SAML Single Sign On User Provisioning Overview Current: JIT - Just-In-Time Provisioning JIT - Just-In-Time Provisioning If LDAP and User Sync are no options for you, you can still use Just In Time (JIT) provisioning. JIT creates and updates users on-the-fly via the SAML attributes when they log in into your Atlassian product (see Create or update users through SAML Attributes). Setting up JIT is more effort then LDAP or User Sync, but since it uses SAML attributes it is always an option to lower your administration effort.AdvantagesUsers will only be created when needed.Users also can be updated.It is also possible to send group memberships via SAML attributes, thus updating the groups of a user. But there are limitations for Azure AD (see Disadvantages)Lowers your administration efforts in comparison to manage users manually.DisadvantagesYou cannot disable users.Similar to User Sync, users are also not able to login with their password if single sign on fails for any reason.Users only get created after their first log in, thus you cannot assign users to projects or tickets before their first login.If you modify your user at your IdP, users only get updated after they log out and log in again. In consequence, when you assign or remove groups from users or change their profile, your Atlassian product will only be update the users, when they log out and log in again.For Azure AD, there is also a special restriction:In contrast to other IdPs, Azure AD only transmits group ids via the SAML attributes, e.g. "42" instead of the group name. If you only have a small amount of groups and you do not really add new groups often, you can use the group transformation feature of our SAML plugin to create a special group mapping. E.g. "42" then can be mapped to a group name. But, this is only feasible when you only have a low number of groups, since you have to create the group transformations for each group by hand.GSuite does not support groups via SAML attributes.