Just-in-Time (JIT) user reactivation via SSO

Overview

Inactive users can now be automatically reactivated when they sign in through a supported SSO provider. This helps reduce manual administration and gives returning users a smoother sign-in experience.

Before you begin

This feature is intended for Application Managers configuring SSO for their Simpplr intranet. JIT reactivation works only for users who already exist in Simpplr and are currently inactive. It does not replace JIT provisioning for brand-new users.

What is new

JIT reactivation is now available for both SAML and OIDC SSO configurations. When enabled, users who already exist in Simpplr but are marked inactive can regain access during sign-in. If Sync existing users via SSO is also enabled, profile details are updated during login.

How JIT reactivation works

JIT reactivation extends Simpplr's existing Just-in-Time user lifecycle capabilities. Previously, SSO could provision new users and sync existing users. With this enhancement, Simpplr can now also reactivate an existing inactive user at the time of SSO login.

• If the user matches an existing inactive Simpplr account and reactivation is enabled, Simpplr changes the user status back to active during sign-in.

• If syncing is also enabled, Simpplr updates mapped user profile fields from the identity provider during that same login flow.

• If reactivation is not enabled, the inactive user remains blocked and must be reactivated manually by an administrator.

Reactivation changes the user's access state. Profile updates happen only when user syncing is separately enabled.

Where to enable JIT reactivation

Application Managers can configure this setting in the SSO setup area:

Manage > Application > Security > External IDP (SSO)

In the SSO configuration, a new toggle is available under the JIT section:

Reactivate users via SSO

This toggle is supported across SAML and OIDC configurations and is off by default until enabled by an administrator.

What happens during sign-in

When a user signs in through SSO, Simpplr evaluates the account based on the configured login identifier and SSO settings.

1. Simpplr checks for a matching existing user record.

2. If the user is inactive and Reactivate users via SSO is enabled, the account is reactivated.

3. If Sync existing users via SSO is also enabled, mapped profile fields are refreshed from the identity provider.

4. The user is allowed into the application without requiring manual admin action.

5. If reactivation is disabled, the user remains inactive and sign-in is blocked.

Supported configurations

JIT reactivation is supported across both major SSO protocols:

• SAML

• OIDC

The feature has been validated across multiple provider types and identifier-based matching scenarios, including Azure/Microsoft Entra ID, Okta, Google, OneLogin, Workday, and custom SSO setups.

User matching follows the login identifiers configured for the SSO connection. Supported identifiers include:

• Email

• Username

• Employee number

• Mobile phone

• Phone number

• Custom field

Best practice: Make sure your selected login identifier is consistently populated in both your identity provider and Simpplr so returning inactive users can be matched correctly.

How syncing works with reactivation

JIT reactivation can work together with user syncing, but the two settings control different behaviors.

• If reactivation is on and syncing is off, the user regains access but profile fields stay unchanged.

• If reactivation is on and syncing is on, the user regains access and mapped profile details are updated during sign-in.

Known limitation: In some cases, profile syncing for an inactive user may not complete on the first reactivation login and may require a second SSO login to fully update attributes. Reactivation itself is supported, but attribute update timing may vary until this issue is resolved.

What users and admins can expect

For administrators, this reduces the need to manually restore access for users who were previously deactivated but are still active in the identity provider.

For end users:

• No separate admin request is needed in supported scenarios.

• Users can regain access during normal SSO sign-in.

• If syncing is enabled, their profile can also be refreshed from the identity provider.

This is especially helpful for organizations that treat the identity provider as the primary source of truth for account access and user attributes.

Sign-in messages

If sign-in cannot proceed, users may see the following messages:

Troubleshooting

An inactive user attempted to sign in through SSO but received a "User account not active" message.

• What happened: The Reactivate users via SSO toggle is not enabled in the SSO configuration. When reactivation is disabled, inactive users cannot sign in through SSO and remain blocked regardless of their status in the identity provider.

• What to do: Go to Manage > Application > Security > External IDP (SSO) and enable the Reactivate users via SSO toggle under the JIT section. Once enabled, the user can attempt to sign in again and will be reactivated automatically if a matching account is found.

An inactive user signed in through SSO and was reactivated, but their profile fields were not updated.

• What happened: JIT reactivation and profile syncing are controlled by separate settings. Reactivation restores account access but does not update profile fields unless Sync existing users via SSO is also enabled.

• What to do: Go to the SSO configuration and confirm that Sync existing users via SSO is enabled alongside Reactivate users via SSO. If syncing was not enabled at the time of the first login, the user can sign in again once syncing is turned on to trigger a profile update.

An inactive user was reactivated on first SSO login but their profile attributes were only partially updated.

• What happened: A known limitation exists where profile syncing for an inactive user may not fully complete on the first reactivation login. Reactivation itself is supported, but attribute update timing may vary and a second SSO login may be needed to complete the profile sync.

• What to do: Ask the user to sign out and sign back in through SSO. The second login should trigger a full profile attribute update. If attributes are still not updating after a second login, confirm that the relevant fields are mapped correctly in the SSO configuration and that the identity provider is sending the expected values.

A user signed in through SSO but received a "User does not exist" message.

• What happened: Simpplr could not find a matching user record based on the configured login identifier. This can happen if the identifier used by the identity provider does not match what is stored in Simpplr, or if the user has never been provisioned in Simpplr and JIT provisioning is not enabled.

• What to do: Confirm that the login identifier configured for the SSO connection, such as email, username, or employee number, is consistently populated in both the identity provider and Simpplr. If the user has never existed in Simpplr, JIT provisioning must be enabled to create a new account. JIT reactivation applies only to users who already exist in Simpplr as inactive accounts.

A user signed in through SSO but received an "Issue in SSO configuration setup" message.

• What happened: Simpplr was unable to process the SSO configuration or the incoming assertion or claims from the identity provider. This typically indicates a configuration mismatch between Simpplr and the identity provider.

• What to do: Go to Manage > Application > Security > External IDP (SSO) and review the SSO configuration for any errors or missing values. Confirm that the identity provider is sending the expected claims and that the assertion format matches what Simpplr is configured to accept. If the issue cannot be identified, contact Simpplr support with details of the SSO provider and the error encountered.

An inactive user cannot be matched during SSO sign-in even though the account exists in Simpplr.

• What happened: User matching during SSO sign-in depends on the login identifier configured for the SSO connection. If the identifier value in the identity provider does not exactly match the corresponding field in Simpplr, the account will not be matched and reactivation will not occur.

• What to do: Confirm which login identifier is configured for the SSO connection. Check that the same identifier value, such as email address or employee number, is present and consistent in both the identity provider and the user's Simpplr profile. Correct any mismatches and ask the user to attempt sign-in again.

Frequently asked questions

Q: Does JIT reactivation create new user accounts?

Ans: No. It reactivates an existing inactive Simpplr user account that matches the configured login identifier. New user creation continues to be handled by JIT provisioning.

Q: Is JIT reactivation supported for both SAML and OIDC?

And: Yes. JIT reactivation is supported for both SAML and OIDC SSO configurations.

Q: Will profile fields be updated when a user is reactivated?

Ans: Yes, if Sync existing users via SSO is enabled. If syncing is disabled, the user is reactivated without updating profile fields.

Q: What happens if reactivation is not enabled and an inactive user tries to sign in?

Ans: The inactive user remains inactive and cannot access Simpplr through SSO until an administrator reactivates the account manually.

Q: How does Simpplr match an inactive user during sign-in?

Ans: Matching depends on the identifiers configured for the SSO provider. Supported identifiers include email, username, employee number, mobile phone, phone number, and custom field.

Q: Is the Reactivate users via SSO toggle on by default?

Ans: No. The toggle is off by default and must be enabled by an administrator in the SSO configuration.