> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/administration/setup-sso-integration-on-prisma-cloud/get-started-with-saml-sso/setup-jit-on-google.md).

# Set up Just-in-Time Provisioning on Google

Configure SSO with Just-in-time Provisioning on Google.

To successfully set up local administrators on the fly with Just-in-Time (JIT) provisioning, you need to configure the Prisma Cloud app for Google to provide the SAML responses that enable Prisma Cloud to add the authenticated SSO user on Prisma Cloud. Then, to ensure that the SSO user has the correct access privileges on Prisma Cloud, you need to assign a Prisma Cloud role to the user; if this role is not a default role on Prisma Cloud, you must define the role before you assign the role to the user on Google.

1. Create the JIT attributes for Google.

   If you have not already created the SAML app for Prisma Cloud on Google, see setup-sso-integration-on-prisma-cloud-for-google.xml\[Set up Google SSO on Prisma Cloud].
2. Create a custom role in Google that will be used as a Prisma Cloud role. For the Prisma Cloud role to be available to each user, this role attribute should be available to each registered user in the Google workspace.
   1. Log in to Google as a Super Administrator and select **Directory > Users**.
   2. Select **More > Manage Custom Attributes**.

      <figure><img src="/files/0dwLEEwvK8HD9bx4cuQ3" alt="sso google jit 6"><figcaption></figcaption></figure>
   3. **Add Custom Attribute**.

      <figure><img src="/files/xdmwcMSmwGNzNbUsZQFP" alt="sso google jit 8"><figcaption></figcaption></figure>
   4. Enter the following details:
      * **Category**—Enter a name for the category, for example Prisma Specific.
      * **Custom fields - Name**—Enter the Role as the name, select Info type Text. and depending on your organization’s requirement, you can select single or multi-value. Prisma Cloud supports multiple roles for a single user.

        <figure><img src="/files/FSIt7Lp7NpW54mPvfzJ2" alt="sso google jit 7"><figcaption></figcaption></figure>
   5. **Add** to complete adding the role as a custom attribute.
3. Map the JIT attributes.
   1. Log in to Google as a Super Administrator and select **Apps > Web and mobile apps**.
   2. Click on the application for which you want to enable JIT provisioning.

      <figure><img src="/files/kCFM0WDQB2yhMfqIfsGt" alt="sso google jit 9"><figcaption></figcaption></figure>
   3. Expand **SAML attribute mapping** and click **Add Mapping**.
   4. Enter email, first name, last name, and role attributes and **Save**.

      <figure><img src="/files/b9X1h4IJiBGvW8SzNq7T" alt="sso google jit 10"><figcaption></figcaption></figure>
   5. Copy the attribute names that you mapped in the above Step.
4. Enable JIT.
   1. Log in to Prisma Cloud and select **Settings > SSO**.
   2. Under Just in Time (JIT) Provisioning, **Enable JIT Provisioning**.
   3. Enter the value of the attributes. These are the attribute names from Step 3 above.
   4. **Save** to enable JIT for the user.

      <figure><img src="/files/ZLWzuspem4UQbVOXfxKW" alt="sso onelogin jit 10"><figcaption></figcaption></figure>
5. Validate JIT.
   1. Log in to Google Mail as a user who belongs to Google Workspace and is not yet provisioned in Prisma Cloud. Make sure all the attributes, including Prisma specific role has been configured for this user.
   2. Click **Prisma \<name>** (the SAML custom application that you had configured) to log directly in to the Prisma Cloud instance.
   3. Log in to Prisma Cloud as an Administrator and select **Settings > Users** to validate that the above user is provisioned.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.prismacloud.io/content-collections/administration/setup-sso-integration-on-prisma-cloud/get-started-with-saml-sso/setup-jit-on-google.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.