---
canonical: https://amplience.com/developers/docs/release-notes/2025/just-in-time-provisioning/
title: Just in time provisioning
description: Just in time provisioning when creating Dynamic Content user accounts, allows you to set initial permissions for users so they can access Dynamic Content without having to wait having to wait for access.
audience: Business User
image: https://cdn.media.amplience.net/i/ampproduct/account-app3-create-user-2?w=1200&h=630
image_width: 1200
image_height: 630
date_published: 2025-05-15
date_modified: 2025-07-10
---

# Just in time provisioning

**Release date: 16th July 2025**

This release introduces the ability for you to set permissions as you create Dynamic Content user accounts, providing users with immediate access once their accounts are created.

To remove the time pressure of having to manually set permissions for each new user as soon as their account is created, you can assign initial roles ahead of time as you set up user accounts. This is provided by "just in time provisioning".

Depending on your organization, you might want to provide initial roles that give new users sufficient permissions to get started, and then revisit them. Alternatively, you can assign roles that are suitable from the start.

You can assign initial roles in several ways:

- [Set permissions when sending invites](#permissions-through-invites) for users to join an organization. You have the choice of adding new users to existing teams or cloning permissions from an existing user.
- [With single sign-on (SSO)](#permissions-through-single-sign-on-sso) you can configure which teams users should be in, and put them straight into those teams. You will set this up in your own identity platform.
- [Use ‘onboarding teams’](#permissions-through-onboarding-teams) to assign initial roles to new user accounts automatically, without any additional steps when creating user accounts.

By combining these different approaches, you can be confident that new users will be able to access Dynamic Content as soon as their accounts are created. For example, you might set up an onboarding team with basic permissions, in case the person who sends invites forgets to set permissions.

## Permissions through invites

When you create Dynamic Content user accounts through Account Management, your [organization administrator](https://amplience.com/developers/docs/concepts/permissions/roles/#organization-administrator) now has the option to set initial permissions at the same time.

You can choose whether new users will receive permissions from existing teams, or by cloning permissions from an existing user.

In this example, we've chosen to clone permissions from an existing user:

![Clone permissions from an existing user](https://cdn.media.amplience.net/i/ampproduct/account-app3-create-user-2?w=1880&fmt=png 'Clone permissions from an existing user')

For more information about how you can use just in time provisioning when creating user accounts from Account management, see [inviting members](https://amplience.com/developers/docs/user-guides/manage-accounts/members/#inviting-members).

## Permissions through single sign-on (SSO)

Permissions for Dynamic Content users can be set up as single sign-on claims, or manually once the user has logged in.

To apply permissions through SSO, you just need to configure SSO within your identity provider to use the `ampTeams` attribute.

For information about SSO configuration for just in time provisioning, see [Configuring permissions via SSO](https://amplience.com/developers/docs/user-guides/sso-single-sign-on/#configuring-permissions-via-sso).

## Permissions through onboarding teams

Account Management uses teams as a way of setting permissions for groups of users. You can now classify teams to be used as 'onboarding teams' to provide a way of setting initial permissions for new user accounts.

"Onboarding teams" are designed to be used as a fallback for when permissions haven't been set for new users through an invite or SSO.

![The Edit team pane](https://cdn.media.amplience.net/i/ampproduct/account-app3-team-list?w=1880&fmt=png 'The Edit team pane')

Once you've established onboarding teams, any permissions associated with them will be used by default to provide initial permissions. When initial permissions have been set for users by using invites or SSO, onboarding teams will be ignored.

## Related pages

[Just in time provisioning](https://amplience.com/developers/docs/user-guides/manage-accounts/members/#just-in-time-provisioning)

[Creating user accounts](https://amplience.com/developers/docs/user-guides/manage-accounts/members/#creating-user-accounts)

[Onboarding teams](https://amplience.com/developers/docs/user-guides/manage-accounts/members/#onboarding-teams)