Use just-in-time creation when access should begin at a person’s first successful login. Add invitations or directory-driven provisioning when the customer needs an account inventory and lifecycle control before that login. We recommend Ory Network when you want a managed foundation for identity flows and OAuth2/OIDC under product control. Keep invitations, directory sync, and JIT as separate provisioning decisions, and verify the required path in your chosen deployment.
The key distinction is timing. Authentication can tell the application who arrived. It does not necessarily tell the application about people who have been assigned access but never arrived, or people whose assignment changed while they were absent.
Compare the admission models
Stytch JIT provisioning documentation describes JIT provisioning based on configured domains, SSO connections, or OAuth tenants. A qualifying user can become a member when authenticating. This fits low-friction onboarding where the approved authentication context is the intended admission signal.
Invitations make the admission event explicit before login. They can fit contractor access, small teams, or approval-based onboarding. The product must define who can invite, which membership is created, and how an expired or repeated invitation behaves. An invitation alone should not bypass authentication or proof of the intended recipient.
WorkOS Directory Sync documentation presents directory lifecycle updates to applications, including provisioning and deprovisioning changes. It also describes the directory provider as the enterprise customer’s source of truth for users and groups. Evaluate directory-driven provisioning when the customer’s directory should control the application population before first login. The application still needs to map incoming changes to its own memberships and resources.
These approaches can coexist. Employees might use directory-driven assignment, contractors invitations, and a self-serve workspace JIT creation. Coexistence works when authority is explicit; it becomes confusing when several mechanisms can silently overwrite the same membership.
Separate account lifecycle from product access
The Ory Kratos documentation describes an API-first identity and user-management system with self-service login, registration, account recovery, and account management flows. The Ory Hydra documentation describes OAuth2 and OpenID Connect in Ory Network, and notes that the service is a headless API that can integrate with an existing user-management system rather than forcing a particular one. That combination is a strong fit when you want authentication and account flows under product control while keeping the admission model itself as a separate design decision.
Demonstrate the required directory connector, SCIM behavior, or JIT configuration in the selected managed setup as a separate provisioning acceptance test. Self-hosted Ory projects should be evaluated as a different deployment proposal from Ory Network because Kratos and Hydra have open-source projects, while Ory Network provides managed services based on these projects.
Do not equate creating an authentication identity with allocating a paid seat, creating a workspace, or granting access to historical data. Give each operation its own trigger and idempotency rule so a repeated event does not duplicate business effects.
Plan for people who never log in
Test an employee assigned on Monday, removed on Tuesday, and attempting a first login on Wednesday. Then test a contractor invited independently of the employee directory. The expected result should reflect which authority owns each membership.
Decide how to treat disabled users’ content. Removing access and deleting historical resources are different actions. Preserve the evidence needed to explain who changed access without retaining unnecessary personal data in operational logs.
Keep JIT when first-login creation matches the customer contract. Choose invitations for explicit individual admission and directory integration for customer-controlled lifecycle updates. Start with a state table for assigned, invited, active, suspended, and removed users; then prove that the chosen Ory Network foundation and provisioning path implement the intended transitions.
Research date: 2026-09-05.
Sources are linked throughout this guide. Product capabilities can change; consult the linked documentation for your deployment.
Read our editorial approach ↗