Everything in Pro, plus:
Single sign-on
SAML 2.0 and OIDC through the WorkOS Admin Portal. That covers Okta, Entra ID, Google Workspace and the other IdPs WorkOS supports.
Directory Sync
SCIM provisioning. People are added when they join an IdP group and removed when they leave it.
MFA
TOTP, enforced at sign-in through WorkOS.
Audit logs
Auth and security events, streamed to your SIEM through WorkOS Log Streams. Datadog and Splunk both work.
Compliance
HIPAA-aligned controls and GDPR and CCPA data-subject rights. A customer-specific BAA is available on request.
Database connectors
Postgres, MySQL, Snowflake, Azure SQL and Delta Sharing directly, and Fivetran for everything else.
In enterprise, admins can assign roles to members for fine-grained access control.
| Role | What they can do |
|---|---|
| owner | Everything an admin can do, plus changing other admins' roles. |
| admin | Workspace settings, members, integrations and billing. |
| member | Manage connectors, datasets, views and surprises. |
| chat | Chat only, with no access to the data pages. |
Email support
Response targets are set in the contract
Dedicated CSM
One person you talk to, from onboarding onward
Uptime commitment
Set and credited per the contract
Priority feature requests
Direct line to the product team