01 · Before and afterThe pattern
// before: any successful SSO sign-in verifies the user everywhere
if (!user.isEmailVerified) await markVerified(user.id);
// after: only accounts that can't log in any other way
if (!user.isEmailVerified && !user.passwordHash) await markVerified(user.id);
// and: display URLs built with the same normaliser the server uses
const acs = new URL(serverUrl); acs.pathname = "/auth/saml/callback";02 · Run it on your appThe check
If one tenant's admin connects an SSO provider that asserts any email, can that unlock an account in another tenant?
If the honest answer is no or not sure, this is worth a look before it reaches production.