Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 18 Packages Projects Releases Wiki Activity

JIT guide: Simplify language (#39306)

Browse Source 
Users sometimes missing the step "Create user and sync permissions on
login": https://github.com/fleetdm/fleet/issues/38438
This commit is contained in:
Noah Talerman
2026-02-04 11:32:12 -06:00
committed by GitHub
parent af9190cffa
commit 996f5d450f
1 changed files with 3 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/Deploy/single-sign-on-sso.md
+3 -6
View File
@@ -175,14 +175,11 @@ If you're configuring end user authentication head to **Settings > Integrations
`Applies only to Fleet Premium`
Fleet automates user creation using just-in-time (JIT) provisioning. Fleet uses System for Cross-domain Identity Management (SCIM) to [map end users' identity provider (IdP) information to host vitals](https://fleetdm.com/guides/foreign-vitals-map-idp-users-to-hosts). SCIM for user provisioning is [coming soon](https://github.com/fleetdm/fleet/issues/15671).
Fleet can automatically create users using just-in-time (JIT) provisioning. To enable this, go to **Settings > Integrations > Single sign-on (SSO) > Fleet users** and check **Create user and sync permissions on login**.
When JIT user provisioning is turned on, Fleet will automatically create an account when a user logs in for the first time with the configured SSO. This removes the need to create individual user accounts for a large organization. The new account's email and full name are copied from the user data in the SSO response.
When enabled, Fleet will automatically create an account when a user logs in for the first time with the configured SSO. The new account's email and full name are copied from the user data in the SSO response.
By default, accounts created via JIT provisioning are assigned the [Global Observer role](https://fleetdm.com/docs/using-fleet/permissions).
To assign different roles for accounts created via JIT provisioning, see [Customization of user roles](#customization-of-user-roles) below.
To enable this option, go to **Settings > Integrations > Single sign-on (SSO) > Fleet users** and check "_Create user and sync permissions on login_" or [adjust your config](https://fleetdm.com/docs/configuration/yaml-files#sso-settings).
By default, accounts created via JIT provisioning are assigned the [Global Observer role](https://fleetdm.com/docs/using-fleet/permissions). To assign different roles for accounts created via JIT provisioning, see [customization of user roles](#customization-of-user-roles) below.
For this to work correctly make sure that: