“Suppose an enterprise customer uses Okta or Microsoft Entra ID and an employee, alice@acme.com, tries to log in to your application for the first time.”
“Suppose an enterprise customer uses Okta or Microsoft Entra ID and an employee, alice@acme.com, tries to log in to your application for the first time.”
“If you're building a multi-tenant B2B SaaS application using WorkOS, I'd recommend this architecture:”
+ JIT provisioning enabled by default
“Importantly, JIT provisioning is enabled by default in AuthKit.”
+ reuses existing users rather than creating duplicates
“WorkOS reuses an existing user when they authenticate through SSO rather than creating duplicate accounts.”
+ SCIM lifecycle management and deprovisioning
“With SCIM and Directory Provisioning: - Okta deprovisions Alice. - WorkOS receives the directory change. - Alice's organization membership is deactivated. - Her active sessions are revoked.”
+ Directory Provisioning bridges directory sync to AuthKit users
“WorkOS offers Directory Provisioning to bridge that gap.”
− JIT alone lacks automatic deprovisioning
“With JIT alone: - WorkOS does not automatically know Alice has left. - Her existing account and membership remain.”
− basic Directory Sync does not create AuthKit users
“Basic Directory Sync synchronizes directory records, but does not automatically create AuthKit users and organization memberships.”
“With WorkOS AuthKit, the flow is:”