# User provisioning methods: JIT, SCIM and handlers

*Platform Identity and Access Management Architect Study Guide · Identity Management Concepts · Last updated October 16, 2026 · https://www.certifyforce.com/study-guide/identity-and-access-management-architect/identity-management-concepts/user-provisioning-methods-jit-scim-and-handlers*

Choose between pushed provisioning (SCIM, API loads) and provisioning at login (standard SAML JIT, a custom SAML JIT handler, an authentication provider's registration handler), and know the SCIM endpoints, the JIT prerequisites and why connected app user provisioning points the other way.

- Certification: Salesforce Platform Identity and Access Management Architect
- Exam section: Identity Management Concepts
- Study guide: https://www.certifyforce.com/study-guide/identity-and-access-management-architect

**Official exam objective:**

> Given a scenario, recommend the appropriate method for provisioning users in Salesforce.

## What the exam expects

- Recommend a provisioning method from when the user must exist: pushed ahead of time (SCIM, API or Data Loader load) or created at first login (standard SAML JIT, custom SAML JIT handler, registration handler, self-registration).
- Know what standard JIT needs (a SAML setting, Federation ID identity type, Email, LastName, ProfileId and Username) and when a custom Apex handler is required.
- Use the Salesforce SCIM endpoints to create, update, deactivate, reactivate and group users, and know what SCIM doesn't support.
- Rule out methods that don't create Salesforce users: delegated authentication and connected app user provisioning.

Key terms: **JIT provisioning** (user created or updated from a SAML assertion at login); **custom SAML JIT handler** (Apex class implementing Auth.SamlJitHandler); **registration handler** (Apex or flow that creates users for an authentication provider); **SCIM** (open standard REST API an external system calls to manage users); **entitlements** (SCIM's name for profiles and permission sets).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Standard JIT required fields | Email, LastName, ProfileId, Username (insert only) | [JIT Assertion Fields for Salesforce](https://help.salesforce.com/s/articleView?id=sf.sso_jit_requirements.htm&language=en_US&type=5) |
| JIT identity type | Federation ID from the User object | [Enable Just-in-Time Provisioning](https://help.salesforce.com/s/articleView?id=sf.sso_jit_enable_jit.htm&language=en_US&type=5) |
| Professional Edition | Standard JIT only | [Enable Just-in-Time Provisioning](https://help.salesforce.com/s/articleView?id=sf.sso_jit_enable_jit.htm&language=en_US&type=5) |
| Execute Handler As | Must have Manage Users | [Enable Just-in-Time Provisioning](https://help.salesforce.com/s/articleView?id=sf.sso_jit_enable_jit.htm&language=en_US&type=5) |
| Site JIT ProfileId | Optional when self-registration with a default profile and role exists | [JIT Assertion Fields for Experience Cloud](https://help.salesforce.com/s/articleView?id=xcloud.sso_jit_community_requirements.htm&language=en_US&type=5) |
| SCIM authorization | OAuth 2.0 access token on every operation | [SCIM Reference Sheet](https://help.salesforce.com/s/articleView?id=xcloud.identity_scim_rest_api.htm&language=en_US&type=5) |
| SCIM DELETE | Deactivates; same result as PATCH active=false | [Deactivate and Reactivate Users](https://help.salesforce.com/s/articleView?id=xcloud.identity_scim_deactivate_reactivate_user.htm&language=en_US&type=5) |
| SCIM bulk | Not supported | [Understand the SCIM Implementation](https://help.salesforce.com/s/articleView?id=xcloud.identity_scim_implementation.htm&language=en_US&type=5) |
| SCIM Roles endpoint | Read only (GET) | [SCIM Reference Sheet](https://help.salesforce.com/s/articleView?id=xcloud.identity_scim_rest_api.htm&language=en_US&type=5) |

## Check yourself

- Why can't standard JIT meet a "deactivate on termination" requirement?
- When can a site JIT assertion omit User.ProfileId?
- How does a SCIM connector bring back a rehired employee's original user?
- Why must a custom SAML JIT handler create the contact and account itself?

## Sources

- [Just-in-Time Provisioning for SAML](https://help.salesforce.com/s/articleView?id=xcloud.sso_jit_about.htm&language=en_US&type=5)
- [Enable Just-in-Time Provisioning](https://help.salesforce.com/s/articleView?id=sf.sso_jit_enable_jit.htm&language=en_US&type=5)
- [Just-in-Time SAML Assertion Fields for Salesforce](https://help.salesforce.com/s/articleView?id=sf.sso_jit_requirements.htm&language=en_US&type=5)
- [Just-in-Time SAML Assertion Fields for Experience Cloud](https://help.salesforce.com/s/articleView?id=xcloud.sso_jit_community_requirements.htm&language=en_US&type=5)
- [SamlJitHandler Interface](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_interface_Auth_SamlJitHandler.htm)
- [Manage Salesforce User Identities with SCIM](https://help.salesforce.com/s/articleView?id=xcloud.identity_scim_overview.htm&language=en_US&type=5)
- [SCIM and REST API Reference Sheet](https://help.salesforce.com/s/articleView?id=xcloud.identity_scim_rest_api.htm&language=en_US&type=5)
- [Understand the SCIM Implementation](https://help.salesforce.com/s/articleView?id=xcloud.identity_scim_implementation.htm&language=en_US&type=5)
- [Examples: Deactivate and Reactivate Users with SCIM](https://help.salesforce.com/s/articleView?id=xcloud.identity_scim_deactivate_reactivate_user.htm&language=en_US&type=5)
- [Examples: Manage Group Members with SCIM](https://help.salesforce.com/s/articleView?id=xcloud.identity_scim_manage_groups.htm&language=en_US&type=5)
- [User Provisioning for Connected Apps](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_user_provisioning.htm&language=en_US&type=5)
- [Configure an Authentication Provider Using OpenID Connect](https://help.salesforce.com/s/articleView?id=xcloud.sso_provider_openid_connect.htm&language=en_US&type=5)
- [Delegated Authentication](https://help.salesforce.com/s/articleView?id=sf.sso_delauthentication.htm&language=en_US&type=5)
- [Identity Connect Retirement](https://help.salesforce.com/s/articleView?id=000390663&language=en_US&type=1)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 9 linked practice questions, and unlimited timed mock exams are included with the Platform Identity and Access Management Architect pack (USD $19): https://www.certifyforce.com/practice-exams