--- collection: auth-identity collection_name: Auth & Identity week_start: 2026-09-14 title: Enterprise identity goes real-time, and Clerk ships fallback SSO everywhere release_count: 81 generated: 2026-09-21 canonical: https://releases.sh/collections/auth-identity/digest/2026-09-14 --- # Enterprise identity goes real-time, and Clerk ships fallback SSO everywhere Auth0 opened Early Access for B2B Connect with live enterprise directory sync and session termination, while Clerk rolled self-serve Directory Sync and an SSO fallback sign-in flow across its entire JavaScript stack. ### Enterprise identity turns into an event stream The biggest shift this week is that enterprise directories stopped being something you poll and became something you subscribe to. [Auth0's B2B Connect Early Access](/release/rel_8jT0r5f_Ag3xgh5lLuo-n-auth0-b2b-connect-enterprise-hits-early-access-with-real-time-directory-sync) adds real-time visibility into directory changes, automatically terminates sessions when an enterprise IdP ends one, and resolves an end user's enterprise connection by email domain — all without migrating users off your existing authorization server. The complementary piece is [enterprise connection event streaming](/release/rel_Fijy_Shq19DNYQHwFF3m7-auth0-early-access-streams-enterprise-connection-events-without-polling), which pushes connection.created/updated/deleted as CloudEvents JSON to a webhook or Amazon EventBridge, so the "did an admin just remove SSO?" question no longer costs you a scheduled Management API sweep. If you build B2B SaaS, the practical consequence is that deprovisioning finally behaves like a first-class event. Session termination on IdP logout closes a gap that has historically forced teams to write their own reconciliation jobs. ### Clerk ships the same enterprise primitives, self-serve Clerk's week was one feature propagated deliberately across the stack: [JavaScript SDK 6.32.0](/release/rel_rpw6B0LdJNzBmsZ3Sc4yf-clerk-javascript-sdk-6-32-0-adds-directory-sync-and-sso-fallback-sign-in) introduces self-serve Directory Sync (SCIM) plus an SSO fallback sign-in flow for allowlisted enterprise users whose IdP is unreachable — instead of a hard redirect to a broken provider, they get a "Can't use SSO?" path to an email code. Custom flows read the new `ssoFallbackFirstFactors` property on the sign-in resource. The same change landed in [@clerk/ui](/release/rel_7Jua65biiy2PAsTzekhkR-clerk-javascript-sdk-clerk-ui-1-33-0-adds-self-serve-directory-sync-and-sso), [@clerk/shared](/release/rel_AoQR-KsC3CWixMrEjFLmd-clerk-javascript-sdk-shared-4-32-0-adds-directory-sync-scim-and-sso-fallback), [the localization package](/release/rel_rZBtx8mmqvvV03cl5wOpM-clerk-localizations-4-17-0-adds-sso-fallback-sign-in-and-directory-sync-support), and [the React SDK](/release/rel_AMtQps2nDJcTvHjMNQjcy-clerk-react-sdk-6-16-0-adds-self-serve-directory-sync-scim). Worth noting alongside it: [@clerk/shared 4.33.0](/release/rel_eOLI4P5Ue382YzwhQYqHJ-clerk-javascript-sdk-clerk-shared-4-33-0-adds-agentid-oauth-provider) added an AgentID OAuth provider, and the organization Security page now lists every enterprise SSO connection individually rather than assuming the first API result is the one you meant — a real bug for multi-connection orgs, fixed in [@clerk/localizations 4.17.1](/release/rel_YXpb7xyskQ-s0tCltaJ8A-clerk-javascript-sdk-clerk-localizations-4-17-1-fixes-multi-connection-sso). On mobile, [Clerk iOS 1.5.5](/release/rel_HoHWAekaWFdB_o-mJbQYL-clerk-ios-sdk-1-5-5-adds-biometric-session-reverification) added biometric session reverification and made session handling fail closed on `has()` token mismatches — the security-relevant half of that release. ### Operability and plumbing Two releases target the parts of auth you only notice when they break. [Clerk's SMS delivery tracing](/release/rel_fpL70Qp-xAdiZJFuPfwNl-clerk-adds-sms-delivery-tracing-to-application-logs) records accepted/delivered/failed/undeliverable events in Application Logs with normalized failure reasons, which turns "the code never arrived" from a support mystery into a log query. On the Auth0 side, [Actions Modules reached GA](/release/rel_dw6uldMnnMJL_ubZxpIOG-auth0-actions-modules-reaches-general-availability), letting you share tested, typed, secret-scoped code across Actions; and [custom user IDs at signup](/release/rel_-0C-zBHy6VDLGGlSsqNEF-auth0-early-access-lets-actions-assign-custom-user-ids-at-signup) now let a pre-user-registration Action call `api.user.setUserId()` so you can keep legacy or domain-specific IDs instead of `auth0|`. [Member Management in the My Organization API](/release/rel_EMLk1hvbMEpoD4LZXnfvL-auth0-opens-early-access-for-member-management-in-my-organization-api) opened Early Access with bulk invites and a permission-aware access model for embeddable UI. Elsewhere, [experimental batch transactional email](/release/rel_T6ga2RCvHTNLNhS75eM6a-clerk-javascript-sdk-clerk-backend-3-18-0-adds-experimental-emails-createbatch) arrived in Clerk's backend SDK, and [better-auth v1.7.5](/release/rel_xfcp6nMJUWp-2VQmQ5a40-better-auth-v1-7-5-adds-postgresql-schemaname-support-and-fixes-migration-schema) added `database.schemaName` for direct PostgreSQL connections while fixing cross-schema migration detection; [v1.6.33](/release/rel_g-mwfiyiTAGuJU9t-Qo2Y-better-auth-v1-6-33-fixes-database-option-type-inference-outside-cloudflare) fixed database option type inference outside Cloudflare Workers. The long tail of the week was dependency propagation — dozens of Clerk framework adapters and Supabase Auth release candidates — which you can safely ignore unless you pin exact versions. ## Releases covered ### Auth0 - [Auth0 B2B Connect Enterprise hits Early Access with real-time directory sync](https://releases.sh/release/rel_8jT0r5f_Ag3xgh5lLuo-n-b2b-connect-enterprise-now-tracks-directory-changes-in-real-time) - [Auth0 early access streams enterprise connection events without polling](https://releases.sh/release/rel_Fijy_Shq19DNYQHwFF3m7-enterprise-connection-events-stream-in-real-time-no-polling) - [Auth0 Actions Modules reaches general availability](https://releases.sh/release/rel_dw6uldMnnMJL_ubZxpIOG-actions-modules-now-ga-for-reusable-action-code) - [Auth0 Early Access lets Actions assign custom user IDs at signup](https://releases.sh/release/rel_-0C-zBHy6VDLGGlSsqNEF-custom-user-id-assignment-in-pre-user-registration-actions) - [Auth0 opens early access for Member Management in My Organization API](https://releases.sh/release/rel_EMLk1hvbMEpoD4LZXnfvL-member-management-enters-early-access-for-my-organization-api) ### Better Auth - [better-auth v1.7.5 adds PostgreSQL schemaName support and fixes migration schema detection](https://releases.sh/release/rel_xfcp6nMJUWp-2VQmQ5a40-postgres-schemaname-support-migration-table-detection-fixed) - [better-auth v1.6.33 fixes database option type inference outside Cloudflare Workers](https://releases.sh/release/rel_g-mwfiyiTAGuJU9t-Qo2Y-database-option-type-inference-fixed-for-non-workers-setups) ### Clerk - [Clerk JavaScript SDK 6.32.0 adds Directory Sync and SSO fallback sign-in](https://releases.sh/release/rel_rpw6B0LdJNzBmsZ3Sc4yf-directory-sync-scim-ships-sso-fallback-sign-in-for-enterprise) - [Clerk JavaScript SDK @clerk/ui 1.33.0 adds self-serve Directory Sync and SSO fallback sign-in](https://releases.sh/release/rel_7Jua65biiy2PAsTzekhkR-self-serve-directory-sync-sso-fallback-sign-in-flow-added) - [Clerk JavaScript SDK shared 4.32.0 adds Directory Sync (SCIM) and SSO fallback sign-in](https://releases.sh/release/rel_AoQR-KsC3CWixMrEjFLmd-directory-sync-scim-sso-fallback-allows-email-code-sign-in) - [Clerk localizations 4.17.0 adds SSO fallback sign-in and Directory Sync support](https://releases.sh/release/rel_rZBtx8mmqvvV03cl5wOpM-sso-fallback-sign-in-for-enterprise-users-self-serve-scim) - [Clerk React SDK 6.16.0 adds self-serve Directory Sync SCIM](https://releases.sh/release/rel_AMtQps2nDJcTvHjMNQjcy-directory-sync-scim-now-self-serve) - [Clerk JavaScript SDK @clerk/shared@4.33.0 adds AgentID OAuth provider](https://releases.sh/release/rel_eOLI4P5Ue382YzwhQYqHJ-agentid-oauth-flow-added-sso-connections-managed-individually) - [Clerk JavaScript SDK @clerk/localizations 4.17.1 fixes multi-connection SSO targeting](https://releases.sh/release/rel_YXpb7xyskQ-s0tCltaJ8A-org-security-page-lists-every-enterprise-sso-connection) - [Clerk iOS SDK 1.5.5 adds biometric session reverification](https://releases.sh/release/rel_HoHWAekaWFdB_o-mJbQYL-biometric-session-reverification-added-has-token-mismatch-fixed) - [Clerk adds SMS delivery tracing to Application Logs](https://releases.sh/release/rel_fpL70Qp-xAdiZJFuPfwNl-sms-delivery-lifecycle-now-traced-in-application-logs) - [Clerk JavaScript SDK @clerk/backend@3.18.0 adds experimental emails.createBatch](https://releases.sh/release/rel_T6ga2RCvHTNLNhS75eM6a-batch-email-api-added-sender-names-and-cc-bcc-supported)