For Acoustic.com, requesting to have "Just in Time Provisioning" added for SSO integrations. This means giving an option to turn this on for SSO self-service integrations, and users from a particluar @emaildomain.com can be automatically onboarded, and added to a given Org/Account.

We recommend tying this to a SAML assertion, so that it only onboards to accounts that have specific headers or values passed, such as roles. If a role is present in a header, it can be mapped to activation of some kind within Acoustic accounts.

Example, if header, roles are comma delimited (or other delimiter):

user_role=tealeaf_account1,campaign_account2
Then the user will be granted access to a specific account in Tealeaf SaaS, and a specific account in Campaign.

Note that this must be checked EACH TIME on login. If access is REVOKED, meaning it is no longer in the header, then access must be removed for that user to that account/org.