Which organizational unit (OU) needs to have permission for Just-in-time provisioning to succeed?

For Just-in-time (JIT) provisioning to function effectively, it is essential that the specific Organizational Unit (OU) containing the user's groups has the appropriate permissions. In the context of JIT provisioning, the system needs to access and validate user information from the directory where users and their associated groups reside.

When provisioning a user, Okta checks for the relevant groups within the designated OU to assign the necessary permissions and roles as prescribed in the provisioning policy. This ensures that the user is not only provisioned with the correct account settings but also has the appropriate access rights associated with their groups, which might contain permissions tied to applications or resources within an organization.

In contrast, permissions at the root OU or any generic OU do not guarantee the correct configurations for specific user groups, leading to potential errors or access issues. Thus, it is critical that the permissions at the specific OU are appropriately set to ensure successful JIT provisioning.