Workspace ONE Access JIT Provisioning Fails with "jit.create.or.update.fail" After Adding Multiple Domains

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

Users are unable to successfully authenticate or provision into Workspace ONE Access (formerly vIDM) via Just-In-Time (JIT) provisioning using Azure AD as the Identity Provider (IdP).

During authentication, users are presented with the following error on the Workspace ONE Access login page:

jit.create.or.update.fail ("Failed to create or update a JIT user")

Environment

Workspace ONE Access (vIDM) 3.3.7

Cause

The underlying cause is that expanding the JIT directory to support multiple domains nullifies the platform's ability to implicitly assign users to a default domain.

In the persistence layer, Workspace ONE Access requires a strict domain mapping to construct a user record within the database. When the JIT directory was originally constrained to a single domain, the authentication pipeline could implicitly map the incoming principal to that default namespace without strict validation. Introducing multiple domains removes this implicit fallback. Because Azure AD is not configured to pass an explicit domain claim in the SAML assertion, the system cannot determine which domain namespace the incoming users belong to, causing the provisioning to fail.

Resolution

To resolve this issue, you must configure Azure AD to pass an explicit domain claim so Workspace ONE Access can fulfill its strict domain mapping requirements. Implementing a dynamic transformation is the best practice for handling multiple domains and B2B guests without manual mapping overhead.

1. Access Azure AD: Log in to the Azure portal and navigate to the Enterprise Application configured for Workspace ONE Access.

2. Modify SAML Configuration: Open the Single Sign-On (SSO) settings and edit the Attributes & Claims section.

3. Add a Domain Claim: Add an explicit domain claim to the SAML configuration.

4. Implement Dynamic Extraction: Configure a transformation rule for this new claim to dynamically extract the domain suffix from the user.userprincipalname attribute. This ensures the correct domain is stripped and passed regardless of whether the user is internal or a B2B guest.

5. Test Authentication: Execute a test login with one of the previously affected users.

6. Verify Assertion: Capture a SAML trace during the test login to definitively confirm that the new domain claim is successfully present in the assertion payload passed to Workspace ONE Access.