> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stackone.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Just-in-Time Provisioning
> Create members automatically the first time they sign in through SSO, and grant admin from a fixed identity provider attribute.
Just-in-time (JIT) provisioning creates a StackOne member automatically the first time someone signs in through your SSO connection. There's no invitation to send and no directory push to configure: an assigned user signs in with SSO and becomes a member of your organization.
JIT rides on your SSO connection, so [set up SSO](/identity/sso/overview) first. It's a lighter-weight alternative to [Directory Sync](/identity/scim/overview): JIT provisions a member the moment they first sign in, where Directory Sync provisions them ahead of time from your directory.
## How JIT works
On a user's **first** SSO sign-in, StackOne:
* Adds them to your organization, at the organization role your identity provider asserts (**Viewer** by default, **Admin** on an exact attribute match, see [Organization role](#organization-role-from-your-identity-provider) below).
* Grants them the connection's **provisioned access**: the projects you selected, each at the role you set for it.
Returning sign-ins don't re-provision. JIT only ever runs on the first sign-in that creates the account.
The organization role is set once, at that first provision. Changing `stackone_role` in your identity provider later, including removing it to demote someone, doesn't change an existing member's role. Adjust a member's role from the dashboard, or remove their access entirely by deprovisioning them in your identity provider.
An invitation always wins. If the person signing in has a pending invitation to your organization, JIT steps aside and the invitation's role is used instead. Directory Sync provisioning also takes precedence, so a user your directory already created keeps the membership it gave them.
## Organization role from your identity provider
By default, JIT provisions members as organization **Viewers**, the least-privilege role. To provision someone as an organization **Admin**, have your identity provider send a fixed attribute on the SSO assertion:
| Attribute | Value | Organization role |
| --------------- | -------------------------- | ----------------- |
| `stackone_role` | `admin` | Admin |
| `stackone_role` | any other value, or absent | Viewer |
The value is matched case-insensitively and trimmed, but it must be exactly `admin`. `admin`, `Admin`, and `ADMIN` all grant admin, while `administrator`, `admin-readonly`, an empty value, or a missing attribute all resolve to **Viewer**. StackOne never grants anything above organization admin from an identity provider attribute, so an unexpected value can only ever leave a member as a viewer.
Send `stackone_role` as a SAML attribute statement named exactly `stackone_role`. Send the value `admin` only for the people who should administer the organization, and leave the attribute off everyone else so they're provisioned as viewers.
This is the same mapping [Directory Sync](/identity/scim/overview) uses: a SCIM `roles` value of `admin` provisions an organization admin, and everything else a viewer.
Organization admins can manage members, connections, and billing for the whole organization. Treat `stackone_role: admin` as you would any admin grant, and drive it from a group or rule in your identity provider that you already trust to define your StackOne admins.
## Prerequisites
* A verified SSO connection for your organization. JIT provisions members as they sign in through it. See [SSO overview](/identity/sso/overview).
* The **Org Admin** role to configure the defaults.
JIT is turned on per connection with the **Enable JIT** action, so nothing to request from support. The projects and roles you set are the connection's shared **provisioned access**: [Directory Sync](/identity/scim/overview) applies the same set, so configuring it once covers both.
## Set up JIT
In the StackOne dashboard, go to **Organization > Security > SSO** and open your verified SSO connection. Select the **Provisioning** tab, then, on the **Provisioned access** card, select **Manage access**.
Pick the projects provisioned members should join and choose a role for each one (**Viewer**, **Member**, or **Admin**), then select **Save changes**. Pick the least-privilege role that fits each project. This sets project access only; the organization role comes from your identity provider.
On the **Just-in-time provisioning** card, select **Enable JIT**. Provisioning starts on the next first-time sign-in. If you haven't set any provisioned access yet, enabling JIT walks you through it first, so a member is never provisioned into nothing.
To grant organization admin to specific people, configure your identity provider to send the `stackone_role` attribute with the value `admin` for them, as described in [Organization role](#organization-role-from-your-identity-provider). Leave it off everyone who should stay a viewer.
Assign the users to the StackOne application in your identity provider. The first time each of them signs in through SSO, StackOne creates their membership at the organization role and provisioned access above.
## Next steps
Set up the SSO connection JIT provisions members through.
Provision members ahead of time from your directory over SCIM.
Grant many members the same project or account access at once.
Connect Okta as your SAML identity provider.