Account creation on first sign-in

Each provider has a Create accounts on first sign-in option (also called just-in-time, or JIT, provisioning).

Option	Someone signs in with SSO and…
On	…isn't a member yet: Waxell creates their account and adds them to the workspace as a member.
Off	…isn't a member yet: sign-in is refused (sso_no_account, or sso_not_a_member if they have a Waxell account elsewhere).

Either way:

• Their email must be in the provider's Email domains.
• Existing members sign in as themselves; nothing about their account changes.
• Group mapping and the provider's default role and team apply on sign-in.

Use off when you invite people individually, or provision them with SCIM or directory sync.