> ## Documentation Index
> Fetch the complete documentation index at: https://docs.e6data.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Domain auto-join and JIT provisioning

> Let users join your organization automatically by email domain, and provision SSO users just-in-time on first sign-in.

Two features let people join your organization without per-person invitations: **domain auto-join** and **SSO just-in-time (JIT) provisioning**. Both create new members with the **Viewer** role, which you can change afterward.

## Domain auto-join

Let anyone with an email address on your company domain join automatically the first time they sign in.

1. Open **Settings** (requires the **Manage organization** permission).
2. In the **Auto-Join Domain** card, switch the toggle **on**. The domain is taken from your account - there's nothing to type.

After this, a new user who signs in with a matching email is added to your organization automatically with the **Viewer** role. Common public domains (such as `gmail.com`) cannot be used for auto-join. Auto-join and per-person invitations can be used together - invitations remain the way to add people on other domains, such as contractors.

## SSO just-in-time provisioning

When SSO is configured with domain routing, a user signing in through your identity provider with a matching email domain is provisioned **on first login** - no separate sign-up or invitation step:

1. The user enters their work email and is routed to your identity provider.
2. On a successful sign-in, e6data looks them up by email; if no account exists, it creates one.
3. A membership is added to your organization with the **Viewer** role.
4. The account propagates to each workspace automatically (typically within \~30 seconds).

Because the same email always resolves to one user globally, users moving between organizations don't produce duplicate accounts. Promote JIT-provisioned users from **Access Control → Users**. While SSO is enabled, manual invitations are disabled - the identity provider is the source of truth.

## See also

* [SSO setup](/platform/sso/setup)
* [Organization setup](/platform/organization-setup)
* [Users, groups, and service accounts](/platform/identity/users-groups-service-accounts)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.