Enterprise identity goes real-time, and Clerk ships fallback SSO everywhere

Enterprise identity turns into an event stream

The biggest shift this week is that enterprise directories stopped being something you poll and became something you subscribe to. Auth0's B2B Connect Early Access adds real-time visibility into directory changes, automatically terminates sessions when an enterprise IdP ends one, and resolves an end user's enterprise connection by email domain — all without migrating users off your existing authorization server. The complementary piece is enterprise connection event streaming, which pushes connection.created/updated/deleted as CloudEvents JSON to a webhook or Amazon EventBridge, so the "did an admin just remove SSO?" question no longer costs you a scheduled Management API sweep.

If you build B2B SaaS, the practical consequence is that deprovisioning finally behaves like a first-class event. Session termination on IdP logout closes a gap that has historically forced teams to write their own reconciliation jobs.

Clerk ships the same enterprise primitives, self-serve

Clerk's week was one feature propagated deliberately across the stack: JavaScript SDK 6.32.0 introduces self-serve Directory Sync (SCIM) plus an SSO fallback sign-in flow for allowlisted enterprise users whose IdP is unreachable — instead of a hard redirect to a broken provider, they get a "Can't use SSO?" path to an email code. Custom flows read the new ssoFallbackFirstFactors property on the sign-in resource. The same change landed in @clerk/ui, @clerk/shared, the localization package, and the React SDK.

Worth noting alongside it: @clerk/shared 4.33.0 added an AgentID OAuth provider, and the organization Security page now lists every enterprise SSO connection individually rather than assuming the first API result is the one you meant — a real bug for multi-connection orgs, fixed in @clerk/localizations 4.17.1. On mobile, Clerk iOS 1.5.5 added biometric session reverification and made session handling fail closed on has() token mismatches — the security-relevant half of that release.

Operability and plumbing

Two releases target the parts of auth you only notice when they break. Clerk's SMS delivery tracing records accepted/delivered/failed/undeliverable events in Application Logs with normalized failure reasons, which turns "the code never arrived" from a support mystery into a log query. On the Auth0 side, Actions Modules reached GA, letting you share tested, typed, secret-scoped code across Actions; and custom user IDs at signup now let a pre-user-registration Action call api.user.setUserId() so you can keep legacy or domain-specific IDs instead of auth0|<id>. Member Management in the My Organization API opened Early Access with bulk invites and a permission-aware access model for embeddable UI.

Elsewhere, experimental batch transactional email arrived in Clerk's backend SDK, and better-auth v1.7.5 added database.schemaName for direct PostgreSQL connections while fixing cross-schema migration detection; v1.6.33 fixed database option type inference outside Cloudflare Workers. The long tail of the week was dependency propagation — dozens of Clerk framework adapters and Supabase Auth release candidates — which you can safely ignore unless you pin exact versions.