Add and update users with LDAP Just-In-Time provisioning

Just-In-Time (JIT) provisioning enables automatic user account creation in Okta the first time a user authenticates with Lightweight Directory Access Protocol (LDAP) delegated authentication.

JIT account creation and activation only works for users who are not already Okta users. This means that users who are confirmed on the import results page, regardless of whether or not they were subsequently activated, are not eligible for JIT activation. When JIT is enabled, users do not receive activation emails.

For JIT provisioning, delegated authentication must be enabled. If delegated authentication is not enabled, Okta user accounts can only be created using bulk import.

When JIT is enabled for your org and delegated authentication is selected for your LDAP integration, JIT is used to create user profiles and import user data.

For a list of known issues, see LDAP integration known issues.

1. In the Admin Console, go to Directory > Directory Integrations.
2. Click LDAP and then click the Provisioning tab.
3. Click To Okta in the Settings list.
4. Click Edit in the General area.
5. Select the Create and update users on login check box next to JIT provisioning.
6. Scroll down and click Save.