# Daily WorkOS identity and directory sync health check

> Every weekday morning, catch customers whose directory sync has quietly broken, file a Linear ticket, and post one summary to Slack.

- Workflow type: agent
- Services: WorkOS, Linear, Slack
- Categories: Engineering, Operations
- Published: 2026-08-10

## What it does

- Checks every customer's directory sync and single sign-on connection in WorkOS each weekday morning and flags the ones that have stopped working.
- Ranks problems by urgency, treating expired directory credentials as critical because provisioning has stopped and departing employees may keep their access.
- Looks for an existing Linear ticket before filing a new one, so the same broken connection never gets reported twice.
- Posts a single summary to your enterprise support channel, worst first, and tells you plainly when everything is healthy.

## What you'll need

- A WorkOS account with the customer organizations you support already connected
- A Linear workspace, and the team you want breakage tickets filed under
- A Slack workspace and the channel your enterprise support team actually watches

## Prompt

Every weekday at 8am, check whether any customer's identity setup in WorkOS has quietly broken. When directory sync fails, our customers stop getting users provisioned and nobody notices for weeks. Run this as a scheduled sweep of current state rather than an event listener, because the failure mode is a directory sitting in a bad state over time, which is not itself an event.

Start by pulling the full picture from WorkOS. Use List Directories to fetch every directory connection and List Connections to fetch every SSO connection, paginating all the way through rather than stopping at the first page. Read the state field on each record.

Classify what you find by severity. Treat a state of invalid_credentials as urgent, because provisioning has stopped: new employees are not getting accounts, and offboarded employees are not being deprovisioned, so people who left the company keep their access. Treat a directory that has been sitting in validating for more than three days as a warning, meaning the customer started setup and never finished it. Treat SSO connections that are inactive or still in draft as warnings too. Anything in an active state is healthy and needs no action.

For every directory or connection that is not healthy, resolve the customer behind it. Take the organization_id on the record and call Get an Organization in WorkOS, so that everything you write names the customer rather than an opaque org_ identifier.

Before filing anything, dedupe. For each affected directory or connection, run Search Issues in Linear using the organization name plus the directory or connection ID, and check whether we already have an open ticket for it. If an open issue exists, do not create another one: note it in the summary as already tracked and carry through the existing issue reference. This step is essential. Without it, this workflow becomes a daily ticket spammer and the team mutes it.

For genuinely new breakages, use Create Issue in Linear. Put the organization name and the failure state in the title so the list is scannable. In the description include the directory or connection ID, the exact state, how long it has been in that state where you can tell, the identity provider type, and suggested remediation. For invalid_credentials, the remediation is to contact the customer's IdP administrator to regenerate the directory sync credentials and re-enter them through the WorkOS Admin Portal. For a directory stalled in validating, the remediation is to nudge the customer's IT contact to finish mapping and pushing users from their identity provider. Set urgent priority on invalid_credentials issues and normal priority on warnings.

Finish with one consolidated summary posted to our enterprise support channel using Send a Message in Slack. Do not post one message per problem. Post a single digest ordered by severity: urgent credential failures first, then stalled or warning states, then anything already tracked in Linear. For each entry give the customer name, the failure state, and the Linear issue reference. If every directory and connection came back healthy, say so explicitly, for example "All customer identity connections healthy, 34 directories and 28 SSO connections checked." The all-clear matters as much as the alerts, because silence is indistinguishable from a workflow that stopped running.

## How to customize

- Change the schedule: every weekday at 8am, daily including weekends, or twice a day while a big customer migration is in flight.
- Adjust how long a half-finished setup can sit before it counts as a warning. The default is three days.
- Point tickets at a different Linear team, or send the summary to a different Slack channel per region or customer segment.

## Example output

Identity health sweep, Tuesday 8:00am. 34 directories and 28 SSO connections checked.

URGENT (1)
Northwind Logistics: directory sync credentials are no longer valid. Provisioning has been stopped since Aug 4. Filed ENG-2841.

WARNING (2)
Acme Corp: directory has been stuck part-way through setup for 6 days, users were never pushed across from their identity provider. Filed ENG-2842.
Brightline Health: single sign-on connection still inactive after 9 days. Already tracked in ENG-2790.

Everything else is healthy.

## FAQ

### Will this file a new ticket every day for the same broken customer?

No. Before filing anything, it searches Linear for an open ticket covering that same connection. If one already exists it links to that ticket in the summary instead of creating a duplicate. Without this step a daily check quickly turns into noise that everyone mutes.

### What happens on a day when everything is working?

You still get a message. It says all connections are healthy and how many were checked, so you always know the check actually ran. Silence would be indistinguishable from a broken workflow.

### Why does a broken directory sync matter so much?

Directory sync is what automatically adds and removes users when your customer's IT team changes someone's access. When it breaks, new hires stop getting accounts and, more seriously, people who have left the company keep theirs until somebody notices by hand.

### Does this change anything in my WorkOS account?

No. It only reads the current state of your customers' connections. The only things it creates are Linear tickets for new breakages and one Slack message.

### Why a scheduled check instead of an alert when something breaks?

The problem here is a connection sitting in a bad state over time, which is a condition rather than a single event. A morning sweep of current state catches setups that stalled or expired quietly, including ones that broke while nobody was looking.

Use this prompt in General Input: https://www.generalinput.com/prompts/daily-workos-identity-and-directory-sync-health-check