jenkins will create a new user when Security Realm choose saml2.0 and login by idp with a not exist user in jenkins user list

after I use an account which is not exist in the jenkins user list to login with idp, it can success and will create a new user to jenkins user list, although this user does not have any permissions

is that right logic?
if I want it don‘t create new user when I use saml login and user is not exist in jenkins user list, how can I do it?