SAML Just-in-Time Provisioning

Just-in-Time (JIT) provisioning allows Netskope to automatically provision users and their associated groups when they authenticate through a configured SAML Identity Provider (IdP). With JIT provisioning enabled, users do not need to be synchronized into Netskope through Directory Importer or SCIM before accessing the service.

When a user successfully authenticates through SAML, Netskope automatically:

• Enrolls the JIT user and displays the user in User Management.

• Assigns user groups based on SAML assertion attributes. The associated SAML groups appear under Direct Group Membership.

• Evaluates policies and configurations using those attributes.

• Lists the device enrolled with the JIT user under Security Cloud Platform > Devices.

JIT provisioning is particularly useful for deployments where directory synchronization has not yet been configured, such as Proof-of-Value deployments or environments that rely primarily on IdP-based authentication.

Supported Access Methods

JIT provisioning supports users accessing Netskope through the following methods:

• Netskope Client enrollment

• IPSec tunnels

• GRE tunnels

• Cloud explicit proxy deployments

Enable Just-in-Time Provisioning

To enable JIT provisioning:

1. Navigate to Settings > Security Cloud Platform > SAML (in Forward Proxy).

2. In the New Account workflow, locate the JIT option.

   This option is available if this feature is enabled for your tenant.

3. Enable the Automatically provision users when users login (Just-in-Time provisioning) option.

When this option is enabled, Netskope dynamically creates users after successful SAML authentication.

Disabling User JIT (Just-in-Time) Auto-population

When you disable User JIT (Just-in-Time) Auto-population in the Forward SAML IdP configuration, the following warning is displayed:

"Disabling User JIT (Just-in-Time) Auto-population will only allow users provisioned via AD/SCIM to be enrolled."

What this means

• AD/SCIM users are not affected. Users provisioned through AD/SCIM can continue to enroll through the IdP as usual. Disabling JIT does not disable IdP enrollment. It only removes the JIT enrollment path.

• Users provisioned through JIT cannot enroll on new devices. Users who were provisioned exclusively through JIT (that is, they do not exist in the AD/SCIM collection) cannot complete new device enrollments while JIT is disabled.

• Existing enrollments are not affected. Devices that were already enrolled, including those enrolled through JIT, continue to function normally. The change affects only new enrollments.

• Re-enabling JIT restores enrollment. If JIT is re-enabled, JIT users can enroll on new devices again.

Configure SAML Assertion Attributes

After enabling JIT provisioning, administrators must define the attributes used to identify users and assign group membership.

The Group Membership Attribute specifies the SAML attribute that contains group information returned by the IdP. For many IdP configurations, the memberOf attribute is commonly used.

User Group Assignment from SAML Assertions

Netskope can create or map user groups dynamically based on the values returned in the SAML assertion. Administrators can enable one or more of the following group-handling methods.

Group Auto-Populate

When this option is enabled, Netskope automatically creates user groups using the raw assertion attribute value. Example:

This option is useful when the assertion values from the Identity Provider already match the desired user group names.

Automatic Mapping

Automatic mapping allows Netskope to match assertion values to existing user group names. Mapping occurs only when the assertion value exactly matches an existing group name.

Example:

If no matching group exists, no mapping occurs.

Manual Mapping

Manual mapping allows administrators to define custom group mappings that are easier to use in policy definitions. Manual mapping allows multiple assertion values to map to a single policy group, and a single assertion value to map to multiple groups, which can simplify policy management.

Each mapping entry contains the following fields:

User Collections

Users created through JIT provisioning belong to a separate User Collection. User Collections allow Netskope to distinguish between users created dynamically through SAML authentication and users provisioned through directory synchronization.

This separation ensures that group memberships originating from different identity systems remain isolated. The User Collection value appears on the User Management page.

Multiple Identity Providers

JIT provisioning is enabled at the Identity Provider account level. If multiple IdP accounts have JIT provisioning enabled, users authenticated through those IdPs are written to the same JIT user collection.

JIT Users in User Management

Users created through JIT provisioning appear in the User Management page. These users have the following characteristics:

• JIT users are read-only
• Administrators cannot manually edit JIT-provisioned users

Policy and Configuration Impact

Users and groups created through JIT provisioning can be referenced only in the following policies and configuration rules using SAML-derived user groups.

These groups are available in:

• SSL Decryption

• Real-Time Protection policies

• Steering configuration rules

• Client configuration rules

For more information, see:

• Steering Configuration

• Client Configuration

• Real-Time Protection Policies