> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/administration/setup-sso-integration-on-prisma-cloud/get-started-with-saml-sso/setup-jit-on-onelogin.md).

# Set up Just-in-Time Provisioning on OneLogin

Configure SSO with Just-in-time Provisioning on OneLogin.

To successfully set up local administrators on the fly with Just-in-Time (JIT) provisioning, you need to configure the Prisma Cloud app for OneLogin to provide the SAML responses that enable Prisma Cloud to add the authenticated SSO user on Prisma Cloud. Then, to ensure that the SSO user has the correct access privileges on Prisma Cloud, you need to assign a Prisma Cloud role to the user; if this role is not a default role on Prisma Cloud, you must define the role before you assign the role to the user on OneLogin.

1. Create the Prisma Cloud App for OneLogin.

   If you have not already created the SAML app for Prisma Cloud on OneLogin, see [Setup OneLogin SSO on Prisma Cloud](/content-collections/administration/setup-sso-integration-on-prisma-cloud/get-started-with-saml-sso/setup-sso-integration-on-prisma-cloud-for-onelogin.md#idc011bcde-1fa7-4759-bf86-d857aac95346).
2. For JIT, create a custom role in OneLogin.
   1. Log in to OneLogin as an Administrator and select **Administration**.
   2. Navigate to **Users > Roles**.
   3. **New Role**.
   4. Enter a **Name** for the Role. The role name should match the roles available on Prisma Cloud, for example System Admin.
   5. Click the checkmark to register the role name and select the application to which this role will be made available.

      <figure><img src="/files/nnBc6aye0NAr6W2mgyXL" alt="sso onelogin jit 1"><figcaption></figcaption></figure>
   6. **Save**

      <figure><img src="/files/eJVuEPCu7jQTEQre2Pgo" alt="sso onelogin jit 2"><figcaption></figcaption></figure>
3. Add users to a role.
   1. In OneLogin, select **Administration**.
   2. Navigate to **Users > Roles** and select the role to which you want to add the users.
   3. Click **Users** and use automatic (filter-based) or manual-based option to add new users to the role.

      <figure><img src="/files/82xsQQZ1g3qZ5qzNOGEM" alt="sso onelogin jit 5"><figcaption></figcaption></figure>
4. Configure the JIT attributes on the Prisma Cloud OneLogin app.
   1. In OneLogin, select **Administration**.
   2. Click **Applications** and select the app you created as the application to modify, for example Prisma Trial.
   3. Select **Parameters** and click **+** to add a new parameter.

      <figure><img src="/files/IwNhk1SaUhp45sNOVE50" alt="sso onelogin jit 7"><figcaption></figcaption></figure>
   4. Enter a **Field name** and select the appropriate flags. For example, in case of Roles, also select Multi-value parameter.

      <figure><img src="/files/l0YxhPTtufR6mWVI4FNj" alt="sso onelogin jit 8"><figcaption></figcaption></figure>
   5. **Save**.
   6. Based on the field name you entered, select the correct attribute from the drop-down.
   7. Make sure to configure all the attributes required by Prisma Cloud, such as email, role, first name, and last name for each user.

      <figure><img src="/files/6sfGoOyavLl7dKVQV3Ht" alt="sso onelogin jit 9"><figcaption></figcaption></figure>
5. Enable JIT.
   1. Log in to Prisma Cloud and select **Settings > SSO**.
   2. Under Just in Time (JIT) Provisioning, **Enable JIT Provisioning**.
   3. Enter the value of the attributes. These are the attribute names from Step 4 above.
   4. **Save** to enable JIT for the user.

      <figure><img src="/files/ZLWzuspem4UQbVOXfxKW" alt="sso onelogin jit 10"><figcaption></figcaption></figure>
6. Validate JIT.
   1. Log in to OneLogin portal as a user who is not yet provisioned in Prisma Cloud. Make sure all the attributes, including Prisma specific role has been configured for this user.
   2. Click **Prisma App** from the dashboard to log directly in to the Prisma Cloud instance.
   3. Log in to Prisma Cloud as an Administrator and select **Settings > Users** to validate that the above user is provisioned.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.prismacloud.io/content-collections/administration/setup-sso-integration-on-prisma-cloud/get-started-with-saml-sso/setup-jit-on-onelogin.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.