SSO sign-in policy and JIT provisioning
Enterprise workspaces can connect SAML 2.0 or OIDC single sign-on so members use their existing identity provider. Alongside the IdP connection, workspace owners set a sign-in policy on SSO & Provisioning. This page explains JIT enrollment, default roles, and domain enforcement in product language.
For connector setup (ACS URLs, entity IDs, and common IdP mistakes), start with Enterprise SSO (SAML & OIDC). This article focuses on who can join after SSO succeeds.
Prerequisites
- An Enterprise workspace with SSO configured
- Owner access to SSO & Provisioning
- At least one verified domain if you use domain-gated JIT or domain-match enforcement
- Open SSO & Provisioning and confirm your IdP connection is healthy.
- Choose a JIT provisioning mode (Off, Verified domain only, or Any SSO user).
- Set the default tenant role for newly provisioned members (Admin or Member). Optionally attach a default custom role when your workspace uses custom roles.
- Decide whether Require email domain match should apply to every SSO sign-in.
- Save, then test with a user who should enroll and one who should be denied.
JIT provisioning modes
Just-in-time (JIT) provisioning controls whether someone who signs in with SSO can automatically receive workspace membership when they are not already in the directory.
| Mode | Behavior |
|---|---|
| Off | New users cannot enroll via SSO alone. An owner must invite them, or they must arrive through SCIM. Existing members can still use SSO. |
| Verified domain only (default) | New users may enroll via SSO only if their email domain matches a verified domain. |
| Any SSO user | Anyone who completes SSO against your provider can be bound to the workspace (subject to IdP assignment rules). Use with care. |
After sign-in, InviziPoll runs a finalize step so admin and member records align with your policy and any group claims from the identity provider (including SCIM group-to-role mappings when configured).
Default roles
Owners choose a default tenant role for newly JIT-provisioned users (Admin or Member). A default custom role can also be set when the workspace uses custom roles. SCIM group mappings can override these defaults when matching groups are present.
The default role is never Owner. Ownership transfer remains an explicit owner action.
Enforce email domain match
Require email domain match applies to SSO sign-in for the workspace: the user’s email must match a verified domain even when JIT is set to Any SSO user, and it can also constrain users who already exist. Use this when you want strict alignment with verified domains regardless of JIT mode.
This control is independent of Verified domain only JIT, which only gates new automatic enrollment.
Audit and troubleshooting
Policy changes and successful JIT provisioning emit metadata-only audit events (no respondent answers, no secrets). If someone cannot enroll, check:
- JIT mode vs their email domain
- Whether domain-match enforcement is on
- IdP group assignment / SCIM role mappings
- Workspace audit log for SSO-related entries
FAQ
Does SSO weaken response anonymity?
No. SSO authenticates admins. Respondent answers are still encrypted in the browser; the server stores ciphertext only.
Should I use JIT or SCIM?
Use SCIM when you need continuous directory sync and group-driven roles. Use JIT when IdP sign-in alone should enroll eligible users. Many teams use both: SCIM for ongoing sync, JIT as a safety valve for verified-domain users.
What if JIT is Off?
Existing members can still sign in with SSO. New people need an invite or SCIM provisioning first.