When JIT is enabled in a tenant and SSO-group-based page access for pages is enabled, Tines will not add a user to the tenant when they open a page as long as that user does not exist in an SSO group mapped with JIT. This is true for all page Access control options.
For example, if a user is assigned to the Tines app in Okta, but this user is not in any SSO groups, JIT will not add them to the tenant when they access a page, as there's no SSO group to associate them to.
For more information on SSO in Tines, read here: