Migrating Auth0 B2B to WorkOS: A 60-Day Runbook

This runbook moves the B2B layer of Auth0 to WorkOS. WorkOS is the 2026 Compass pick when the product is SSO, SCIM, audit logs, and an Admin Portal. AuthKit is free to 1M MAU. You pay for connections. If the leave-reason is a public connection price without the WorkOS portal, use Auth0 to SSOJet instead.

Verify before you act. WorkOS FGA, Directory Sync, and AuthKit are separate SKUs. Confirm which ones you are buying. Compass last verified the WorkOS profile on 19 August 2026. This is not a consumer-auth migration. For passkeys, use Auth0 to MojoAuth.

Phase 1, Scope: Admin Portal and SSO, not full CIAM (7 days)

Inventory Auth0 Organizations, roles, invitations, Enterprise Connections, and every Action that reads org_id. Those Actions are the real work. They do not port to WorkOS. Count them before you promise a date, because this inventory is the duration, not user count.

Decide whether login stays on Auth0, Clerk, or AuthKit. Some teams keep Clerk or Auth0 for the login box and put WorkOS in front of SSO only. Two vendors. That is valid when you already shipped UI.

If a named deal needs Directory Sync this quarter, that deal is the pilot. Do not invent a synthetic tenant.

Phase 2, Stand up AuthKit, Organizations, and Directory Sync (14 days)

Create the WorkOS environment and mirror Organizations from Auth0 without renaming them mid-flight. Configure Admin Portal branding enough that a customer admin will not bounce. If the portal looks unfinished, the pilot customer will not complete IdP setup.

Directory Sync: pick Okta or Entra first. Map groups to roles before you sync. A wrong group-to-admin mapping is an incident, not a bug.

AuthKit session and JWT claims: list every custom claim the app reads from Auth0. Rebuild them. Missing claims look like authorization bugs in your product.

Phase 3, Pilot SSO and SCIM with two customers (16 days)

Dual-run two IdPs that represent your mix, usually one Okta and one Entra. Test SP-initiated and IdP-initiated login. Test SCIM create, update, and deactivate. Document the customer admin steps using the WorkOS Admin Portal, not your support wiki.

Failures here are customer IdP queues and claim mapping. Budget them. WorkOS protocol support is not the risk.

Phase 4, Application cutover and Admin Portal rollout (14 days)

Point the application at WorkOS for org-scoped login and ship Admin Portal links to remaining customers in batches. Keep Auth0 connections until each customer confirms in writing. A silent cut of ACS URLs is how you spend the weekend on a Sev-1.

Sessions and refresh tokens do not migrate. Users sign in again. Passkeys bound to the Auth0 RP-ID do not move. If passkeys matter, you are in the wrong playbook.

Phase 5, Decommission Auth0 B2B surface (9 days)

Disable Auth0 Organizations and Enterprise Connections you no longer need. Recalculate the invoice. If Auth0 remains for B2C, isolate that tenant so a leftover Action cannot fire on a WorkOS user.

Related: Auth0 vs WorkOS, WorkOS vs Auth0 vs Clerk, best CIAM 2026.