Just-in-Time (JIT) Group Assignments simplify user group management in Mediafly by automatically assigning users to predefined groups upon authentication through Single Sign-On (SSO). This eliminates the need for admins to manually add users to groups while ensuring appropriate access control.
-
Reduces admin overhead by automating user group assignments.
-
Ensures consistent access control based on user attributes.
-
Works in real-time when users log in via SSO.
-
Supports multiple identity providers (Okta, Microsoft Entra, etc.).
How JIT Group Assignments Work
When a user logs in via SSO:
-
Mediafly SSO verifies and authenticates the user as usual.
-
Mediafly checks if JIT Group Assignments are enabled.
-
Mediafly searches for the relevant attribute where the name is "group" in the SAML assertion.
-
Mediafly looks for matching groups:
-
If a group named "Sales" exists in Mediafly and the user is not a member, they will be added.
-
If a group named "Marketing" exists in Mediafly and the user is not a member, they will be added.
-
Note: This feature does not dynamically create groups in Mediafly. Groups must already exist before assigning users via JIT.
Configuring JIT Groups
-
Ensure that groups are already created in Mediafly. Check out our article on creating groups to learn more.
-
Configure your identity provider (IdP) to send group attributes in the SAML assertion.
▪ If you're using Microsoft Entra, use this Microsoft Guide.
▪ If you're using Okta, use this Okta Guide. -
Verify that the attribute name used for groups in the SAML assertion matches the Mediafly group names exactly.
Replies have been locked on this page!