Enable JIT user provisioning for SSO

JIT user provisioning is optional, but recommended. When you enable this setting, Retool provisions user accounts when users sign in over SSO for the first time. This saves time for admins, who then don't need to manually invite users to Retool. The identity provider is still the source of truth and determines which users have access to Retool. Users must also still be granted access in the identity provider before an account is created in Retool.

Cloud-hosted organizations
Self-hosted organizations

Navigate to Settings > Single Sign-on (SSO).
Select your configured SSO provider.
Toggle Enable JIT user provisioning.

If you're setting up SSO with Google, you also need to set the DEFAULT_GROUP_FOR_DOMAINS environment variable.