# Standard JIT attributes and registration handler provisioning

*Platform Identity and Access Management Architect Study Guide · Accepting Third-Party Identity in Salesforce · Last updated October 16, 2026 · https://www.certifyforce.com/study-guide/identity-and-access-management-architect/accepting-third-party-identity-in-salesforce/standard-jit-attributes-and-registration-handler-provisioning*

How users get created and kept current at login: the attributes standard SAML JIT requires for internal and Experience Cloud users and the order it matches users, contacts and accounts, moving existing users to Federation ID JIT, how registration handlers create, update and confirm users for authentication providers, and the per-user permission that turns on delegated authentication.

- Certification: Salesforce Platform Identity and Access Management Architect
- Exam section: Accepting Third-Party Identity in Salesforce
- Study guide: https://www.certifyforce.com/study-guide/identity-and-access-management-architect

**Official exam objective:**

> Given a scenario, identify the ways that users can be provisioned in Salesforce to enable SSO and apply access rights.

## What the exam expects

- Build a standard JIT assertion: the required `User.` attributes, a profile name or ID in `User.ProfileId`, optional fields such as the role.
- Add the `Contact.` and `Account.` attributes Experience Cloud JIT needs, and predict whether it matches or creates the user, contact and account.
- Turn on JIT for an org that already has users without creating duplicates.
- Choose where registration handler logic goes: createUser, updateUser or confirmUser, and know when a custom SAML JIT handler is needed instead.
- Grant Is Single Sign-On Enabled so delegated authentication applies to a user.

Key terms: **standard JIT** (Salesforce creates and updates users from SAML assertion attributes); **Custom SAML JIT with Apex handler** (a class implementing `Auth.SamlJitHandler` provisions instead); **registration handler** (the Apex class or flow an authentication provider runs to create or update the user); **third-party account link** (the stored link between a Salesforce user and a provider identity).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Required JIT fields | Email, LastName, ProfileId, Username (insert only) | [JIT Fields for Salesforce](https://help.salesforce.com/s/articleView?id=xcloud.sso_jit_requirements.htm&language=en_US&type=5) |
| ProfileId value | Profile name or ID; IDs differ between orgs | [JIT Fields for Salesforce](https://help.salesforce.com/s/articleView?id=xcloud.sso_jit_requirements.htm&language=en_US&type=5) |
| JIT identity type | Assertion contains the Federation ID from the User object | [Enable JIT](https://help.salesforce.com/s/articleView?id=xcloud.sso_jit_enable_jit.htm&language=en_US&type=5) |
| Professional Edition | Standard JIT only | [Enable JIT](https://help.salesforce.com/s/articleView?id=xcloud.sso_jit_enable_jit.htm&language=en_US&type=5) |
| Site contact attributes | Contact.Email + Contact.LastName when User.Contact is absent | [JIT Fields for Experience Cloud](https://help.salesforce.com/s/articleView?id=xcloud.sso_jit_community_requirements.htm&language=en_US&type=5) |
| Site account attributes | Account.AccountNumber + Account.Name when Contact.Account is absent | [JIT Fields for Experience Cloud](https://help.salesforce.com/s/articleView?id=xcloud.sso_jit_community_requirements.htm&language=en_US&type=5) |
| updateUser | Runs when a user who logged in before with the provider logs in again | [RegistrationHandler Interface](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_auth_plugin.htm) |
| confirmUser | Runs before updateUser for linked users; null return fails login | [ConfirmUserRegistrationHandler](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_interface_Auth_ConfirmUserRegistrationHandler.htm) |
| Delegated authentication | Applies only to users with Is Single Sign-On Enabled | [Configure Delegated Authentication](https://help.salesforce.com/s/articleView?id=xcloud.sso_delauthentication_configuring.htm&language=en_US&type=5) |

## Check yourself

- Why does a returning user's access not change when permission set logic lives only in createUser?
- When does an authentication provider need Auth.ConfirmUserRegistrationHandler?
- Which URL connects an existing Salesforce user to their provider identity once?
- When does Experience Cloud JIT create a new account?

## Sources

- [Just-in-Time SAML Assertion Fields for Salesforce](https://help.salesforce.com/s/articleView?id=xcloud.sso_jit_requirements.htm&language=en_US&type=5)
- [Just-in-Time SAML Assertion Fields for Experience Cloud](https://help.salesforce.com/s/articleView?id=xcloud.sso_jit_community_requirements.htm&language=en_US&type=5)
- [Enable Just-in-Time Provisioning](https://help.salesforce.com/s/articleView?id=xcloud.sso_jit_enable_jit.htm&language=en_US&type=5)
- [Understanding Just-in-Time (JIT) Provisioning for SAML Single Sign-On (SSO)](https://help.salesforce.com/s/articleView?id=000385744&language=en_US&type=1)
- [Example SAML Assertions](https://help.salesforce.com/s/articleView?id=xcloud.sso_saml_assertion_examples.htm&language=en_US&type=5)
- [Create an Authentication Provider Registration Handler](https://help.salesforce.com/s/articleView?id=xcloud.sso_create_registration_handler.htm&language=en_US&type=5)
- [RegistrationHandler Interface](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_auth_plugin.htm)
- [ConfirmUserRegistrationHandler Interface](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_interface_Auth_ConfirmUserRegistrationHandler.htm)
- [Configure an Authentication Provider Using OpenID Connect](https://help.salesforce.com/s/articleView?id=xcloud.sso_provider_openid_connect.htm&language=en_US&type=5)
- [Add Functionality to an Authentication Provider](https://help.salesforce.com/s/articleView?id=xcloud.sso_provider_addl_params.htm&language=en_US&type=5)
- [Configure Salesforce for Delegated Authentication](https://help.salesforce.com/s/articleView?id=xcloud.sso_delauthentication_configuring.htm&language=en_US&type=5)
- [Delegated Authentication](https://help.salesforce.com/s/articleView?id=xcloud.sso_delauthentication.htm&language=en_US&type=5)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 10 linked practice questions, and unlimited timed mock exams are included with the Platform Identity and Access Management Architect pack (USD $19): https://www.certifyforce.com/practice-exams