Just-in-Time (JIT) Provisioning during SAML SSO

Just-in-Time (JIT) Provisioning, or automatic account provisioning, is a process by which accounts for employees are created on-demand during the first time they authenticate via SAML SSO in your application.

Using JIT Provisioning means your IT department won't have to manually create user accounts for each of the services or apps your employees use to get work done.

Clerk supports JIT account provisioning for all supported SAML providers.

Check your preferred SAML provider's documentation to enable JIT account provisioning on their side.

If you need users to be provisioned and deprovisioned automatically — without waiting for a sign-in event — consider using Directory Sync (SCIM) instead.

Disable JIT Provisioning

By default, JIT Provisioning is enabled for every SAML connection. You can disable it for an individual connection if you want full control over which users can create an account in your application. For example, you may want users to be provisioned only through Directory Sync, an invitation, or the Backend API⁠.

When JIT Provisioning is disabled for a connection:

• Users who already have a Clerk account can sign in using the connection as usual, regardless of how their account was created.
• Users without an existing account can't sign in. Instead, they receive the saml_jit_provisioning_disabled error, which includes the email address used during the sign-in attempt.

To disable JIT Provisioning for a SAML connection:

1. In the Clerk Dashboard, navigate to the SSO connections⁠ page.
2. Select the SAML connection you want to disable JIT Provisioning for.
3. Select the Settings tab.
4. Toggle off the Create users during sign-in option.
5. Select Save.

To manage this setting programmatically, use the disable_jit_provisioning property of the Backend API's Update Enterprise Connection⁠ endpoint.

Sync user attributes during sign in

During SAML SSO and after a user has successfully authenticated, the IdP provides Clerk with the corresponding user data. After each successful sign in, Clerk handles keeping the user data up-to-date based on the response of the SAML provider. This means that if a user's data changes on the IdP side, Clerk will automatically update the user's data in the Clerk database.

To disable this behavior:

1. In the Clerk Dashboard, navigate to the SSO connections⁠ page.
2. Select the SAML connection you want to disable the sync for.
3. Select the Settings tab.
4. Toggle off the Sync user attributes option.
5. Select Save.