Inviting people one by one works well for a small, known group. It gets harder when dozens or hundreds of colleagues should be able to open the roadmaps you share, and your identity provider (IdP) already knows who belongs.

Just-in-time (JIT) provisioning removes the invitation step for those people.

What JIT provisioning does

When JIT provisioning is on, anyone who signs in to Craft.io through your identity provider joins the account on their first sign-in. They do not need an invitation.

What it would mean for them:

They join as a Stakeholder.
They are not added to any space and do not use a paid seat.
Their name and email come from your identity provider.

Stakeholders can open views that are shared with account members.
If someone needs more access, an admin can add them to a space later.

JIT provisioning only adds people, it never removes anyone.

Before you start

JIT provisioning requires SSO to be set up on your account. SSO is configured by Craft.io Customer Success, so if it is not set up yet, contact your Customer Success Manager first.

Make sure that:

SSO is set up on your account. Without it, the setting is unavailable.
You are an account Owner or Admin. Only Owners and Admins can turn JIT provisioning on or off.
Your colleagues use an email address on a domain covered by your SSO, for example @yourcompany.com.
Your identity provider sends each person's email address, first name, and last name. All three are required, and the attribute names depend on your identity provider.

You do not need to change anything in your identity provider.

JIT provisioning uses your existing SSO connection and is turned on in Craft.io.

🚩 By default, JIT provisioning is off. Turning it on is a deliberate step, because it means anyone your identity provider admits to the Craft.io app can become an account member.

Turn JIT provisioning on or off

Follow these steps:

Open the Account Manager, then select Account settings.
Find Just-in-time provisioning in Account settings.
Turn the switch on.
Read the confirmation message, then select Turn on.

The confirmation reminds you that anyone who signs in through your company identity provider will join as a Stakeholder.

To turn it off, switch it off again. No confirmation is needed.

Either change applies from the next sign-in. Turning it off does not remove anyone who already joined.

What happens when someone signs in

Each time someone signs in through your identity provider, Craft.io checks these in order. The first one that applies decides what happens.

Have you deactivated them in this account?
They stay deactivated. Signing in never brings back someone you deactivated.
Do they have a pending invitation to this account?
The invitation is accepted for them, with the spaces and roles you invited them with. They are not registered as a Stakeholder. This happens whether or not just-in-time provisioning is on.
Already a member: the person signs in and their access stays the same.
JIT provisioning is on: the person joins as a Stakeholder.
None of the above: the person is not let in and sees "You don't have access to this Craft.io account yet. Ask your administrator to invite you." No user is created.

Examples:

A new colleague who is assigned the Craft.io app in your IdP but was never invited signs in with JIT on: they join as a Stakeholder.
The same colleague signs in the next day: they sign in, and nothing new is created.
A new colleague signs in with JIT off: they are not let in.
A colleague was invited to a space but never accepted: the invitation is accepted, with the invited role.
A long-time Standard user signs in: their access does not change.
A deactivated colleague signs in: they stay deactivated.

Shared views and JIT provisioning

Imagine you share a roadmap with a colleague who has never used Craft.io.

When they open the link, Craft.io routes them through your identity provider.

With JIT provisioning on, they join as a Stakeholder and land directly on the shared view.

This works with views shared using the Account members link type.

Manage people who joined through JIT

JIT provisioning never locks anyone. People who join this way are managed in Craft.io like any other account member. Here is what you can and cannot change:

Space membership and roles: Account admins can change it. Signing in never changes them.
Account Admin role: admins can set it. Signing in leaves it alone.
Deactivate or reactivate: allowed. Signing in does not reverse it.
Remove from account: allowed. Keep in mind that the person rejoins as a Stakeholder at their next sign-in if they are still assigned the Craft.io app in your IdP.
Name: each sign-in overwrites it with the name from your IdP, so change it there.
Email and password: these cannot be edited in Craft.io, because your domain uses SSO.

To give a Stakeholder more than view access, add them to a space from the Account Manager. On that page, Stakeholders appear under the Stakeholder type in the Type column, which you can sort to group them in one click.

Remove someone's access

With JIT provisioning on, your identity provider is the place to remove access. Unassign the Craft.io app from the person there, and they can no longer sign in.

To block someone permanently, deactivate them in Craft.io.

A deactivated person stays deactivated even if they are still assigned the app in your IdP.

Frequently asked questions

Can I limit JIT provisioning to certain groups or domains?
Group and domain restrictions are handled in your identity provider. Craft.io does not add its own.
Does JIT provisioning affect feedback portal users?
No. Feedback portal users are not affected.
Does JIT provisioning hand control of my account to the identity provider?
No. JIT provisioning only adds people at sign-in. Account Owners and Admins stay in control of roles, spaces, and deactivation in Craft.io.
What happens if someone's email address changes in the IdP?
Craft.io matches people by email address. The new address creates a new Stakeholder, and the original user keeps their spaces until an admin cleans up the old record.

Troubleshooting

The setting is greyed out and reads "Available once SSO is set up": SSO is not set up on your account. Contact your Customer Success Manager.
A colleague sees "You don't have access to this Craft.io account yet": JIT provisioning is off and they have no invitation. Turn it on, or invite them.
A colleague cannot reach the sign-in page: they may not be assigned the Craft.io app in your IdP, or their email domain is not covered by your SSO.
A removed user is back: they are still assigned the Craft.io app in your IdP. Unassign it there, or deactivate them in Craft.io.
A colleague appears twice: their email address was changed in your IdP. Ask an admin to remove or deactivate the old record.

What comes next?

Once JIT provisioning is on, the next step is sharing a view with your account. Share a roadmap with the Account Stakeholders link type, and your colleagues can open it with a single sign-in. Teams often start with one roadmap for leadership, then expand from there.

Need more guidance? 🙋 Our LIVE support team (at the bottom right corner of your screen) replies to ANY question!