WorkOS

WorkOS is a technology company focused on providing enterprise-grade identity authentication and user management infrastructure for SaaS applications, with products covering core enterprise IT capabilities such as SSO (Single Sign-On), SCIM directory synchronization, and audit logs.

WorkOS was originally positioned to help SaaS products quickly integrate enterprise-grade identity capabilities such as SSO and directory sync.

WorkOS User Groups is part of its authorization system, built on top of the existing user directory and role model.

WorkOS supports both single-role and multi-role modes, and group roles are resolved differently in the two modes.

In multi-role mode, the roles corresponding to the various groups a user belongs to stack and take effect, forming a complete permission set.

AuthKit has fully translated its hosted pages, emails and Widgets into 90 locales.

WorkOS engineering manager Nick Nisi and applied AI team engineer Zach Proser proposed at the AI Engineer workshop that an agent's "completion" should be turned from the model's self-report into reproducible evidence.

Against the backdrop of frequent security incidents, enterprises should treat identity infrastructure as a core component of the security architecture rather than an auxiliary feature.

WorkOS recommends that teams review dependency lock files, enable package integrity verification, and monitor anomalous outbound network behavior.

This automatic capture is not retroactive; events that occurred before it was enabled will not be backfilled.

WorkOS's Directory Sync feature connects to enterprise identity providers (such as Okta, Azure AD and Google Workspace) via the SCIM protocol.

Automatic capture covers only two types of events, sign-in sessions and membership changes; other custom business operations still require developers to actively report them via the Audit Logs API.

WorkOS previously did not persistently store sign-in and membership change events for audit purposes, so they cannot be backfilled retroactively.

For products using WorkOS for enterprise-grade SSO and Directory Sync, this update lowers integration costs and is particularly helpful for meeting compliance requirements such as SOC 2 and ISO 27001.

Membership change events are generated on the Directory Sync path: group changes on the IdP side are pushed via SCIM, triggering WorkOS to update organization membership, which is then written to the audit log.

If a compliance audit needs to cover a longer historical period, teams should enable this feature as early as possible and check the receiving configuration of downstream logging systems (such as a SIEM).

If an application has its own membership management entry point independent of the IdP, those membership changes will not automatically enter the WorkOS audit log.

Previously, developers had to manually call WorkOS's audit log API to record sign-in and membership change actions.

auth.md was proposed by WorkOS and is still in an early adoption stage; it lets services use a Markdown file to describe registration, authentication, and available permissions, supporting two modes: Agent verified and User claimed.

WorkOS exposes a standardized provisioning interface through the Provisioning API.