Disable just-in-time provisioning for SAML connections

Just-in-time (JIT) provisioning can now be disabled per enterprise connection. By default, Clerk creates a user account the first time someone signs in through a SAML connection. With JIT provisioning disabled, sign-ins only succeed for users who already exist in your instance - anyone else is rejected instead of being auto-created. This is useful when your identity provider handles authentication but a separate system, such as Directory Sync (SCIM) or an internal admin flow, decides who gets an account.

Disable JIT provisioning

Open a SAML connection in the Clerk Dashboard⁠ and turn off Create users during sign-in in the connection's settings. The same control is available on the Backend API as a disable_jit field when updating a SAML connection or enterprise connection.

When JIT provisioning is disabled, a sign-in attempt by someone without an existing account fails with a saml_jit_provisioning_disabled error that includes the attempted email address, so blocked attempts are easy to diagnose. Existing users are unaffected and continue to sign in normally, including the first time they sign in through the SAML connection.

Compatibility

JIT provisioning remains enabled by default, so existing connections keep provisioning users exactly as before. Connections that previously had JIT provisioning disabled through the internal exception are migrated to the new setting automatically — their behavior is unchanged, it's just visible and editable in the Dashboard now.