# JIT user provisioning > Depth-first rabbithole dossier for JIT user provisioning; source-anchored research pack. Parent: [Atlas Federated Authentication](https://llms-explorer.com/tree/atlas-federated-authentication/) · 2 facets · 6 facts · page: https://llms-explorer.com/tree/jit-user-provisioning/ ## How it works - [low] When an organization uses Role Mapping to manage Atlas user access through Identity Provider groups, a federated user's permissions in Atlas only update when that user logs in. Sources: https://www.mongodb.com/docs/atlas/app-connections.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/jit-user-provisioning-71d0208641/rabbithole-synthesis.md#core` ## Facts and statements - [low] MongoDB Atlas supports just-in-time (JIT) user provisioning, which is enabled by default. Sources: https://learn.microsoft.com/en-us/entra/identity/saas-apps/mongodb-cloud-tutorial — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/jit-user-provisioning-71d0208641/rabbithole-synthesis.md#core` - [low] Atlas SSO supports JIT provisioning, meaning a user provisioned from SSO can only be updated on login, including their group assignments. (verified as of 2026-10-14) Sources: https://feedback.mongodb.com/ideas/CUSTOMER-I-8881 — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/jit-user-provisioning-71d0208641/rabbithole-synthesis.md#core` - [low] The Okta MongoDB integration supports SAML-based Single Sign-On (SSO) and SCIM-based automated user provisioning, allowing IT teams to centralize account lifecycle management and automatically govern project, organization, and operational role entitlements. Sources: https://www.okta.com/integrations/mongodb-atlas/ — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/jit-user-provisioning-71d0208641/rabbithole-synthesis.md#core` - [low] If a user does not already exist in MongoDB Atlas, a new user account is created after successful authentication. Sources: https://learn.microsoft.com/en-us/entra/identity/saas-apps/mongodb-cloud-tutorial — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/jit-user-provisioning-71d0208641/rabbithole-synthesis.md#core` - [low] If a user's Identity Provider (IdP) group elevation expires, the change is not updated in Atlas until the user re-authenticates. Sources: https://feedback.mongodb.com/ideas/CUSTOMER-I-8881 — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/jit-user-provisioning-71d0208641/rabbithole-synthesis.md#troubleshooting` ## Related concepts - user — is a part of JIT user provisioning - provisioning — is a part of JIT user provisioning - JIT — is a part of JIT user provisioning