How does just-in-time (JIT) SAML provisioning differ from SCIM-based user provisioning for GitHub Enterprise Cloud organizations?
Select an answer to reveal the explanation.
Short Explanation and Infographic
JIT = account shows up when you first SSO in. SCIM = IdP pushes create/update/disable lifecycle over the API. Totally different operational models.
Full explanation below image
Full Explanation
Just-in-time SAML provisioning establishes a GitHub user mapping when a person authenticates successfully through the identity provider, which is simple but weak for offboarding until the next login attempt or manual cleanup. SCIM provisioning lets the IdP create, update attributes, and deactivate accounts through the SCIM API, giving administrators stronger joiner-mover-leaver control. JIT does not delete IdP groups nightly or limit SCIM to SSH keys. SCIM is a cloud enterprise provisioning pattern, not an air-gapped-only GHES feature, and JIT is not exclusive to GitHub Free. CSV billing uploads are unrelated. Mature enterprises often combine SAML for authentication with SCIM for lifecycle automation and auditability.