With just-in-time provisioning, you can use SAML to create users on the fly the first time they try to log in. This eliminates the need to create user accounts in advance.

For example, if you recently added an employee to your organization, you don't need to manually create the user in Salesforce. When they log in with single sign-on, their account is automatically created for them, eliminating the time and effort with on-boarding the account.

Just-in-time provisioning works with your SAML identity provider to pass the correct user information to Salesforce in a SAML 2.0 assertion. You can both create and modify accounts this way. Because just-in-time provisioning uses SAML to communicate, your organization must have SAML-based single sign-on enabled.