Multiple enterprise connections per Organization

An Organization can now have more than one enterprise connection. Previously, creating a second SAML or OIDC connection for an Organization that already had one failed with organization_already_has_sso_connection. That limit is gone across the Clerk Dashboard⁠ and the Backend API⁠.

Why this matters

Some enterprise customers use more than one identity provider (IdP). This happens after an acquisition, during a migration from one IdP to another, or when subsidiaries and contractors sign in through separate providers. Before, each connection needed its own Organization. Now every connection can point to the same Organization, each with its own domain, protocol, and settings.

Directory Sync follows

Because each enterprise connection can have its own Directory Sync, a single Organization can now be fed by several directories, and the same person can be managed by more than one of them.

Clerk tracks each directory's view of a user separately:

• A user stays active while at least one enabled directory reports them as active. Clerk deactivates the user and revokes their sessions only when every enabled directory that manages them has deprovisioned them.
• Organization membership and Role mapping follow the directories that still grant access. Deprovisioning from one directory withdraws only that directory's grant. The membership is deleted only when no directory grants it anymore.
• Disabling or deleting a directory withdraws the memberships it granted without waiting for the IdP to sync. The recalculation runs in the background. Each affected user's status is recalculated from the remaining enabled directories: they are deactivated only if every one of those has deprovisioned them, and if none remain their status doesn't change.

Get started

In the Clerk Dashboard, navigate to the SSO connections⁠ page and add a connection for an Organization that already has one. Read the Organization-level Enterprise SSO and Directory Sync docs to learn more.