Just in Time Provisioning

Just in Time Provisioning is only available to organizations on a Arrow Business or Omnix plan.
Upgrade your plan

Just in Time Provisioning makes onboarding new employees to Arrow faster and simpler. When a new employee goes to log in to Arrow with their work email, they’ll automatically be prompted to log in with SSO and added to your plan. They won’t need to use an email invite or invite link.

Tip: You can prompt your employees to log in to Arrow by mass deploying the Arrow Smart Extension.
Mass deploy the Arrow Smart Extension

Note: If you turned on Just in Time Provisioning and a plan member sees an error message when logging in for the first time, it could mean your plan is out of seats.
Buy more seats for your plan

Before you turn on Just in Time Provisioning

Before you can turn on Just in Time Provisioning, make sure you’ve done the following:

• Set up SSO for Arrow. You can also turn on Just in Time Provisioning during the SSO setup itself.
  More about setting up SSO
• If you’re using Just in Time Provisioning along with another automatic provisioning method, like SCIM or AD sync, make sure to add all your plan members to your synced groups. Otherwise, plan members who aren’t added to synced groups will be removed the next time the directory syncs.

How to turn on Just in Time Provisioning

To turn on Just in Time Provisioning, navigate to the Admin Console and select Integrations > Single sign-on

Depending on your configuration, Confidential SSO or self-hosted SSO:

Important: Self-hosted SSO will no longer be available for setup after September 30, 2025. Please consider using the Confidential SSO instead.
More about Arrow Confidential SSO and SCIM Provisioning

1. If you use Confidential SSO, scroll to Step 3: Verify your domain(s) and turn on Just in Time Provisioning.

   

2. If you use self-hosted SSO select to Edit your SSO settings

   

   • Then scroll to Just in Time Provisioning and turn it on.