Can Azure B2B Collaboration perform just-in-time provisioning with SAML Federation for Guest Accounts?

Question

I have an Azure AD tenant configured with B2B Collaboration with several external identity providers using the invite capabilities to individually invite guests to the tenant. Notably, when these users are invited, they are also assigned groups and SCIM'ed into other SaaS products.

I have another external IdP joining the fray with a slightly more interesting provisioning lifecycle that I cannot directly hook into. Instead, at best, I can process a daily export of provisioning information and mass invite new users, having them accept the invitation / consent via URL on their first login attempt (invite email goes to an unattended mailbox). Ideally, I'd like to avoid the batch processing and perform onboarding when the user presents to the tenant with the SAML for the first time. Am I missing such a capability anywhere?

Constraints:

1. External IDP won't perform any lifecycle hooks (e.g. wont provision the user for me in AD)
2. External IDP is not Azure-based

Answer 1

@Christopher Rowlett ,

SAML JIT user provisioning can be enabled if your application is using SAML for federation, and it is supported for guest accounts.

https://learn.microsoft.com/en-us/azure/active-directory/app-provisioning/isv-automatic-provisioning-multi-tenant-apps