through SSO without an existing account, Userpilot does the following:

1. Confirms the sign-in came through your organization's verified SSO connection.
2. Checks that the teammate's email domain is one of your verified SSO domains.
3. Creates the account, assigns the default role, and places the teammate in the default application.

<Info>
  If SCIM later places a JIT-created teammate into a mapped group, that group's role replaces the JIT default role on the next sync. The JIT default is a starting point, not a permanent assignment. The one exception is the Userpilot [role-management mode](/configure/team-and-roles/scim#choosing-who-owns-roles), where SCIM never changes roles.
</Info>

## IdP-initiated SSO

JIT provisioning supports IdP-initiated SSO, so teammates can reach Userpilot straight from your identity provider without being invited beforehand.

There are two ways to start an SSO sign-in, and JIT works with both:

* **Service-provider-initiated.** The teammate starts from Userpilot, enters their work email, and is redirected to your identity provider to authenticate before being sent back to Userpilot:

  `Userpilot → Identity provider → Userpilot`
* **IdP-initiated.** The teammate opens the Userpilot tile from their identity provider's app dashboard and is sent straight to Userpilot, where JIT provisioning creates their account and completes the sign-in:

  `Identity provider → Userpilot`

<Frame caption="Example: an identity provider's app dashboard. Selecting an app tile (shown here in Okta) starts an IdP-initiated sign-in.">
  <img src="https://mintcdn.com/userpilot/idWCuF5jtX2Yhtj7/images/idp-initiated-app-tile.png?fit=max&auto=format&n=idWCuF5jtX2Yhtj7&q=85&s=39476db46466fe34ec37eb3639583875" alt="Identity provider app dashboard showing application tiles" width="1046" height="822" data-path="images/idp-initiated-app-tile.png" />
</Frame>

With JIT enabled, an eligible teammate has their Userpilot account created during their first SSO login from either flow, as long as their email domain is one of your verified SSO domains. A manual invitation or prior SCIM sync is not required. New teammates land in the [default application](#enabling-jit-provisioning) you set for JIT.

## JIT and SSO are linked

JIT only runs during an SSO sign-in, so its availability follows SSO:

* Disabling SSO automatically turns JIT off.
* Deleting the SSO configuration turns JIT off and clears the JIT default role.

If you re-enable SSO later, re-enable JIT and select its settings again.

## FAQs

<AccordionGroup>
  <Accordion title="Why isn't a teammate being auto-created?" defaultOpen="false">
    Check that JIT is on, that a default role and default application are set, and that the teammate's email domain is one of your verified SSO domains.
  </Accordion>

  <Accordion title="Can JIT assign someone as Account Owner?" defaultOpen="false">
    Yes. Account Owner is selectable as the JIT default role, the same as in [CSV import](/configure/team-and-roles/csv-import). Because the default role applies to every teammate JIT creates, choose it only when that is what you intend.
  </Accordion>

  <Accordion title="Do I still need SCIM if I use JIT?" defaultOpen="false">
    Not necessarily. JIT alone is enough to onboard teammates on first login. Add SCIM when you also want roles and de-provisioning to stay in sync with your IdP groups.
  </Accordion>

  <Accordion title="Does JIT work with IdP-initiated SSO?" defaultOpen="false">
    Yes. When a teammate opens the Userpilot tile in your identity provider (an IdP-initiated login), JIT creates their account and signs them in, the same as a sign-in started from Userpilot. No prior invite or SCIM sync is needed.
  </Accordion>
</AccordionGroup>

<Frame>
  [**For any questions or concerns please reach out to support@userpilot.com**](mailto:support@userpilot.com)
</Frame>