---
title: "May updates"
description: "New this month: MCP Authorization, update user emails, SAML custom attributes, & more"
url: https://workos.com/blog/may-2025-updates
published: "Jun 02, 2025"
---

# May updates

**MCP Authorization with AuthKit**

![](https://cdn.prod.website-files.com/621f84dc15b5ed16dc85a18a/68363b137567e4c61d2f5349_1%20MCP%20Authorization%20with%20AuthKit%201690x888.webp)

As previewed during [MCP Night](https://youtu.be/6UI5ZPuw_Pw)—a night of live demos, discussions, and community building—AuthKit now supports acting as an OAuth 2.0–compatible authorization server for MCP servers, based on the latest MCP protocol specification. This enables fine-grained authorization for agentic applications. The feature is currently in preview—contact [WorkOS Support](mailto:support@workos.com) to request access. In the meantime, [check out the documentation](https://workos.com/docs/user-management/mcp).

[Try a live demo at mcp.shop →](https://mcp.shop/)

---

**Support for Changing Email Addresses**

![](https://cdn.prod.website-files.com/621f84dc15b5ed16dc85a18a/683a153bdc3876457c75d851_email.webp)

It's now possible to update a user’s email address via the Update User API or directly in the Dashboard—helping teams handle common scenarios like email migrations or domain changes more smoothly. When an email is changed:

- The new email becomes unverified.
- OAuth identities that no longer match the updated email are unlinked.
- Email changes are blocked for users managed via SSO or SCIM.

[Learn how to update user emails →](https://workos.com/docs/reference/user-management/user/update)

---

**SAML Custom Attributes**

![](https://cdn.prod.website-files.com/621f84dc15b5ed16dc85a18a/683639f373454f4ed580c29f_SAML%20custom%20attributes%201690x888.webp)

Custom attributes now support mapping from SAML responses during SSO. This enables fragmented identity provider configurations to be unified under a consistent schema within the WorkOS SSO Profile.

[Learn more about SAML attribute mapping →](https://workos.com/docs/sso/attributes)

---

**FGA Policy Helpers**

![](https://cdn.prod.website-files.com/621f84dc15b5ed16dc85a18a/681d3a2f4915018255686fb1_FGA%20Policy%20Helpers%201690x888.webp)

WorkOS FGA now supports two special context variables—`check_ctx` and `warrant_ctx`—along with a new `get_metadata` helper. These additions make it easier to write dynamic, context-aware policies by:

- Accessing details about the current check using `check_ctx`.
- Referencing matched warrant attributes with `warrant_ctx`.
- Fetching resource metadata directly within policies using `get_metadata`, without needing to pass it manually.

[View the FGA documentation for details →](https://workos.com/docs/fga/policies/advanced-usage/injected-context)

---

**Domain Verification: Improved UX, Setup Notifications, Easier Debugging**

![](https://cdn.prod.website-files.com/621f84dc15b5ed16dc85a18a/683dd93f19b22f26430962d2_Domain%20Verification%20Improvements.webp)

The Admin Portal now displays clearer guidance for domain verification during SSO setup. A new UI-level notification informs users when domain verification is required before configuring SAML or OIDC connections. If no verified domains exist, an inline warning appears during setup to prompt verification before continuing. These updates help prevent misconfigurations and reduce support requests.

[See how domain verification works →](https://workos.com/docs/domain-verification)

---

**More featured content**

- [MCP Night 2025: When the AI infra community overflowed the Exploratorium in San Francisco](https://workos.com/blog/mcpnight-2025-in-san-francisco)
- [What is free trial abuse — and how can you stop it?](https://workos.com/blog/what-is-free-trial-abuse)
- [How MCP servers work: Components, logic, and architecture](https://workos.com/blog/how-mcp-servers-work)