> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/administration/setup-sso-integration-on-prisma-cloud/get-started-with-oidc-sso/get-started-with-oidc-jit.md).

# Get Started with OIDC JIT

Prisma Cloud offers System Administrators the ability to auto-provision users using the Open ID Connect (OIDC) Single Sign-On (SSO) configuration. This option allows you to manage user identities outside of Prisma Cloud in your organization’s Identity Provider (IdP). Configure OIDC Just in Time (JIT) provisioning to create new Prisma Cloud users on an as needed basis, when users with the appropriate entitlements log in using OIDC SSO.

Complete the steps below on the Prisma Cloud console and your IdP to set up OIDC JIT provisioning:

1. Log in to Prisma Cloud using an account with System Administrator privileges to configure SSO.
2. On your Prisma Cloud tenant select **Settings > Access Control > SSO** and click **OIDC**.
3. Navigate to **Just in Time (JIT) Provisioning** and select **Enable**.

   <figure><img src="/files/26ip2PvaJlaTAzKaTsVn" alt="50"><figcaption></figcaption></figure>
4. Enter information for the users you would like to provision in the following fields:
   1. **Scopes** - "email", "profile", and "openid" or are always enabled. Specify additional scopes if required to expose the **Role Claim Name** defined below.
   2. **Role Claim Name** - Specify a claim under which Prisma Cloud Role names will be exposed for the purposes of authorization. If no Role Claim Name is entered, a “groups” claim will be used by default. Follow the instructions below for IdP specific configuration:
      1. **Microsoft Azure**
         1. On the Azure portal, navigate to **Manage > Token Configuration > Add groups claim > Edit groups claim > Customize token properties by type** and set all token types to use "sAMAccountName".

            <figure><img src="/files/D0AgMBIY3wuJDlMmTtAU" alt="40"><figcaption></figcaption></figure>
         2. Navigate to **API permissions > Add a permission** and capture all permissions available for Microsoft Graph.

            <figure><img src="/files/6wcGvRSuSk9xhHoHehGF" alt="40"><figcaption></figcaption></figure>
      2. **Okta**
         1. On the Okta Admin Console, navigate to **Home > Applications**. Select the **Sign On > OpenID Connect ID Token** and click edit. Select **Add groups claim filter**.

            <figure><img src="/files/392nQ79YfwbotVdJUsYj" alt="40"><figcaption></figcaption></figure>
         2. On the Okta Admin Console, navigate to **Security > API > Authorization Servers > Default** and ensure that groups scope is enabled.

            <figure><img src="/files/eLI36VSqXWjlV8EWqdyR" alt="40"><figcaption></figcaption></figure>
         3. Add “groups” to the Scopes defined in Step 4 above.
5. **Default Role** - Authenticated users that do not present a valid Prisma Cloud Role name under the **Role Name Claim** are granted access to this role if specified.

If specified, all authenticated users will have access to the Default Role. If default access for all authenticated users is required, a read-only Prisma Cloud Role is recommended. While not prohibited, use of a System Administrator Role is strongly discouraged.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.prismacloud.io/content-collections/administration/setup-sso-integration-on-prisma-cloud/get-started-with-oidc-sso/get-started-with-oidc-jit.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.