# SAML SSO, JIT and SCIM provisioning by plan

*Slack Administrator Study Guide · User Lifecycle Management · Last updated October 21, 2026 · https://www.certifyforce.com/study-guide/slack-administrator/user-lifecycle-management/saml-sso-jit-and-scim-provisioning-by-plan*

Which plan supports SAML SSO and SCIM and who configures them, how Slack matches a SAML sign-in to an existing account, when just-in-time provisioning is enough and when SCIM pre-provisioning is needed, and how SCIM handles email sync and billing.

- Certification: Salesforce Slack Administrator
- Exam section: User Lifecycle Management
- Study guide: https://www.certifyforce.com/study-guide/slack-administrator

**Official exam objective:**

> Assess a scenario to determine the appropriate authentication and user provisioning options based on the Slack plan.

## What the exam expects

- Decide whether a plan supports SAML SSO and SCIM, and whether a Workspace Owner or an Org Owner configures SSO.
- Explain how Slack matches a SAML sign-in to an existing account, and what must stay the same when the identity provider changes.
- Choose between just-in-time (JIT) provisioning and SCIM provisioning from when accounts must exist and which profile data must flow from the IdP.
- Keep email addresses synced from the IdP, and explain when SCIM-created accounts become billable.

Key terms:
- **SAML SSO**: sign-in through an identity provider (IdP) that passes authentication to Slack using SAML 2.0.
- **NameID**: the IdP-specific, unchanging identifier sent in the SAML response alongside the email address.
- **JIT provisioning**: Slack creates an account automatically the first time a user signs in through SSO.
- **SCIM provisioning**: the IdP creates, updates and deactivates Slack accounts ahead of sign-in through a connector app and the SCIM API.

## Key facts

| Fact | Detail | Source |
|---|---|---|
| SAML SSO and SCIM plans | Business+ and Enterprise; Free and Pro only with a connected Salesforce org | [SAML SSO](https://slack.com/help/articles/203772216-SAML-single-sign-on), [Plan updates](https://slack.com/help/articles/39264531104275-Updates-to-feature-availability-and-pricing-for-Slack-plans) |
| Who enables SSO | Workspace Owner (Free, Pro, Business+); Org Owner (Enterprise) | [SAML SSO](https://slack.com/help/articles/203772216-SAML-single-sign-on) |
| Configure SSO in an Enterprise org | Org Owner permission | [Permissions by role](https://slack.com/help/articles/201314026-Permissions-by-role-in-Slack) |
| Additional SSO configurations | Up to 11 | [SAML SSO](https://slack.com/help/articles/203772216-SAML-single-sign-on) |
| Account matching | NameID or email; no match creates a new account | [Maximize Access & Security](https://trailhead.salesforce.com/content/learn/modules/identity-management-in-slack/explore-access-and-security-controls) |
| Service Provider Issuer URL | Defaults to https://slack.com; must match the IdP | [SAML SSO](https://slack.com/help/articles/203772216-SAML-single-sign-on) |
| JIT | Default once SSO is configured; account at first sign-in | [Maximize Access & Security](https://trailhead.salesforce.com/content/learn/modules/identity-management-in-slack/explore-access-and-security-controls) |
| SCIM guests | Multi-Channel Guests on Enterprise plans only; otherwise create a member, then change the role | [SCIM provisioning](https://slack.com/help/articles/212572638-Manage-members-with-SCIM-provisioning) |
| SCIM email sync | Only when members are restricted from changing email | [Maximize Access & Security](https://trailhead.salesforce.com/content/learn/modules/identity-management-in-slack/explore-access-and-security-controls) |
| SCIM billing | Billable at first sign-in, prorated | [SCIM provisioning](https://slack.com/help/articles/212572638-Manage-members-with-SCIM-provisioning) |

## Check yourself

- Why must email addresses stay the same when an Enterprise org changes identity providers?
- When does JIT provisioning create a Slack account?
- Which role configures SAML SSO for an Enterprise org?
- Why would finance not pay for SCIM accounts that are never used?

## Sources

- [Set up SAML single sign-on for Slack](https://slack.com/help/articles/203772216-SAML-single-sign-on)
- [Manage members with SCIM provisioning](https://slack.com/help/articles/212572638-Manage-members-with-SCIM-provisioning)
- [Maximize Access & Security in Slack](https://trailhead.salesforce.com/content/learn/modules/identity-management-in-slack/explore-access-and-security-controls)
- [Implement the Right Authentication Process](https://trailhead.salesforce.com/content/learn/modules/identity-management-in-slack/implement-the-right-authentication-process)
- [Slack plans and features](https://slack.com/help/articles/115003205446-Slack-plans-and-features)
- [Updates to feature availability and pricing for Slack plans](https://slack.com/help/articles/39264531104275-Updates-to-feature-availability-and-pricing-for-Slack-plans)
- [Permissions by role in Slack](https://slack.com/help/articles/201314026-Permissions-by-role-in-Slack)
- [Get Started with Slack and Identity Management](https://trailhead.salesforce.com/content/learn/modules/identity-management-in-slack/get-started-with-slack-and-identity-management)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 5 linked practice questions, and unlimited timed mock exams are included with the Slack Administrator pack (USD $19): https://www.certifyforce.com/practice-exams