---
updatedAt: 2025-08-26T18:53:39.000Z
agentTools:
  projectIndex: https://docs.synthesia.io/llms.txt
---

# Just-in-Time (JIT) Provisioning

Automatically onboard users from your domain—no manual invites required.

> 📘 JIT Provisioning is only available for Synthesia Enterprise Organizations with SSO enabled.

Just-in-Time (JIT) Provisioning is a way to automatically create user accounts the moment someone from your organization logs in via Single Sign-On (SSO). This means admins no longer need to manually create accounts or pre-approve access.

It works by checking if the user’s email domain matches your organization’s SSO configuration. If it does, the user is instantly added to your default workspace with a default license, which can be defined by the Organization's administrator.

This approach is useful for large teams and enterprise environments, where manually managing user access can be time-consuming and error-prone. JIT Provisioning ensures that everyone who needs access gets it—quickly, securely, and with minimal admin involvement.

## How JIT Provisioning works

When a new user with a matching domain logs in using SSO:

1. They’re **automatically added** to your default workspace.
2. They receive the **default license** for the workspace (full, free, or restricted).
3. No manual intervention or pre-approval is needed.

> 👍 The default workspace and license can be updated anytime by your Organization admin.

## How to set up JIT Provisioning

To enable domain-based entry:

1. Go to **Org Settings > Collaboration > Authentication**.
2. Enable the **“Auto capture new users from listed domains”** toggle.
3. Select a **default workspace** where new users will be added.
4. In the **Billing tab**, choose the **default license type**.

## FAQ

<Accordion title="What license do new users receive?" icon="fa-info-circle">
  They are assigned the default license set by your Org admin (full, free, or restricted).
</Accordion>

<Accordion title="Can I still control access to full licenses manually?" icon="fa-info-circle">
  Yes. Use a restricted license as default, then upgrade access based on user requests.
</Accordion>

<Accordion title="Do I need to update my SSO configuration?" icon="fa-info-circle">
  No changes to your existing SSO setup are required, provided it meets the configuration requirements.
</Accordion>