What happens if a new user with a reserved domain email address is not found in the system during SSO login?

When a new user with a reserved domain email address is not found in the system during SSO (Single Sign-On) login, the correct outcome is the creation of a new user membership within the organization. This functionality is particularly useful for organizations that manage user access and authentication centrally using SSO methods.

The SSO process typically links user authentication back to a directory service, such as LDAP or Active Directory. When an organization has reserved certain domain names for authorized use (like emails ending in their company’s domain), the system allows for the seamless onboarding of new users by creating their accounts automatically. This process mitigates potential administrative burdens, ensuring users can access the system quickly without requiring manual account setup.

This automatic creation aligns with best practices in account management, ensuring that users can efficiently access resources required for their roles within the organization, immediately after their email is verified against the domain. Thus, the integration of SSO with account creation processes enhances user experience while maintaining security protocols inherent in reserved domain policies.