diff --git a/docs/configuration/authentication/oauth.md b/docs/configuration/authentication/oauth.md
index 459db8c8..8258ae63 100644
--- a/docs/configuration/authentication/oauth.md
+++ b/docs/configuration/authentication/oauth.md
@@ -62,3 +62,15 @@ The correspondence between the user fields obtained from the OAuth authorization
 * uid: the unique identifier for SeaTable identify a user from the OAuth provider.
 * name: the name of a user in SeaTable
 * contact_email: a user's contact email in SeaTable
+
+#### **OAUTH_CREATE_UNKNOWN_USER**
+
+Controls just-in-time (JIT) user provisioning. Default is `True`: a SeaTable account is created automatically the first time a user authenticates successfully via OAuth. Set it to `False` to disable auto-provisioning — users who already have a SeaTable account continue to log in via OAuth, but users without an existing account are rejected and **no** account is created:
+
+```python
+OAUTH_CREATE_UNKNOWN_USER = False
+```
+
+Use this when account eligibility is governed outside of SeaTable (for example by your identity provider or an identity-governance system). With auto-provisioning disabled, new users must exist in SeaTable beforehand — created by an administrator or via import — before their first login.
+
+A related option, `OAUTH_ACTIVATE_USER_AFTER_CREATION` (default `True`), keeps auto-provisioning on but creates new users in an inactive state that requires admin approval; set it to `False` for that behavior.
diff --git a/docs/configuration/authentication/saml.md b/docs/configuration/authentication/saml.md
index b75e221f..34b43141 100644
--- a/docs/configuration/authentication/saml.md
+++ b/docs/configuration/authentication/saml.md
@@ -105,6 +105,7 @@ To enable SAML, add the following parameters to `dtable_web_settings.py`, custom
 | SAML_REMOTE_METADATA_URL | URL of metadata.xml used by SAML IdP                        | URL, e.g. 'https://login.microsoftonline.com/xxx/federationmetadata/2007-06/federationmetadata.xml?appid=xxx'                                |
 | SAML_ATTRIBUTE_MAP       | Key-value pairs mapping SAML attributes to local attributes | Keys are the SAML attributes from the IdP; some IdPs use attribute like 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress' |
 | SAML_CERTS_DIR           | Path to certificates within the Seatable Docker container   | Path, e.g. /opt/seatable/seahub-data/certs                                                                                                   |
+| SAML_CREATE_UNKNOWN_USER | Enables/disables just-in-time user provisioning on first login (optional)   | `True` (default) or `False`. With `False`, existing users can still log in, but no new accounts are created                                  |
 
 This is a sample configuration. Adapt the values to your needs.
 
@@ -120,6 +121,10 @@ SAML_ATTRIBUTE_MAP = {
 SAML_CERTS_DIR = '/shared/certs'
 ```
 
+!!! note "Controlling auto-provisioning"
+
+    By default SeaTable creates a user account on the first successful SAML login (`SAML_CREATE_UNKNOWN_USER = True`). To stop new accounts from being created while keeping existing SSO users working, set `SAML_CREATE_UNKNOWN_USER = False`. New users must then be provisioned in SeaTable beforehand (by an administrator or via import).
+
 !!! warning "Details about the SAML_ATTRIBUTE_MAP"
 
     The `SAML_ATTRIBUTE_MAP` defines the values provided by the IdP that SeaTable uses to create a user or update the user's profile.