# Alert customer success when enterprise SSO goes live

> The moment an enterprise customer switches on single sign-on, your account team hears about it in Slack and the milestone lands on their CRM record.

- Workflow type: agent
- Services: WorkOS, HubSpot, Slack Bot
- Categories: Customer Support, Sales
- Published: 2026-08-10

## What it does

- Catches the moment an enterprise customer finishes turning on single sign-on, so the milestone reaches your account team instead of stopping with engineering.
- Works out who the customer actually is: their company name, their domains, and which identity provider they connected.
- Checks whether that same customer has also set up automated user provisioning, so you know whether manual user management is still in their way.
- Posts a go-live message to your customer success channel and records a note on the matching company in your CRM, flagging it clearly if no company matched.

## What you'll need

- A WorkOS account where your enterprise customers' single sign-on connections are set up
- A HubSpot login that can search companies and add notes to them
- A Slack workspace and the channel your customer success team actually watches
- Customer domains filled in on your HubSpot company records, so the lookup has something to match on

## Prompt

Run this workflow whenever WorkOS sends a connection.activated webhook event. That event is the signal that an enterprise customer has finished turning on single sign-on and the connection is ready to roll out, so treat every delivery as a go-live moment that my account team needs to hear about immediately.

Start from the webhook payload. Read the organization ID and the connection details off the event. WorkOS IDs are type-prefixed, so pass the full prefixed value (org_..., conn_...) everywhere it is used, never a trimmed version. Note the connection type, which tells us which identity provider the customer connected, for example Okta SAML, Microsoft Entra ID, or Google SAML. If the payload does not carry a readable provider name, call WorkOS Get a Connection with the connection ID to resolve it.

Call WorkOS Get an Organization with that organization ID to resolve the customer's display name and their associated domains. These domains are what I will match on in the CRM, so keep the full list rather than just the first one.

Then call WorkOS List Directories, filtered to the same organization, to check whether that customer has also set up directory sync (SCIM). If one or more active directories come back, directory sync is already in place. If none come back, single sign-on is live but directory sync is still outstanding, which means the customer is still adding and removing users by hand. Treat that as the useful follow-up signal, not a footnote.

Look the customer up in the CRM using HubSpot Search Companies, matching on the organization's domain. If the organization has several domains, try them in turn until a company matches. If more than one company comes back for a domain, pick the best match against the organization name and say in the Slack message that the match was ambiguous.

When a company matches, log the milestone with HubSpot Create Note associated to that company record. The note should state that single sign-on went live, the date it activated, which identity provider was connected, and whether directory sync is also configured or still outstanding. Write it so an account manager reading the record in six months understands what happened without any other context.

Finally, post to my customer success channel with Slack Bot Send a Message. Name the organization, state which identity provider they connected, and say clearly whether directory sync is done or still outstanding, so the CSM knows the exact next step to chase. When directory sync is missing, spell out that the customer is still managing users manually and that SCIM is the natural next conversation. Keep it to a short, scannable message rather than a wall of text.

If no HubSpot company matches any of the organization's domains, still post the Slack message. Say explicitly that the CRM match failed, list the domains that were tried, and include everything that was resolved from WorkOS so the go-live is still actionable. Never let a failed CRM lookup silently swallow the notification, and do not skip the Slack post just because the note could not be written.

## How to customize

- Change which Slack channel receives the alert, or route different customer segments to different channels.
- Reword the go-live announcement and the note that gets saved to the customer record.
- Decide whether missing automated user provisioning reads as an upsell prompt or just a status line.

## FAQ

### How quickly does the alert arrive?

It runs as soon as the single sign-on connection becomes active, so your channel usually hears within seconds of the customer finishing setup on their side.

### What happens if the customer isn't found in our CRM?

The alert still posts to Slack and says plainly that the CRM match failed, including the domains it tried. The go-live is never silently dropped, so someone can fix the record and log it.

### Will this work on HubSpot Free?

Yes. It only needs to search companies and add notes to them, and both are available on free and starter plans.

### Does it tell us whether the customer still needs directory sync?

Yes. It checks whether the same customer has automated user provisioning configured and calls it out as the next thing for the CSM to chase, since single sign-on on its own still leaves manual user management in place.

### Will the message look like it came from a person?

No. It posts as a Slack bot, so the alert has its own identity and keeps working even if a particular teammate changes roles or leaves.

Use this prompt in General Input: https://www.generalinput.com/prompts/alert-customer-success-when-enterprise-sso-goes-live