User provisioning methods: JIT, SCIM and handlers
Choose between pushed provisioning (SCIM, API loads) and provisioning at login (standard SAML JIT, a custom SAML JIT handler, an authentication provider's registration handler), and know the SCIM endpoints, the JIT prerequisites and why connected app user provisioning points the other way.
Given a scenario, recommend the appropriate method for provisioning users in Salesforce.
~6 min read · 9 practice questions ·
What the exam expects
- Recommend a provisioning method from when the user must exist: pushed ahead of time (SCIM, API or Data Loader load) or created at first login (standard SAML JIT, custom SAML JIT handler, registration handler, self-registration).
- Know what standard JIT needs (a SAML setting, Federation ID identity type, Email, LastName, ProfileId and Username) and when a custom Apex handler is required.
- Use the Salesforce SCIM endpoints to create, update, deactivate, reactivate and group users, and know what SCIM doesn't support.
- Rule out methods that don't create Salesforce users: delegated authentication and connected app user provisioning.
Key terms: JIT provisioning (user created or updated from a SAML assertion at login); custom SAML JIT handler (Apex class implementing Auth.SamlJitHandler); registration handler (Apex or flow that creates users for an authentication provider); SCIM (open standard REST API an external system calls to manage users); entitlements (SCIM's name for profiles and permission sets).
Key facts
- Detail
- Email, LastName, ProfileId, Username (insert only)
- Detail
- Federation ID from the User object
- Detail
- Standard JIT only
- Detail
- Must have Manage Users
- Detail
- Optional when self-registration with a default profile and role exists
- Detail
- OAuth 2.0 access token on every operation
- Detail
- Deactivates; same result as PATCH active=false
- Detail
- Not supported
- Detail
- Read only (GET)
Sources for this section (6)
- JIT Assertion Fields for Salesforcehelp.salesforce.com (opens in a new tab)
- Enable Just-in-Time Provisioninghelp.salesforce.com (opens in a new tab)
- JIT Assertion Fields for Experience Cloudhelp.salesforce.com (opens in a new tab)
- SCIM Reference Sheethelp.salesforce.com (opens in a new tab)
- Deactivate and Reactivate Usershelp.salesforce.com (opens in a new tab)
- Understand the SCIM Implementationhelp.salesforce.com (opens in a new tab)
- Why can't standard JIT meet a "deactivate on termination" requirement?
- When can a site JIT assertion omit User.ProfileId?
- How does a SCIM connector bring back a rehired employee's original user?
- Why must a custom SAML JIT handler create the contact and account itself?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Platform Identity and Access Management Architect pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 25 lessons of the Platform Identity and Access Management Architect guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Inline practice questions and one-click topic practice (9 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Unlimited timed practice exams