Enterprise identity gets real-time sync, fallback sign-in, and custom IDs

Enterprise directories move to real time

The week's biggest story is Auth0's B2B Connect Enterprise entering Early Access, which turns enterprise directory awareness from something you poll into something you subscribe to. Auth0 now streams real-time visibility into directory changes, terminates sessions automatically when an enterprise IdP ends one, resolves an end user's enterprise connection by email domain, and supports applications that don't sit behind an external authorization server. Those connection events can land in a webhook, Amazon EventBridge, or a custom pipeline. That last capability arrived in a related Early Access feature: streamed enterprise connection events covering created, updated, and deleted connections for Azure AD, ADFS, Google Workspace, Active Directory, LDAP, and Ping, delivered as CloudEvents-formatted JSON so you can drop the Management API polling loop you probably built. Both features are additive — the Dashboard and Management API behave as before.

Clerk answered on the same front with self-serve Directory Sync (SCIM) landing across its JavaScript SDK and every framework wrapper in one sweep — React, the shared package, localizations, and @clerk/ui. SCIM provisioning has long been the enterprise checkbox that forces teams onto a bespoke backend; Clerk is making it something you turn on.

When the IdP is down, let people in anyway

Clerk's other significant addition this week is SSO fallback sign-in in <SignIn />. Allowlisted enterprise users whose identity provider can't be reached now see a "Can't use SSO?" link that leads to an email code step instead of being bounced straight into a dead redirect. Custom flows can read the new ssoFallbackFirstFactors property on the sign-in resource, and the same release fixed OAuth sign-ups from openSignIn({ withSignUp: true }) that were landing on the sign-in page with an "External Account was not found" error rather than creating the account.

The rest of Clerk's week was smaller but coherent. The organization Security page now lists every enterprise SSO connection separately, so changing a provider or removing a connection targets that connection instead of whichever one the API returned first — a fix that matters once an org has more than one directory. Clerk also added AgentID as an OAuth provider for the "Continue with AgentID" flow, and its backend picked up an experimental emails.createBatch() for up to 100 transactional emails with per-message idempotency keys, plus sender display names, CC/BCC, attachments, and custom headers.

On the platform side, Clerk made Client ID Metadata Documents generally available for all applications — MCP and other public OAuth clients can use an HTTPS URL as their client_id with no pre-issued ID, secret, or Dynamic Client Registration. It's opt-in via the OAuth application settings. Application Logs also gained SMS delivery tracing, recording accepted, delivered, failed, undeliverable, and unconfirmed events with normalized failure reasons, and the iOS SDK added biometric session reverification while hardening session handling to fail closed on mismatched has() tokens.

Custom IDs and the plumbing underneath

Auth0's pre-user-registration Actions can now assign custom user IDs via api.user.setUserId(), ending the auth0|<id> lock-in for teams with legacy-compatible identifier schemes who previously had to build self-hosted signup pages or bulk import. It works for database connections, Universal Login sign-up, the Authentication API signup endpoint, and the Management API Create User endpoint — though not passwordless, social, or enterprise connections. Auth0 also took Actions Modules to general availability, letting tenants share typed, testable, secret-bearing code across Actions and triggers, and opened Early Access for Member Management in the My Organization API, with bulk invitations up to 10 per atomic request, role assignment guardrails, checkpoint pagination, and a four-level permission model that drives permission-aware embeddable UI.

Underneath it all, Better Auth shipped PostgreSQL schemaName support alongside fixes for migrations misidentifying tables and views across schemas, plus type inference fixes for database options outside Cloudflare Workers. Supabase's Auth service churned through a long run of 2.198.0 release candidates — checksum-only artifacts with no user-facing detail yet worth reading into.