Admin comparison
Nightschool AI: SCIM vs JIT provisioning for Claude, plan by plan
Team gets JIT. Enterprise can use SCIM. The difference shows up when someone leaves.
Anthropic's Claude offers JIT provisioning on Team, Enterprise and Console organizations, and SCIM on Enterprise and Console only; SCIM is not available for Team plans. JIT adds people when they first sign in but never removes them. SCIM adds and removes people from your identity provider automatically.
Published
Key Takeaways
- JIT: Team, Enterprise and Console. SCIM: Enterprise and Console only, never Team.
- JIT creates users at first sign-in with the User role and never removes anyone.
- SCIM provisions without a sign-in and removes users who leave your identity provider app.
- The Primary Owner is exempt from SCIM reconciliation, so check that account by hand.
The full guide
Tap any section to open it.
About this guide
Once SSO works, the next admin question for Anthropic's Claude is how accounts get created and removed. This page compares just-in-time (JIT) provisioning and SCIM using Anthropic's provisioning article, so you can pick one and write down how leavers are handled.
JIT and SCIM side by side
| Question | JIT provisioning | SCIM provisioning |
|---|---|---|
| Plans | Team, Enterprise, Console | Enterprise and Console only |
| When an account is created | At the user's first sign-in | From your identity provider, no sign-in needed |
| Role on creation | User, changed by hand | From group mappings, if you turn them on |
| When someone leaves | Never removed automatically | Removed when taken off the identity provider app |
| Primary Owner | Cannot be set by group mappings | Exempt from SCIM reconciliation |
The short versionWhich one you can use depends on the plan
Anthropic says JIT provisioning is available for Team plans, Enterprise plans, and Console organizations, and SCIM provisioning is available for Enterprise and Console organizations only. Its exact wording is that SCIM is not available for Team plans or Console organizations joined to a Team plan's parent organization.
Anthropic's pricing page shows the same split: SCIM is listed for Enterprise and not for Team. If you are on Team, your choice is JIT, with or without group mappings, plus a manual offboarding step.
Both modes assume SSO and domain verification are already done. Anthropic's provisioning guide says so at the top, so finish our SSO and domain verification page first.
JITHow just-in-time provisioning behaves
With JIT, people assigned to your Claude app in the identity provider are provisioned when they first sign in, with the User role. Roles and seat types are then changed by hand.
Anthropic is explicit that JIT never removes members automatically. If you unassign someone from your identity provider app, they can no longer sign in, but they stay in your member list and keep their seat until an admin removes them.
That last point is the one to plan for. A leaver on a JIT org still holds a paid seat until someone removes them in Claude, so add that removal to your offboarding checklist.
Removing the member in Claude is not enough on its own, either. Anthropic says that to remove a JIT user permanently, you remove them in Claude and unassign them in your IdP; a user you remove only in Claude will be re-added the next time they log in with SSO.
SCIMHow SCIM provisioning behaves
With SCIM, users are provisioned from the identity provider without signing in first, and users removed from your identity provider app are automatically removed. With group mappings on, users in a mapped group get the role for that group.
Anthropic notes that group mappings set a user's role type and seat tier only. Users with the Custom role get their permissions from groups in Claude, and those groups sync from your identity provider only in SCIM directory sync mode.
When SCIM directory sync is on, Claude sends each newly provisioned member a welcome email. Owners and Primary Owners can turn that off under Organization settings, Organization and access, User provisioning.
Primary OwnerThe one account SCIM does not manage
Anthropic says your organization's Primary Owner is exempt from SCIM reconciliation. If that account is not in the identity provider directory, or not in a group mapped to a role, it is skipped when SCIM syncs.
Owner and Admin accounts are not exempt. Anthropic says they must be in a group mapped to a role, or they will be removed when SCIM group mappings are enabled; with JIT and group mappings, they are removed the next time they log in.
The Primary Owner role cannot be assigned through group mappings and is transferred by hand in Organization settings. It is not exempt from SSO enforcement, so if its email is on an enforced domain, it signs in through SSO like everyone else.
ChecklistProvisioning checklist you can copy
Write the answers down before you switch modes. Each line follows Anthropic's article.
1. Confirm the plan
Team means JIT only. Enterprise or Console can choose JIT or SCIM.
2. Finish SSO first
Domain verified and SSO tested before you change the provisioning mode.
3. Map groups to roles
List each identity provider group and its role. Team roles are Owner, Admin and User; Enterprise adds Custom. Put every Owner and Admin in a mapped group.
4. Name the Primary Owner
Record who it is. SCIM skips that account, so it needs a manual review.
5. Offboarding step
On JIT, do both: unassign the leaver in your IdP and remove them in Claude. Removing them only in Claude without unassigning in the IdP lets them come back at their next SSO sign-in.
6. Welcome email
On SCIM directory sync, decide whether new members get the welcome email and set it under User provisioning.
SourcesWhere each fact comes from
Anthropic, "Set up JIT or SCIM provisioning": support.claude.com/en/articles/13133195. Anthropic, "Set up single sign-on (SSO)": support.claude.com/en/articles/13132885.
Anthropic, "Plans and pricing": claude.com/pricing.
Each fact on this page was read on that vendor page on 2026-11-08. Settings pages move and plans change, so open the source and your own admin console before you rely on a detail here.
Train the admins, then the people they support
This page covers one admin task. The Nightschool AI admin and governance course walks the whole Team and Enterprise setup in order: sign-in, provisioning, connectors, data, and Claude Code, with every step checked against Anthropic's own documentation.
Frequently Asked Questions
Does Claude Team have SCIM?
No. Anthropic says SCIM is not available for Team plans or Console organizations joined to a Team plan's parent organization. Team plans use JIT provisioning, and the pricing page lists SCIM under Enterprise only.
What is JIT provisioning in Claude?
Just-in-time provisioning creates a Claude account the first time someone assigned to your identity provider app signs in. Anthropic says those users get the User role, and roles and seat types are then changed by hand.
Does JIT remove people who leave?
No. Anthropic says JIT never removes members automatically. An unassigned user can no longer sign in, but stays in the member list and keeps their seat until an admin removes them.
Does SCIM remove people automatically?
Yes. With SCIM, Anthropic says users removed from your identity provider app are automatically removed. The exception is the Primary Owner, who is exempt from SCIM reconciliation.
Can group mappings give someone admin rights?
Group mappings set a user's role type and seat tier only. Team roles are Owner, Admin and User, and Enterprise adds Custom. Custom role permissions come from groups in Claude, which sync from your identity provider only with SCIM directory sync.
Do I need SSO before provisioning?
Yes. Anthropic's provisioning guide assumes you have already completed SSO setup, including domain verification and SSO configuration. Set those up first and test sign-in.
Why was the Primary Owner skipped in a SCIM sync?
Because Anthropic exempts the Primary Owner from SCIM reconciliation. If that account is not in the directory or not in a mapped group, SCIM skips it rather than removing it.
Set it up once, write it down, then teach it
Pick the mode your plan allows, then write down exactly what happens to a leaver's seat.
Nightschool AI is independent and not affiliated with, sponsored by or endorsed by Anthropic. Claude is Anthropic's product, named here only to describe it. Facts checked against Anthropic's public pages on 2026-11-08; confirm in your own admin console before you change a setting.