Daily WorkOS identity and directory sync health check

Every weekday at 8am, check whether any customer's identity setup in WorkOS has quietly broken. When directory sync fails, our customers stop getting users provisioned and nobody notices for weeks. Run this as a scheduled sweep of current state rather than an event listener, because the failure mode is a directory sitting in a bad state over time, which is not itself an event.

Start by pulling the full picture from WorkOS. Use List Directories to fetch every directory connection and List Connections to fetch every SSO connection, paginating all the way through rather than stopping at the first page. Read the state field on each record.

Classify what you find by severity. Treat a state of invalid_credentials as urgent, because provisioning has stopped: new employees are not getting accounts, and offboarded employees are not being deprovisioned, so people who left the company keep their access. Treat a directory that has been sitting in validating for more than three days as a warning, meaning the customer started setup and never finished it. Treat SSO connections that are inactive or still in draft as warnings too. Anything in an active state is healthy and needs no action.

For every directory or connection that is not healthy, resolve the customer behind it. Take the organization_id on the record and call Get an Organization in WorkOS, so that everything you write names the customer rather than an opaque org_ identifier.

Before filing anything, dedupe. For each affected directory or connection, run Search Issues in Linear using the organization name plus the directory or connection ID, and check whether we already have an open ticket for it. If an open issue exists, do not create another one: note it in the summary as already tracked and carry through the existing issue reference. This step is essential. Without it, this workflow becomes a daily ticket spammer and the team mutes it.

For genuinely new breakages, use Create Issue in Linear. Put the organization name and the failure state in the title so the list is scannable. In the description include the directory or connection ID, the exact state, how long it has been in that state where you can tell, the identity provider type, and suggested remediation. For invalid_credentials, the remediation is to contact the customer's IdP administrator to regenerate the directory sync credentials and re-enter them through the WorkOS Admin Portal. For a directory stalled in validating, the remediation is to nudge the customer's IT contact to finish mapping and pushing users from their identity provider. Set urgent priority on invalid_credentials issues and normal priority on warnings.

Finish with one consolidated summary posted to our enterprise support channel using Send a Message in Slack. Do not post one message per problem. Post a single digest ordered by severity: urgent credential failures first, then stalled or warning states, then anything already tracked in Linear. For each entry give the customer name, the failure state, and the Linear issue reference. If every directory and connection came back healthy, say so explicitly, for example "All customer identity connections healthy, 34 directories and 28 SSO connections checked." The all-clear matters as much as the alerts, because silence is indistinguishable from a workflow that stopped running.