# Just-in-time User Provisioning on Confluent Cloud Just-in-time (JIT) user provisioning automatically creates Confluent Cloud user accounts, then uses [group mappings](group-mapping/overview.md#group-mapping), to grant Confluent Cloud access to Confluent Cloud resources based on group memberships in your single sign-on (SSO) identity provider. When a user from your SSO-enabled organization uses their SSO credentials to sign in to Confluent Cloud for the first time, Confluent Cloud automatically creates a user account with no predefined access to Confluent Cloud resources. If group mappings are available, the user is automatically granted Confluent Cloud role-based access control (RBAC) roles and permissions based on their group memberships in the organization’s user directory at your SSO identity provider. #### IMPORTANT If you enable [SCIM user provisioning](scim.md#scim-user-provisioning), SCIM takes precedence for managing SSO user accounts, and you can no longer invite SSO users from Confluent Cloud. Enabling SCIM does not turn off JIT user provisioning, so users can still be provisioned at first SSO sign-in. To make your identity provider the sole source of new SSO user accounts, [turn off JIT user provisioning](#disable-jit-user-provisioning). JIT user provisioning and group mappings reduce your administrative workload and expedite user onboarding because you no longer must manually provision users by creating Confluent Cloud user accounts and configuring roles and permissions in advance. ## Enable JIT user provisioning RBAC role required: [OrganizationAdmin](../../../../access-control/rbac/predefined-rbac-roles.md#organizationadmin-role). JIT user provisioning is enabled by default for most Confluent Cloud organizations. If JIT user provisioning has been disabled, or if your organization has it disabled by default, you can enable it using either the Cloud Console or the REST API. For more information, see [Support for Azure Marketplace organizations](#jit-user-provisioning-az). ### Enable JIT user provisioning in the Confluent Cloud Console 1. In the Confluent Cloud Console, go to the SSO settings page for your organization. 2. Toggle **Just-in-time (JIT) user provisioning** to the on position. The toggle takes effect immediately for subsequent SSO sign-ins. ### Enable JIT user provisioning using the REST API To enable JIT user provisioning, use the Organizations API to update the organization settings by making an HTTP PATCH request to `/org/v2/organizations/` with the `jit_enabled` field set to `true`. The following curl command shows an example request: ```shell curl --request PATCH --url 'https://api.confluent.cloud/org/v2/organizations/' \ --header 'Authorization: Basic ' \ --header 'content-type: application/json' \ --data '{"jit_enabled": true}' ``` The response returns the updated organization setting in JSON format. For details about updating an organization using the Organizations API, see [Update an Organization](https://docs.confluent.io/cloud/current/ccloud/update-org-v-2-organization/). ## Support for Azure Marketplace organizations JIT user provisioning is disabled by default for Azure Marketplace organizations. To use JIT user provisioning for your Azure Marketplace organization, you need to enable JIT user provisioning in Confluent Cloud (see [Enable JIT user provisioning](#enable-jit-user-provisioning)) and update the Confluent Cloud application in Azure Portal. ### Update the Confluent Cloud application in Azure Portal To use JIT user provisioning for your Azure Marketplace organization, assign users and user groups to the Confluent Cloud application to ensure only assigned users can have their user accounts automatically created at first SSO sign-in. This also ensures existing SSO users do not lose sign-in access. * On the Confluent Cloud enterprise application properties page, apply the following updates: * Ensure that the **Enabled for users to sign-in?** option is set to **Yes**. This setting ensures that users can sign in to Confluent Cloud using their SSO credentials. * Set **Assignment required?** option to **Yes**. ## Disable JIT user provisioning RBAC role required: [OrganizationAdmin](../../../../access-control/rbac/predefined-rbac-roles.md#organizationadmin-role). You can disable JIT user provisioning using either the Confluent Cloud Console or the REST API. ### Disable JIT user provisioning in the Confluent Cloud Console 1. In the Confluent Cloud Console, go to the SSO settings page for your organization. 2. Toggle **Just-in-time (JIT) user provisioning** to the off position. The toggle takes effect immediately for subsequent SSO sign-ins. ### Disable JIT user provisioning using the REST API To disable JIT user provisioning for users in your SSO identity provider, use the Organizations API to update the organization settings by making an HTTP PATCH request to `/org/v2/organizations/` with the `jit_enabled` field set to `false`. The following curl command shows an example request: ```shell curl --request PATCH --url 'https://api.confluent.cloud/org/v2/organizations/' \ --header 'Authorization: Basic ' \ --header 'content-type: application/json' \ --data '{"jit_enabled": false}' ``` The response returns the updated organization setting in JSON format. For details about updating an organization using the Organizations API, see [Update an Organization](https://docs.confluent.io/cloud/current/ccloud/update-org-v-2-organization/).