# Just-in-Time provisioning

The Just-in-Time (JIT) provisioning is the default provisioning mode. User accounts are created in SonarQube Community Build when GitLab users log in for the first time. With this mode, you can use the group synchronization feature.

## Group synchronization <a href="#group-synchronization" id="group-synchronization"></a>

Groups are used in SonarQube Community Build to manage user permissions.

With the group synchronization:

* The synchronization occurs each time a user logs in to SonarQube Community Build with their GitLab credentials.
* If a matching group is found in SonarQube Community Build, the GitLab account’s memberships in that group are synchronized in SonarQube Community Build. The groups match if the SonarQube Community Build group name matches the GitLab group URL. For example, the SonarQube Community Build group `my-gitlab-group/sub-group` matches the GitLab group whose URL is `https://gitlab.com/my-gitlab-group/sub-group`. (The name check is case-sensitive; The default built-in `sonar-users` group is excluded from the synchronization.)
* Manually added group memberships of JIT-provisioned users are reset in SonarQube Community Build at synchronization time.

<figure><img src="/spaces/KXW79zfYFiA8incTvwZK/files/30bcr3kKtIvthbwJiURM" alt="JIT&#x27;s group synchronization principles with GitLab"><figcaption></figcaption></figure>

## User access restriction (Allowed groups) <a href="#user-access-restriction" id="user-access-restriction"></a>

You can block the signup of new users with SonarQube. This may be useful if you want to manage user provisioning through an API.

{% hint style="info" %}
With SonarQube Server, you can restrict access to SonarQube by defining Allowed groups. For more information, see [Feature comparison table](/sonarqube-community-build/feature-comparison-table.md).
{% endhint %}

## Related page <a href="#related-pages" id="related-pages"></a>

* [Managing groups](/sonarqube-community-build/instance-administration/user-management/user-groups.md#group-concept)
* [Setting up authentication](/sonarqube-community-build/instance-administration/authentication/gitlab/setting-up.md)
* [Managing JIT provisioning](/sonarqube-community-build/instance-administration/authentication/gitlab/managing-jit-mode.md)


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.sonarsource.com/sonarqube-community-build/instance-administration/authentication/gitlab/provisioning-modes/just-in-time.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.