Account creation on first sign-in
Each provider has a Create accounts on first sign-in option (also called just-in-time, or JIT, provisioning).
| Option | Someone signs in with SSO and… |
|---|---|
| On | …isn't a member yet: Waxell creates their account and adds them to the workspace as a member. |
| Off | …isn't a member yet: sign-in is refused (sso_no_account, or sso_not_a_member if they have a Waxell account elsewhere). |
Either way:
- Their email must be in the provider's Email domains.
- Existing members sign in as themselves; nothing about their account changes.
- Group mapping and the provider's default role and team apply on sign-in.
Use off when you invite people individually, or provision them with SCIM or directory sync.
No email is sent when an account is created: the person is already signing in. To tell people who haven't signed in yet, see Telling people they're ready.
Which surface new people see
Surface for new people on the provider decides what everyone it creates sees: through sign-in or SCIM.
| Setting | New people land on |
|---|---|
| Same as an invite (default) | What an invited member gets in this workspace |
| Full Platform | Everything |
| Connect Only | Connect: workspaces, channels and agents |
| MCP Gateway | The gateway |
It's applied once, when the person is added. Change anyone afterwards under Settings → Users, and their next sign-in won't undo it, unless one of their groups has a mapped surface, which is re-applied at every sign-in. A directory sync connection has the same setting for the accounts it creates.