Everything in Pro, plus:
Single sign-on
SAML 2.0 and OIDC through the WorkOS Admin Portal. That covers Okta, Entra ID, Google Workspace and the other IdPs WorkOS supports.
Directory Sync
SCIM provisioning. People are added when they join an IdP group and removed when they leave it.
MFA
TOTP, enforced at sign-in through WorkOS.
Audit logs
Auth and security events, streamed to your SIEM through WorkOS Log Streams. Datadog and Splunk both work.
Compliance
HIPAA-aligned controls and GDPR and CCPA data-subject rights. A customer-specific BAA is available on request.
Database connectors
Postgres, MySQL, Snowflake, Azure SQL and Delta Sharing directly, plus 300+ more sources such as QuickBooks Online, Salesforce and HubSpot.
In Enterprise, admins can assign roles to members for fine-grained access control.
| Role | What they can do |
|---|---|
| owner | Everything an admin can do, plus changing other admins' roles. |
| admin | Workspace settings, members, integrations and billing. |
| member | Manage connectors, datasets, views and surprises. |
| chat | Chat only. The data pages stay hidden from this role. |
Email support
Response targets are set in the contract
Dedicated CSM
One person you talk to, from onboarding onward
Uptime commitment
Set and credited per the contract
Priority feature requests
Direct line to the product team