Major incident

WorkOS: Degraded performance for Directory Provisioning for Authkit

Affected: Directory Sync, AuthKit

Current status of WorkOS: Operational — live WorkOS status

Timeline

1. Jun 22, 2026, 21:36 UTC
   investigating
   We are seeing a delay in Directory Provisioning for Authkit, for any directories created before June 22, 21:36:17 UTC. Any directories created after this time are working as expected.
2. Jun 24, 2026, 16:47 UTC
   identified
   The underlying issue that has lead to a delay in provisioning has been identified, and a fix is being prepared
3. Jun 24, 2026, 17:37 UTC
   identified
   We have corrected the affected directories, and they are back to a provisioning status.
4. Jun 25, 2026, 00:09 UTC
   monitoring
   Provisioning has caught up for user creation, and new directory activity is syncing normally. We are still working through and monitoring the remaining synchronization catch-up, which is not yet fully complete. Another update to follow.
5. Jun 25, 2026, 03:29 UTC
   monitoring
   Synchronization has continued to catch up. We are continuing to monitor the few out of sync changes that are remaining.
6. Jun 25, 2026, 05:12 UTC
   resolved
   The remaining out-of-sync user records are now back in sync.
7. Jul 1, 2026, 16:12 UTC
   postmortem
   ## **Summary** Between June 22, 2026 at 21:36 UTC and June 25, 2026 at 05:12 UTC, Directory Provisioning for AuthKit was interrupted. During this period, directory updates continued to be received and processed by WorkOS, but downstream AuthKit user and organization membership changes were not applied as expected. The issue was caused by an internal data migration being run in production with parameters that unintentionally changed the AuthKit provisioning state for existing customer directories. Once identified, we restored the affected directory provisioning state, backfilled missed user provisioning updates, and deactivated memberships that had not been deactivated during the incident window. No directory events were lost or dropped during this period; however, events received during the incident period were not immediately propagated to AuthKit. Directories created after the migration were unaffected. ## Background Directory Provisioning for AuthKit works in two steps: WorkOS receives directory events from a customer's identity provider, then propagates those events downstream to create or update AuthKit users and organization memberships. That second step only happens if the directory is marked as eligible for downstream provisioning. If that eligibility is disabled, WorkOS continues receiving directory events normally, but the corresponding AuthKit updates are not applied. ## What Happened On June 22, 2026 at 21:36 UTC, an internal data migration was executed through an administrative migration tool. The migration changed the provisioning status for customer directories in a way that unintentionally disabled Directory Provisioning in AuthKit for affected customers. As a result: * New directory users created during the incident window were not consistently provisioned into AuthKit. * Some directory user updates, including attributes and roles, were not propagated to corresponding organization memberships. * Some users who were removed or deactivated in the directory were not fully deactivated in AuthKit during the incident period. This meant that, for the duration of the incident, some users who should have lost access to an organization may have retained it. Based on our review, we found no evidence that this residual access was exercised or misused during the incident window. The incident was reported on June 24, 2026 after customer reports of provisioning failures, approximately 42 hours after the migration ran. We did not have sufficient monitoring in place at the time that was sensitive enough to detect an abnormal drop in volume for Directory Provisioning in AuthKit, which is why detection relied on customer reports rather than internal alerting. Our team investigated the behavior, identified the migration as the cause, and immediately worked to restore affected directory provisioning state. We then performed additional remediation to address downstream effects from the incident window. This included provisioning missed users, refreshing affected membership attributes and roles, and deactivating stale memberships that should no longer have been active. ## Customer Impact & Recommended Actions Customers with Directory Provisioning enabled for AuthKit during the incident window may have experienced delayed user provisioning, attribute/role updates, or deactivation between June 22, 2026 21:36 UTC and June 25, 2026 05:12 UTC. All known gaps from this window have since been backfilled as part of our remediation. If you have reason to believe your AuthKit users or organization memberships were affected in a way not addressed by this remediation, please reach out to our support team so we can investigate your specific environment. ## **Timeline** * **June 22, 2026 21:36 UTC** – An internal data migration unintentionally disabled Directory Provisioning for affected directories. * **June 24, 2026 15:49 UTC** – The incident was reported after customer provisioning failures were identified. * **June 24, 2026 17:

Updates as published by WorkOS (original).