How to build approval workflows from the SCIM manager attribute

WorkOS Directory Sync now provides predefined manager_id, manager_name, and manager_email attributes, enabling applications to derive approval routing from identity-provider or HR-system data rather than maintaining separate manager assignments that can become outdated after reorganizations. These optional, normalized fields appear in a Directory User’s custom_attributes object, with manager_id recommended as the durable lookup key because names and email addresses may change; depending on the provider, it may match either a WorkOS Directory User ID or a provider-specific idp_id. Applications should validate joins, route only to active matched managers, and implement a fallback sequence of manager ID, manager email, and a configured organization-level approver so requests are never lost or automatically approved when manager data is unavailable. Enabling attributes can generate large batches of user-update events and may take up to an hour, so implementations should distinguish initial backfills from real manager changes, tolerate missing attributes before activation, and use regular API reconciliation because events may not capture every disappearance or unresolved manager. The guidance also addresses provider coverage differences, inactive or deleted managers, safeguards for multi-level chains such as cycle detection and depth limits, optional JWT exposure of one-hop attributes, and additional predefined fields including display_name, employee_number, organization, phone_numbers, and addresses.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.