A media company recently implemented an IAM system supporting SAML and OpenId.

To provide "instant access" for new customers via an external IAM system using SAML, Salesforce provides a declarative feature called Just-in-Time (JIT) provisioning.

When a customer attempts to log in to the Community (Experience Cloud) through the IAM system, the IAM system (acting as the Identity Provider) sends a SAML assertion to Salesforce. If JIT provisioning is enabled, Salesforce parses the user information contained in that assertion—such as name, email, and federation ID. If a corresponding User record does not exist, Salesforce automatically creates one on-the-fly and then logs the user in. This eliminates the need for a manual registration step or pre-provisioning accounts.

Option A is slightly incorrect because Registration Handlers are specifically associated with Authentication Providers (which use OpenID Connect/OAuth), not SAML SSO. Option C is incorrect because JIT provisioning is a feature of SAML, while Authentication Providers use the Registration Handler class to achieve the same result. For a "self-service" scenario where speed to market and standard protocols are key, SAML SSO with JIT provisioning is the architect's primary choice for automating user management and providing a seamless single-entry point for subscribers.