diff --git a/.changeset/public-parts-chew.md b/.changeset/public-parts-chew.md
new file mode 100644
index 00000000000..761ec1d47c6
--- /dev/null
+++ b/.changeset/public-parts-chew.md
@@ -0,0 +1,8 @@
+---
+'@clerk/localizations': patch
+'@clerk/clerk-js': patch
+'@clerk/shared': patch
+'@clerk/ui': patch
+---
+
+Add support for custom SAML provider in `<ConfigureSSO />`
diff --git a/packages/localizations/src/en-US.ts b/packages/localizations/src/en-US.ts
index 2c53f0070d1..2435fe52c8a 100644
--- a/packages/localizations/src/en-US.ts
+++ b/packages/localizations/src/en-US.ts
@@ -379,9 +379,9 @@ export const enUS: LocalizationResource = {
         },
       },
       samlOkta: {
-        title: 'Configure Okta Workforce',
-        subtitle: 'Create a new enterprise application in your Okta Dashboard',
+        headerTitle: 'Configure Okta Workforce',
         createApp: {
+          headerSubtitle: 'Create a new enterprise application in your Okta Dashboard',
           title: 'Create a new enterprise application in Okta',
           step1: 'Sign in to Okta and go to <bold>Admin → Applications.</bold>',
           step2: 'Click <bold>Create App Integration.</bold>',
@@ -402,6 +402,7 @@ export const enUS: LocalizationResource = {
           step2: 'Complete the form with any comments and select <bold>Finish</bold>.',
         },
         configureAttributes: {
+          headerSubtitle: 'Map users attributes from Okta to Clerk',
           step1: 'In the Okta dashboard, find the <bold>Attribute Statements</bold> section.',
           step2:
             'Select <bold>Add Expression</bold> for each attribute, and enter the following name and expression pairs:',
@@ -422,6 +423,7 @@ export const enUS: LocalizationResource = {
           },
         },
         assignUsers: {
+          headerSubtitle: 'Assign users to the enterprise app',
           title: 'Assign selected user or group in Okta',
           paragraph: 'You need to assign users or groups to your enterprise app before they can use it to sign in.',
           step1: 'In the Okta dashboard, select the <bold>Assignments</bold> tab.',
@@ -432,6 +434,7 @@ export const enUS: LocalizationResource = {
           step5: 'Select the <bold>Done</bold> button to complete the assignment.',
         },
         metadataUrl: {
+          headerSubtitle: 'Configure identity provider metadata',
           label: 'Metadata URL',
           placeholder: 'Paste URL here...',
           description: 'In your Okta SAML app, go to the Sign On tab and retrieve the metadata URL. Paste it below.',
@@ -463,6 +466,57 @@ export const enUS: LocalizationResource = {
           },
         },
       },
+      samlCustom: {
+        headerTitle: 'Configure your identity provider (IdP)',
+        createApp: {
+          headerSubtitle:
+            'Register Clerk as a service provider in your IdP, then add your identity provider configuration.',
+          title: 'Create a SAML application on your identity provider',
+          subtitle:
+            'In your identity provider’s admin dashboard, create a new SAML 2.0 application and use the following service provider details:',
+        },
+        configureAttributes: {
+          headerSubtitle: 'Map user attributes from your identity provider to Clerk.',
+          title: 'We expect your SAML responses to have the following specific attributes:',
+        },
+        assignUsers: {
+          headerSubtitle: 'Assign users to the enterprise app',
+          title: 'Assign selected user or group',
+          paragraph: 'You need to assign users or groups to your enterprise app before they can use it to sign in.',
+        },
+        metadataUrl: {
+          headerSubtitle: 'Configure identity provider metadata',
+          label: 'Metadata URL',
+          placeholder: 'Paste URL here...',
+          description: 'In your enterprise app, retrieve the metadata URL. Paste it below.',
+        },
+        modes: {
+          ariaLabel: 'Configuration mode',
+          metadataUrl: 'Add via metadata',
+          manual: 'Configure manually',
+        },
+        submitSamlConfig: {
+          title: 'Fill in your SAML application details',
+        },
+        manual: {
+          description: 'In your SAML app, retrieve these values.',
+          signOnUrl: {
+            label: 'Sign on URL',
+            placeholder: 'Paste URL here...',
+          },
+          issuer: {
+            label: 'Issuer',
+            placeholder: 'Paste URL here...',
+          },
+          signingCertificate: {
+            label: 'Signing certificate',
+            uploadFile: 'Upload file',
+            replaceFile: 'Replace file',
+            removeFile: 'Remove file',
+            fileUploaded: 'File uploaded',
+          },
+        },
+      },
     },
   },
   createOrganization: {
diff --git a/packages/shared/src/types/localization.ts b/packages/shared/src/types/localization.ts
index 05d9a743102..6c0352c4a68 100644
--- a/packages/shared/src/types/localization.ts
+++ b/packages/shared/src/types/localization.ts
@@ -1436,9 +1436,9 @@ export type __internal_LocalizationResource = {
         };
       };
       samlOkta: {
-        title: LocalizationValue;
-        subtitle: LocalizationValue;
+        headerTitle: LocalizationValue;
         createApp: {
+          headerSubtitle: LocalizationValue;
           title: LocalizationValue;
           step1: LocalizationValue;
           step2: LocalizationValue;
@@ -1457,6 +1457,7 @@ export type __internal_LocalizationResource = {
           step2: LocalizationValue;
         };
         configureAttributes: {
+          headerSubtitle: LocalizationValue;
           step1: LocalizationValue;
           step2: LocalizationValue;
           pairs: {
@@ -1476,6 +1477,7 @@ export type __internal_LocalizationResource = {
           };
         };
         assignUsers: {
+          headerSubtitle: LocalizationValue;
           title: LocalizationValue;
           paragraph: LocalizationValue;
           step1: LocalizationValue;
@@ -1485,6 +1487,56 @@ export type __internal_LocalizationResource = {
           step5: LocalizationValue;
         };
         metadataUrl: {
+          headerSubtitle: LocalizationValue;
+          label: LocalizationValue;
+          placeholder: LocalizationValue;
+          description: LocalizationValue;
+        };
+        modes: {
+          ariaLabel: LocalizationValue;
+          metadataUrl: LocalizationValue;
+          manual: LocalizationValue;
+        };
+        submitSamlConfig: {
+          title: LocalizationValue;
+        };
+        manual: {
+          description: LocalizationValue;
+          signOnUrl: {
+            label: LocalizationValue;
+            placeholder: LocalizationValue;
+          };
+          issuer: {
+            label: LocalizationValue;
+            placeholder: LocalizationValue;
+          };
+          signingCertificate: {
+            label: LocalizationValue;
+            uploadFile: LocalizationValue;
+            replaceFile: LocalizationValue;
+            removeFile: LocalizationValue;
+            fileUploaded: LocalizationValue;
+          };
+        };
+      };
+      samlCustom: {
+        headerTitle: LocalizationValue;
+        createApp: {
+          headerSubtitle: LocalizationValue;
+          title: LocalizationValue;
+          subtitle: LocalizationValue;
+        };
+        configureAttributes: {
+          headerSubtitle: LocalizationValue;
+          title: LocalizationValue;
+        };
+        assignUsers: {
+          headerSubtitle: LocalizationValue;
+          title: LocalizationValue;
+          paragraph: LocalizationValue;
+        };
+        metadataUrl: {
+          headerSubtitle: LocalizationValue;
           label: LocalizationValue;
           placeholder: LocalizationValue;
           description: LocalizationValue;
diff --git a/packages/ui/src/components/ConfigureSSO/ConfigureSSO.tsx b/packages/ui/src/components/ConfigureSSO/ConfigureSSO.tsx
index e366df1078f..7a0afd6c7b7 100644
--- a/packages/ui/src/components/ConfigureSSO/ConfigureSSO.tsx
+++ b/packages/ui/src/components/ConfigureSSO/ConfigureSSO.tsx
@@ -1,11 +1,15 @@
-import { __internal_useUserEnterpriseConnections, useSession } from '@clerk/shared/react';
-import type { __experimental_ConfigureSSOProps } from '@clerk/shared/types';
+import {
+  __internal_useEnterpriseConnectionTestRuns,
+  __internal_useUserEnterpriseConnections,
+  useSession,
+} from '@clerk/shared/react';
+import type { __experimental_ConfigureSSOProps, EnterpriseConnectionResource } from '@clerk/shared/types';
 import React from 'react';
 
 import { useProtect } from '@/common';
 import { withCoreUserGuard } from '@/contexts';
 import { Col, descriptors, Flex, Flow, Heading, Icon, localizationKeys, Text } from '@/customizables';
-import { withCardStateProvider } from '@/elements/contexts';
+import { useCardState, withCardStateProvider } from '@/elements/contexts';
 import { ProfileCard } from '@/elements/ProfileCard';
 import { ExclamationTriangle } from '@/icons';
 import { Route, Switch } from '@/router';
@@ -16,7 +20,7 @@ import { ConfigureSSONavbar } from './ConfigureSSONavbar';
 import { ConfigureSSOSkeleton } from './ConfigureSSOSkeleton';
 import { ProfileCardFooter, ProfileCardHeader } from './elements/ProfileCard';
 import { Step } from './elements/Step';
-import { Wizard } from './elements/Wizard';
+import { useWizard, Wizard } from './elements/Wizard';
 import { ConfigureStep, ConfirmationStep, SelectProviderStep, TestConfigurationStep, VerifyDomainStep } from './steps';
 
 const ConfigureSSOInternal = () => {
@@ -64,19 +68,31 @@ const AuthenticatedContent = withCoreUserGuard(() => {
 });
 
 const ConfigureSSOCardContent = ({ contentRef }: { contentRef: React.RefObject<HTMLDivElement> }) => {
-  const { data: enterpriseConnections, isLoading } = __internal_useUserEnterpriseConnections({ enabled: true });
-
+  const {
+    data: enterpriseConnections,
+    isLoading: isLoadingEnterpriseConnections,
+    createEnterpriseConnection,
+    updateEnterpriseConnection,
+    deleteEnterpriseConnection,
+  } = __internal_useUserEnterpriseConnections({ enabled: true });
   // Currently FAPI only supports one enterprise connection per user
   const enterpriseConnection = enterpriseConnections?.[0];
 
-  if (isLoading && !enterpriseConnection) {
+  const { hasSuccessfulTestRun, isLoading: isLoadingTestRuns } = useHasSuccessfulTestRun(enterpriseConnection);
+
+  const isLoading = isLoadingEnterpriseConnections || isLoadingTestRuns;
+  if (isLoading) {
     return <ConfigureSSOSkeleton />;
   }
 
   return (
     <ConfigureSSOProvider
+      hasSuccessfulTestRun={hasSuccessfulTestRun}
       enterpriseConnection={enterpriseConnection}
       contentRef={contentRef}
+      createEnterpriseConnection={createEnterpriseConnection}
+      updateEnterpriseConnection={updateEnterpriseConnection}
+      deleteEnterpriseConnection={deleteEnterpriseConnection}
     >
       <ConfigureSSOSteps />
     </ConfigureSSOProvider>
@@ -88,6 +104,7 @@ const ConfigureSSOSteps = () => {
 
   return (
     <Wizard initialStepId={initialStepId}>
+      <ResetCardErrorOnStepChange />
       <ConfigureSSOHeader />
 
       <Wizard.Step id='select-provider'>
@@ -183,5 +200,45 @@ const MissingManageEnterpriseConnectionsPermission = () => (
   </>
 );
 
+/**
+ * Sentinel component rendered inside `<Wizard>`
+ *
+ * Clears any card-level error whenever the active step transitions, so a stale failure from one step
+ * doesn't leak into the next
+ */
+const ResetCardErrorOnStepChange = (): null => {
+  const { currentStep } = useWizard();
+  const card = useCardState();
+  const previousStepIdRef = React.useRef(currentStep?.id);
+
+  React.useEffect(() => {
+    if (previousStepIdRef.current === currentStep?.id) {
+      return;
+    }
+
+    previousStepIdRef.current = currentStep?.id;
+    card.setError(undefined);
+  }, [currentStep?.id, card]);
+
+  return null;
+};
+
+/**
+ * Fetches a single successful test run for the given connection on mount
+ */
+const useHasSuccessfulTestRun = (
+  enterpriseConnection: EnterpriseConnectionResource | undefined,
+): { hasSuccessfulTestRun: boolean; isLoading: boolean } => {
+  const { data: successfulTestRuns, isLoading } = __internal_useEnterpriseConnectionTestRuns({
+    enterpriseConnectionId: enterpriseConnection?.id ?? null,
+    params: { initialPage: 1, pageSize: 1, status: ['success'] },
+  });
+
+  return {
+    hasSuccessfulTestRun: (successfulTestRuns?.length ?? 0) > 0,
+    isLoading,
+  };
+};
+
 export const ConfigureSSO: React.ComponentType<__experimental_ConfigureSSOProps> =
   withCardStateProvider(ConfigureSSOInternal);
diff --git a/packages/ui/src/components/ConfigureSSO/ConfigureSSOContext.tsx b/packages/ui/src/components/ConfigureSSO/ConfigureSSOContext.tsx
index db6ac7dd9e9..51c217f17a3 100644
--- a/packages/ui/src/components/ConfigureSSO/ConfigureSSOContext.tsx
+++ b/packages/ui/src/components/ConfigureSSO/ConfigureSSOContext.tsx
@@ -1,5 +1,14 @@
-import type { EnterpriseConnectionResource } from '@clerk/shared/types';
-import React, { type PropsWithChildren } from 'react';
+import type { UseUserEnterpriseConnectionsReturn } from '@clerk/shared/react/index';
+import { useSession, useUser } from '@clerk/shared/react/index';
+import type {
+  EmailAddressResource,
+  EnterpriseConnectionResource,
+  SignedInSessionResource,
+  UserResource,
+} from '@clerk/shared/types';
+import React, { type PropsWithChildren, useCallback } from 'react';
+
+import { useCardState } from '@/elements/contexts';
 
 import { deriveInitialStep } from './deriveInitialStep';
 import type { ProviderType, WizardStepId } from './types';
@@ -28,11 +37,32 @@ export interface ConfigureSSOData {
    * Ref to the scrollable content container of the wizard.
    */
   contentRef: React.RefObject<HTMLDivElement>;
+  /**
+   * Creates a new enterprise connection
+   */
+  createEnterpriseConnection: (provider: ProviderType, primaryEmailAddress?: EmailAddressResource) => Promise<void>;
+  /**
+   * Updates an existing enterprise connection
+   */
+  updateEnterpriseConnection: UseUserEnterpriseConnectionsReturn['updateEnterpriseConnection'];
+  /**
+   * Deletes an enterprise connection
+   */
+  deleteEnterpriseConnection: UseUserEnterpriseConnectionsReturn['deleteEnterpriseConnection'];
+  /**
+   * Determines if the user's domain is already wired to an enterprise connection that
+   * doesn't belong to the org they're currently configuring
+   */
+  isDomainTakenByOtherOrg: boolean;
 }
 
 interface ConfigureSSOProviderProps {
   enterpriseConnection: EnterpriseConnectionResource | undefined;
+  hasSuccessfulTestRun: boolean;
   contentRef: React.RefObject<HTMLDivElement>;
+  createEnterpriseConnection: UseUserEnterpriseConnectionsReturn['createEnterpriseConnection'];
+  updateEnterpriseConnection: UseUserEnterpriseConnectionsReturn['updateEnterpriseConnection'];
+  deleteEnterpriseConnection: UseUserEnterpriseConnectionsReturn['deleteEnterpriseConnection'];
 }
 
 const ConfigureSSOContext = React.createContext<ConfigureSSOData | null>(null);
@@ -40,24 +70,69 @@ ConfigureSSOContext.displayName = 'ConfigureSSOContext';
 
 export const ConfigureSSOProvider = ({
   enterpriseConnection,
+  hasSuccessfulTestRun,
   contentRef,
+  createEnterpriseConnection: createEnterpriseConnectionApi,
+  updateEnterpriseConnection,
+  deleteEnterpriseConnection,
   children,
 }: PropsWithChildren<ConfigureSSOProviderProps>): JSX.Element => {
   const [provider, setProvider] = React.useState<ProviderType | undefined>(
     enterpriseConnection?.provider as ProviderType,
   );
+  const { session } = useSession();
+  const { user } = useUser();
+  const card = useCardState();
+
+  const isDomainTakenByOtherOrg = checkDomainTakenByOtherOrg(user, session, enterpriseConnection);
+  const initialStepId = deriveInitialStep(enterpriseConnection, { isDomainTakenByOtherOrg, hasSuccessfulTestRun });
+
+  const createEnterpriseConnection = useCallback(
+    async (provider: ProviderType, primaryEmailAddress?: EmailAddressResource): Promise<void> => {
+      const emailDomain = primaryEmailAddress?.emailAddress.split('@')[1];
+      const organizationId = session?.lastActiveOrganizationId ?? null;
 
-  const initialStepId = deriveInitialStep(enterpriseConnection);
+      if (!emailDomain) {
+        return;
+      }
+
+      card.setLoading();
+
+      try {
+        await createEnterpriseConnectionApi({
+          provider,
+          name: emailDomain,
+          organizationId,
+        });
+      } finally {
+        card.setIdle();
+      }
+    },
+    [card, session, createEnterpriseConnectionApi],
+  );
 
   const value = React.useMemo<ConfigureSSOData>(
     () => ({
+      provider,
+      contentRef,
+      setProvider,
       initialStepId,
       enterpriseConnection,
+      isDomainTakenByOtherOrg,
+      createEnterpriseConnection,
+      updateEnterpriseConnection,
+      deleteEnterpriseConnection,
+    }),
+    [
       provider,
-      setProvider,
       contentRef,
-    }),
-    [initialStepId, enterpriseConnection, provider, contentRef],
+      initialStepId,
+      enterpriseConnection,
+      createEnterpriseConnection,
+      updateEnterpriseConnection,
+      deleteEnterpriseConnection,
+      isDomainTakenByOtherOrg,
+    ],
   );
 
   return <ConfigureSSOContext.Provider value={value}>{children}</ConfigureSSOContext.Provider>;
@@ -70,3 +145,20 @@ export const useConfigureSSO = (): ConfigureSSOData => {
   }
   return ctx;
 };
+
+/**
+ * Determines if the user's domain is already wired to an enterprise connection that
+ * doesn't belong to the org they're currently configuring
+ */
+const checkDomainTakenByOtherOrg = (
+  user: UserResource | null | undefined,
+  session: SignedInSessionResource | null | undefined,
+  enterpriseConnection: EnterpriseConnectionResource | undefined,
+): boolean => {
+  const emailToVerify =
+    user?.primaryEmailAddress ?? user?.emailAddresses?.find(e => e.verification.status !== 'verified');
+  const isVerified = emailToVerify?.verification.status === 'verified';
+  const activeOrganizationId = session?.lastActiveOrganizationId ?? null;
+
+  return Boolean(isVerified && enterpriseConnection && enterpriseConnection.organizationId !== activeOrganizationId);
+};
diff --git a/packages/ui/src/components/ConfigureSSO/__tests__/deriveInitialStep.test.ts b/packages/ui/src/components/ConfigureSSO/__tests__/deriveInitialStep.test.ts
index 2f67bbcc603..c077e3395d7 100644
--- a/packages/ui/src/components/ConfigureSSO/__tests__/deriveInitialStep.test.ts
+++ b/packages/ui/src/components/ConfigureSSO/__tests__/deriveInitialStep.test.ts
@@ -1,4 +1,4 @@
-import type { EnterpriseConnectionResource } from '@clerk/shared/types';
+import type { EnterpriseConnectionResource, SamlAccountConnectionResource } from '@clerk/shared/types';
 import { describe, expect, it } from 'vitest';
 
 import { deriveInitialStep } from '../deriveInitialStep';
@@ -25,65 +25,83 @@ const makeConnection = (overrides: Partial<EnterpriseConnectionResource> = {}):
     ...overrides,
   }) as EnterpriseConnectionResource;
 
+const makeSamlConnection = (overrides: Partial<SamlAccountConnectionResource> = {}): SamlAccountConnectionResource =>
+  ({
+    id: 'saml_1',
+    name: 'acme.com',
+    active: false,
+    idpEntityId: '',
+    idpSsoUrl: '',
+    idpCertificate: '',
+    idpMetadataUrl: '',
+    idpMetadata: '',
+    acsUrl: 'https://clerk.example.com/acs',
+    spEntityId: 'https://clerk.example.com',
+    spMetadataUrl: 'https://clerk.example.com/sp-metadata',
+    allowSubdomains: false,
+    allowIdpInitiated: false,
+    forceAuthn: false,
+    ...overrides,
+  }) as SamlAccountConnectionResource;
+
+const defaultOptions = { isDomainTakenByOtherOrg: false, hasSuccessfulTestRun: false };
+
 describe('deriveInitialStep', () => {
-  const cases: Array<{ name: string; input: EnterpriseConnectionResource | undefined; expected: WizardStepId }> = [
+  const cases: Array<{
+    name: string;
+    input: EnterpriseConnectionResource | undefined;
+    options?: Partial<typeof defaultOptions>;
+    expected: WizardStepId;
+  }> = [
+    {
+      name: 'domain taken by other org → verify-domain',
+      input: makeConnection(),
+      options: { isDomainTakenByOtherOrg: true },
+      expected: 'verify-domain',
+    },
     {
       name: 'no connection → select-provider',
       input: undefined,
       expected: 'select-provider',
     },
     {
-      name: 'connection without samlConnection → configure',
-      input: makeConnection({ samlConnection: null }),
+      name: 'active connection → confirmation',
+      input: makeConnection({ active: true, samlConnection: makeSamlConnection() }),
+      expected: 'confirmation',
+    },
+    {
+      name: 'connection with empty SAML IdP config → configure',
+      input: makeConnection({ samlConnection: makeSamlConnection() }),
       expected: 'configure',
     },
     {
-      name: 'connection with empty samlConnection.idpSsoUrl → configure',
+      name: 'configured connection without successful test run → test',
       input: makeConnection({
-        samlConnection: {
-          id: 'saml_1',
-          name: 'acme.com',
-          active: false,
-          idpEntityId: '',
-          idpSsoUrl: '',
-          idpCertificate: '',
-          idpMetadataUrl: '',
-          idpMetadata: '',
-          acsUrl: 'https://clerk.example.com/acs',
-          spEntityId: 'https://clerk.example.com',
-          spMetadataUrl: 'https://clerk.example.com/sp-metadata',
-          allowSubdomains: false,
-          allowIdpInitiated: false,
-          forceAuthn: false,
-        },
+        samlConnection: makeSamlConnection({
+          idpEntityId: 'https://idp.example.com/entity',
+          idpSsoUrl: 'https://idp.example.com/sso',
+          idpCertificate: 'CERT',
+          idpMetadataUrl: 'https://idp.example.com/metadata',
+        }),
       }),
-      expected: 'configure',
+      expected: 'test',
     },
     {
-      name: 'connection with samlConnection.idpSsoUrl populated → confirmation',
+      name: 'configured connection with successful test run → confirmation',
       input: makeConnection({
-        samlConnection: {
-          id: 'saml_1',
-          name: 'acme.com',
-          active: true,
+        samlConnection: makeSamlConnection({
           idpEntityId: 'https://idp.example.com/entity',
           idpSsoUrl: 'https://idp.example.com/sso',
           idpCertificate: 'CERT',
           idpMetadataUrl: 'https://idp.example.com/metadata',
-          idpMetadata: '',
-          acsUrl: 'https://clerk.example.com/acs',
-          spEntityId: 'https://clerk.example.com',
-          spMetadataUrl: 'https://clerk.example.com/sp-metadata',
-          allowSubdomains: false,
-          allowIdpInitiated: false,
-          forceAuthn: false,
-        },
+        }),
       }),
+      options: { hasSuccessfulTestRun: true },
       expected: 'confirmation',
     },
   ];
 
-  it.each(cases)('$name', ({ input, expected }) => {
-    expect(deriveInitialStep(input)).toBe(expected);
+  it.each(cases)('$name', ({ input, options, expected }) => {
+    expect(deriveInitialStep(input, { ...defaultOptions, ...options })).toBe(expected);
   });
 });
diff --git a/packages/ui/src/components/ConfigureSSO/deriveInitialStep.ts b/packages/ui/src/components/ConfigureSSO/deriveInitialStep.ts
index fb19fee3138..4a403486be4 100644
--- a/packages/ui/src/components/ConfigureSSO/deriveInitialStep.ts
+++ b/packages/ui/src/components/ConfigureSSO/deriveInitialStep.ts
@@ -5,21 +5,47 @@ import type { WizardStepId } from './types';
 /**
  * Decides where the ConfigureSSO wizard should mount on (re)load based on
  * the current state of the user's enterprise connection.
- *
- * No connection → `select-provider`
- * Connection without SAML IdP metadata → `configure`
- * Connection with SAML IdP metadata → `confirmation`
- *
- * The `test` step is intentionally absent — we can't derive a "last test
- * passed" signal synchronously from the resource. Users can re-test from
- * Confirmation.
  */
-export const deriveInitialStep = (connection: EnterpriseConnectionResource | undefined): WizardStepId => {
-  if (!connection) {
+export const deriveInitialStep = (
+  enterpriseConnection: EnterpriseConnectionResource | undefined,
+  options: { isDomainTakenByOtherOrg: boolean; hasSuccessfulTestRun: boolean },
+): WizardStepId => {
+  const { isDomainTakenByOtherOrg, hasSuccessfulTestRun } = options;
+
+  // Go to the verify domain step in order to display warning
+  if (isDomainTakenByOtherOrg) {
+    return 'verify-domain';
+  }
+
+  // If no initial connection, go to the select provider step
+  if (!enterpriseConnection) {
     return 'select-provider';
   }
-  if (!connection.samlConnection?.idpSsoUrl) {
+
+  // Connection is enabled, go to the confirmation step
+  const isEnabled = enterpriseConnection?.active;
+  if (isEnabled) {
+    return 'confirmation';
+  }
+
+  const hasMinimumIdPConfiguration = checkHasMinimumIdPConfiguration(enterpriseConnection);
+
+  // If the connection hasn't finished configuring it, go to the configure step
+  // Connection exists, but is not enabled and hasn't finished configuring it
+  if (!hasMinimumIdPConfiguration) {
     return 'configure';
   }
+
+  // If the connection hasn't been tested, go to the test step
+  if (!hasSuccessfulTestRun) {
+    return 'test';
+  }
+
+  // Connection is disabled but has been tested and configured
   return 'confirmation';
 };
+
+// TODO - Update to support OpenID Connect
+const checkHasMinimumIdPConfiguration = (connection: EnterpriseConnectionResource): boolean => {
+  return Boolean(connection.samlConnection?.idpSsoUrl && connection.samlConnection?.idpEntityId);
+};
diff --git a/packages/ui/src/components/ConfigureSSO/steps/ConfigureStep.tsx b/packages/ui/src/components/ConfigureSSO/steps/ConfigureStep.tsx
index c9c93571978..d5c126febec 100644
--- a/packages/ui/src/components/ConfigureSSO/steps/ConfigureStep.tsx
+++ b/packages/ui/src/components/ConfigureSSO/steps/ConfigureStep.tsx
@@ -1,6 +1,7 @@
-import { __internal_useUserEnterpriseConnections, useReverification } from '@clerk/shared/react';
+import { isClerkAPIResponseError } from '@clerk/shared/error';
+import { useReverification } from '@clerk/shared/react';
 import type { FieldId, UpdateMeEnterpriseConnectionParams } from '@clerk/shared/types';
-import React from 'react';
+import React, { type JSX } from 'react';
 
 import {
   Badge,
@@ -35,8 +36,11 @@ import { handleError } from '@/utils/errorHandler';
 import { useConfigureSSO } from '../ConfigureSSOContext';
 import { Step } from '../elements/Step';
 import { useWizard, Wizard } from '../elements/Wizard';
+import { useConfigureStepTranslations } from './configureStepTranslations';
 
 export const ConfigureStep = (): JSX.Element => {
+  const { key } = useConfigureStepTranslations();
+
   return (
     <Flow.Part part='configureCreateApp'>
       <Step
@@ -44,26 +48,47 @@ export const ConfigureStep = (): JSX.Element => {
         elementId={descriptors.configureSSOStep.setId('configure')}
       >
         <Wizard>
-          <Step.Header
-            title={localizationKeys('configureSSO.configureStep.samlOkta.title')}
-            description={localizationKeys('configureSSO.configureStep.samlOkta.subtitle')}
-          >
-            <InnerStepCounter />
-          </Step.Header>
-
           <Wizard.Step id='create-app'>
+            <Step.Header
+              title={localizationKeys(key('headerTitle'))}
+              description={localizationKeys(key('createApp.headerSubtitle'))}
+            >
+              <InnerStepCounter />
+            </Step.Header>
+
             <CreateAppSubStep />
           </Wizard.Step>
 
           <Wizard.Step id='configure-attributes'>
+            <Step.Header
+              title={localizationKeys(key('headerTitle'))}
+              description={localizationKeys(key('configureAttributes.headerSubtitle'))}
+            >
+              <InnerStepCounter />
+            </Step.Header>
+
             <ConfigureAttributesSubStep />
           </Wizard.Step>
 
           <Wizard.Step id='assign-users'>
+            <Step.Header
+              title={localizationKeys(key('headerTitle'))}
+              description={localizationKeys(key('assignUsers.headerSubtitle'))}
+            >
+              <InnerStepCounter />
+            </Step.Header>
+
             <AssignUsersSubStep />
           </Wizard.Step>
 
           <Wizard.Step id='submit-saml-config'>
+            <Step.Header
+              title={localizationKeys(key('headerTitle'))}
+              description={localizationKeys(key('metadataUrl.headerSubtitle'))}
+            >
+              <InnerStepCounter />
+            </Step.Header>
+
             <SubmitSamlConfigSubStep />
           </Wizard.Step>
         </Wizard>
@@ -123,7 +148,8 @@ const ATTRIBUTE_PAIRS = [
 
 export const CreateAppSubStep = (): JSX.Element => {
   const { goNext, goPrev, isFirstStep, isLastStep } = useWizard();
-  const { enterpriseConnection } = useConfigureSSO();
+  const { enterpriseConnection, provider } = useConfigureSSO();
+  const { key } = useConfigureStepTranslations();
 
   const acsUrl = enterpriseConnection?.samlConnection?.acsUrl ?? '';
   const spEntityId = enterpriseConnection?.samlConnection?.spEntityId ?? '';
@@ -147,62 +173,21 @@ export const CreateAppSubStep = (): JSX.Element => {
             <Heading
               as='h3'
               textVariant='subtitle'
-              localizationKey={localizationKeys('configureSSO.configureStep.samlOkta.createApp.title')}
+              localizationKey={localizationKeys(key('createApp.title'))}
             />
-            <Col
-              as='ul'
-              sx={theme => ({
-                gap: theme.space.$1x5,
-                margin: 0,
-                paddingInlineStart: theme.space.$5,
-                listStyleType: 'disc',
-              })}
-            >
-              <Text
-                as='li'
-                colorScheme='secondary'
-                localizationKey={localizationKeys('configureSSO.configureStep.samlOkta.createApp.step1')}
-              />
-              <Text
-                as='li'
-                colorScheme='secondary'
-                localizationKey={localizationKeys('configureSSO.configureStep.samlOkta.createApp.step2')}
-              />
-              <Text
-                as='li'
-                colorScheme='secondary'
-                localizationKey={localizationKeys('configureSSO.configureStep.samlOkta.createApp.step3')}
-              />
-              <Text
-                as='li'
-                colorScheme='secondary'
-                localizationKey={localizationKeys('configureSSO.configureStep.samlOkta.createApp.step4')}
-              />
+
+            {provider === 'saml_okta' && <OktaCreateAppStepContent />}
+
+            {provider === 'saml_custom' && (
               <Text
-                as='li'
+                as='p'
                 colorScheme='secondary'
-                localizationKey={localizationKeys('configureSSO.configureStep.samlOkta.createApp.step5')}
+                localizationKey={localizationKeys('configureSSO.configureStep.samlCustom.createApp.subtitle')}
               />
-            </Col>
+            )}
           </Col>
 
-          <Col sx={theme => ({ gap: theme.space.$1x5 })}>
-            <Heading
-              as='h3'
-              textVariant='subtitle'
-              localizationKey={localizationKeys('configureSSO.configureStep.samlOkta.serviceProvider.title')}
-            />
-            <Text
-              as='p'
-              colorScheme='secondary'
-              localizationKey={localizationKeys('configureSSO.configureStep.samlOkta.serviceProvider.paragraph1')}
-            />
-            <Text
-              as='p'
-              colorScheme='secondary'
-              localizationKey={localizationKeys('configureSSO.configureStep.samlOkta.serviceProvider.paragraph2')}
-            />
-          </Col>
+          {provider === 'saml_okta' && <OktaServiceProviderStepContent />}
 
           <Form.ControlRow elementId={acsUrlField.id}>
             <Form.CommonInputWrapper {...acsUrlField.props}>
@@ -226,33 +211,7 @@ export const CreateAppSubStep = (): JSX.Element => {
             </Form.CommonInputWrapper>
           </Form.ControlRow>
 
-          <Col sx={theme => ({ gap: theme.space.$1x5 })}>
-            <Heading
-              as='h3'
-              textVariant='subtitle'
-              localizationKey={localizationKeys('configureSSO.configureStep.samlOkta.completeSamlIntegration.title')}
-            />
-            <Col
-              as='ul'
-              sx={theme => ({
-                gap: theme.space.$1x5,
-                margin: 0,
-                paddingInlineStart: theme.space.$5,
-                listStyleType: 'disc',
-              })}
-            >
-              <Text
-                as='li'
-                colorScheme='secondary'
-                localizationKey={localizationKeys('configureSSO.configureStep.samlOkta.completeSamlIntegration.step1')}
-              />
-              <Text
-                as='li'
-                colorScheme='secondary'
-                localizationKey={localizationKeys('configureSSO.configureStep.samlOkta.completeSamlIntegration.step2')}
-              />
-            </Col>
-          </Col>
+          {provider === 'saml_okta' && <OktaCompleteSamlIntegrationStepContent />}
         </Step.Section>
       </Step.Body>
 
@@ -270,18 +229,117 @@ export const CreateAppSubStep = (): JSX.Element => {
   );
 };
 
+// TODO - Move IdP specific content to separate modules
+const OktaServiceProviderStepContent = (): JSX.Element => {
+  return (
+    <Col sx={theme => ({ gap: theme.space.$1x5 })}>
+      <Heading
+        as='h3'
+        textVariant='subtitle'
+        localizationKey={localizationKeys('configureSSO.configureStep.samlOkta.serviceProvider.title')}
+      />
+      <Text
+        as='p'
+        colorScheme='secondary'
+        localizationKey={localizationKeys('configureSSO.configureStep.samlOkta.serviceProvider.paragraph1')}
+      />
+      <Text
+        as='p'
+        colorScheme='secondary'
+        localizationKey={localizationKeys('configureSSO.configureStep.samlOkta.serviceProvider.paragraph2')}
+      />
+    </Col>
+  );
+};
+
+const OktaCreateAppStepContent = (): JSX.Element => {
+  return (
+    <Col
+      as='ul'
+      sx={theme => ({
+        gap: theme.space.$1x5,
+        margin: 0,
+        paddingInlineStart: theme.space.$5,
+        listStyleType: 'disc',
+      })}
+    >
+      <Text
+        as='li'
+        colorScheme='secondary'
+        localizationKey={localizationKeys('configureSSO.configureStep.samlOkta.createApp.step1')}
+      />
+      <Text
+        as='li'
+        colorScheme='secondary'
+        localizationKey={localizationKeys('configureSSO.configureStep.samlOkta.createApp.step2')}
+      />
+      <Text
+        as='li'
+        colorScheme='secondary'
+        localizationKey={localizationKeys('configureSSO.configureStep.samlOkta.createApp.step3')}
+      />
+      <Text
+        as='li'
+        colorScheme='secondary'
+        localizationKey={localizationKeys('configureSSO.configureStep.samlOkta.createApp.step4')}
+      />
+      <Text
+        as='li'
+        colorScheme='secondary'
+        localizationKey={localizationKeys('configureSSO.configureStep.samlOkta.createApp.step5')}
+      />
+    </Col>
+  );
+};
+
+const OktaCompleteSamlIntegrationStepContent = (): JSX.Element => {
+  return (
+    <Col sx={theme => ({ gap: theme.space.$1x5 })}>
+      <Heading
+        as='h3'
+        textVariant='subtitle'
+        localizationKey={localizationKeys('configureSSO.configureStep.samlOkta.completeSamlIntegration.title')}
+      />
+      <Col
+        as='ul'
+        sx={theme => ({
+          gap: theme.space.$1x5,
+          margin: 0,
+          paddingInlineStart: theme.space.$5,
+          listStyleType: 'disc',
+        })}
+      >
+        <Text
+          as='li'
+          colorScheme='secondary'
+          localizationKey={localizationKeys('configureSSO.configureStep.samlOkta.completeSamlIntegration.step1')}
+        />
+        <Text
+          as='li'
+          colorScheme='secondary'
+          localizationKey={localizationKeys('configureSSO.configureStep.samlOkta.completeSamlIntegration.step2')}
+        />
+      </Col>
+    </Col>
+  );
+};
+
 export const ConfigureAttributesSubStep = (): JSX.Element => {
   const { goNext, goPrev, isFirstStep, isLastStep } = useWizard();
 
+  const { provider } = useConfigureSSO();
+
   return (
     <>
       <Step.Body>
         <Step.Section sx={theme => ({ gap: theme.space.$3 })}>
-          <Heading
-            as='h3'
-            textVariant='subtitle'
-            localizationKey={localizationKeys('configureSSO.configureStep.attributeMapping.title')}
-          />
+          {provider === 'saml_custom' && (
+            <Heading
+              as='h3'
+              textVariant='subtitle'
+              localizationKey={localizationKeys('configureSSO.configureStep.samlCustom.configureAttributes.title')}
+            />
+          )}
 
           <Table
             sx={theme => ({
@@ -345,70 +403,7 @@ export const ConfigureAttributesSubStep = (): JSX.Element => {
             </Tbody>
           </Table>
 
-          <Text
-            as='p'
-            colorScheme='secondary'
-            localizationKey={localizationKeys('configureSSO.configureStep.attributeMapping.paragraph')}
-          />
-
-          <Col
-            as='ol'
-            sx={theme => ({
-              gap: theme.space.$1x5,
-              margin: 0,
-              paddingInlineStart: theme.space.$5,
-              listStyleType: 'decimal',
-            })}
-          >
-            <Text
-              as='li'
-              colorScheme='secondary'
-              localizationKey={localizationKeys('configureSSO.configureStep.samlOkta.configureAttributes.step1')}
-            />
-            <Text
-              as='li'
-              colorScheme='secondary'
-            >
-              <Text
-                as='span'
-                localizationKey={localizationKeys('configureSSO.configureStep.samlOkta.configureAttributes.step2')}
-              />
-              <Col
-                as='ul'
-                sx={theme => ({
-                  gap: theme.space.$1x5,
-                  margin: 0,
-                  marginTop: theme.space.$1x5,
-                  paddingInlineStart: theme.space.$5,
-                  listStyleType: '"- "',
-                })}
-              >
-                {ATTRIBUTE_PAIRS.map(pair => (
-                  <Text
-                    key={pair.id}
-                    as='li'
-                  >
-                    <Badge
-                      localizationKey={pair.name}
-                      sx={{ fontFamily: 'monospace' }}
-                    />
-
-                    <Text
-                      as='span'
-                      localizationKey={localizationKeys(
-                        'configureSSO.configureStep.samlOkta.configureAttributes.pairs.conjunction',
-                      )}
-                    />
-
-                    <Badge
-                      localizationKey={pair.expression}
-                      sx={{ fontFamily: 'monospace' }}
-                    />
-                  </Text>
-                ))}
-              </Col>
-            </Text>
-          </Col>
+          {provider === 'saml_okta' && <OktaConfigureAttributesStepContent />}
         </Step.Section>
       </Step.Body>
 
@@ -426,8 +421,112 @@ export const ConfigureAttributesSubStep = (): JSX.Element => {
   );
 };
 
+const OktaConfigureAttributesStepContent = (): JSX.Element => {
+  return (
+    <>
+      <Text
+        as='p'
+        colorScheme='secondary'
+        localizationKey={localizationKeys('configureSSO.configureStep.attributeMapping.paragraph')}
+      />
+
+      <Col
+        as='ol'
+        sx={theme => ({
+          gap: theme.space.$1x5,
+          margin: 0,
+          paddingInlineStart: theme.space.$5,
+          listStyleType: 'decimal',
+        })}
+      >
+        <Text
+          as='li'
+          colorScheme='secondary'
+          localizationKey={localizationKeys('configureSSO.configureStep.samlOkta.configureAttributes.step1')}
+        />
+        <Text
+          as='li'
+          colorScheme='secondary'
+        >
+          <Text
+            as='span'
+            localizationKey={localizationKeys('configureSSO.configureStep.samlOkta.configureAttributes.step2')}
+          />
+          <Col
+            as='ul'
+            sx={theme => ({
+              gap: theme.space.$1x5,
+              margin: 0,
+              marginTop: theme.space.$1x5,
+              paddingInlineStart: theme.space.$5,
+              listStyleType: '"- "',
+            })}
+          >
+            {ATTRIBUTE_PAIRS.map(pair => (
+              <Text
+                key={pair.id}
+                as='li'
+              >
+                <Badge
+                  localizationKey={pair.name}
+                  sx={{ fontFamily: 'monospace' }}
+                />
+
+                <Text
+                  as='span'
+                  localizationKey={localizationKeys(
+                    'configureSSO.configureStep.samlOkta.configureAttributes.pairs.conjunction',
+                  )}
+                />
+
+                <Badge
+                  localizationKey={pair.expression}
+                  sx={{ fontFamily: 'monospace' }}
+                />
+              </Text>
+            ))}
+          </Col>
+        </Text>
+      </Col>
+    </>
+  );
+};
+
 export const AssignUsersSubStep = (): JSX.Element => {
   const { goNext, goPrev, isFirstStep, isLastStep } = useWizard();
+  const { provider } = useConfigureSSO();
+
+  if (provider === 'saml_custom') {
+    return (
+      <>
+        <Step.Body>
+          <Step.Section sx={theme => ({ gap: theme.space.$3 })}>
+            <Heading
+              as='h3'
+              textVariant='subtitle'
+              localizationKey={localizationKeys('configureSSO.configureStep.samlCustom.assignUsers.title')}
+            />
+            <Text
+              as='p'
+              colorScheme='secondary'
+              localizationKey={localizationKeys('configureSSO.configureStep.samlCustom.assignUsers.paragraph')}
+            />
+          </Step.Section>
+        </Step.Body>
+
+        <Step.Footer>
+          <Step.Footer.Previous
+            onClick={() => goPrev()}
+            isDisabled={isFirstStep}
+          />
+          <Step.Footer.Continue
+            onClick={() => goNext()}
+            isDisabled={isLastStep}
+          />
+        </Step.Footer>
+      </>
+    );
+  }
 
   return (
     <>
@@ -500,8 +599,8 @@ export const SubmitSamlConfigSubStep = (): JSX.Element => {
   const card = useCardState();
   const { t } = useLocalizations();
   const { goNext, goPrev, isFirstStep } = useWizard();
-  const { enterpriseConnection } = useConfigureSSO();
-  const { updateEnterpriseConnection } = __internal_useUserEnterpriseConnections();
+  const { enterpriseConnection, updateEnterpriseConnection } = useConfigureSSO();
+  const { key } = useConfigureStepTranslations();
 
   const samlConnection = enterpriseConnection?.samlConnection;
   const hasExistingConfig = Boolean(
@@ -530,28 +629,28 @@ export const SubmitSamlConfigSubStep = (): JSX.Element => {
 
   const metadataUrlField = useFormControl('idpMetadataUrl', samlConnection?.idpMetadataUrl ?? '', {
     type: 'text',
-    label: localizationKeys('configureSSO.configureStep.samlOkta.metadataUrl.label'),
-    placeholder: localizationKeys('configureSSO.configureStep.samlOkta.metadataUrl.placeholder'),
+    label: localizationKeys(key('metadataUrl.label')),
+    placeholder: localizationKeys(key('metadataUrl.placeholder')),
     isRequired: true,
   });
 
   const signOnUrlField = useFormControl('idpSsoUrl', samlConnection?.idpSsoUrl ?? '', {
     type: 'text',
-    label: localizationKeys('configureSSO.configureStep.samlOkta.manual.signOnUrl.label'),
-    placeholder: localizationKeys('configureSSO.configureStep.samlOkta.manual.signOnUrl.placeholder'),
+    label: localizationKeys(key('manual.signOnUrl.label')),
+    placeholder: localizationKeys(key('manual.signOnUrl.placeholder')),
     isRequired: true,
   });
 
   const issuerField = useFormControl('idpEntityId', samlConnection?.idpEntityId ?? '', {
     type: 'text',
-    label: localizationKeys('configureSSO.configureStep.samlOkta.manual.issuer.label'),
-    placeholder: localizationKeys('configureSSO.configureStep.samlOkta.manual.issuer.placeholder'),
+    label: localizationKeys(key('manual.issuer.label')),
+    placeholder: localizationKeys(key('manual.issuer.placeholder')),
     isRequired: true,
   });
 
   const certFileField = useFormControl('idpCertificate', '', {
     type: 'text',
-    label: localizationKeys('configureSSO.configureStep.samlOkta.manual.signingCertificate.label'),
+    label: localizationKeys(key('manual.signingCertificate.label')),
     isRequired: true,
   });
 
@@ -588,12 +687,21 @@ export const SubmitSamlConfigSubStep = (): JSX.Element => {
 
         await updateConnection({ saml: samlPayload });
       }
+
       void goNext();
     } catch (err) {
-      if (mode === 'metadataUrl') {
-        handleError(err as Error, [metadataUrlField], card.setError);
-      } else {
-        handleError(err as Error, [signOnUrlField, issuerField, certFileField], card.setError);
+      const fields = mode === 'metadataUrl' ? [metadataUrlField] : [signOnUrlField, issuerField, certFileField];
+
+      handleError(err as Error, fields, card.setError);
+
+      if (isClerkAPIResponseError(err)) {
+        const unscopedSamlError = err.errors.find(e => e.code?.startsWith('saml_') && !e.meta?.paramName);
+
+        if (unscopedSamlError) {
+          const primaryField = mode === 'metadataUrl' ? metadataUrlField : signOnUrlField;
+          primaryField.setError(unscopedSamlError);
+          card.setError(undefined);
+        }
       }
     } finally {
       card.setIdle();
@@ -610,21 +718,24 @@ export const SubmitSamlConfigSubStep = (): JSX.Element => {
           <Heading
             as='h3'
             textVariant='subtitle'
-            localizationKey={localizationKeys('configureSSO.configureStep.samlOkta.submitSamlConfig.title')}
+            localizationKey={localizationKeys(key('submitSamlConfig.title'))}
           />
           <SegmentedControl.Root
-            aria-label={t(localizationKeys('configureSSO.configureStep.samlOkta.modes.ariaLabel'))}
+            aria-label={t(localizationKeys(key('modes.ariaLabel')))}
             value={mode}
-            onChange={value => setMode(value as 'metadataUrl' | 'manual')}
+            onChange={value => {
+              card.setError(undefined);
+              setMode(value as 'metadataUrl' | 'manual');
+            }}
             fullWidth
           >
             <SegmentedControl.Button
               value='metadataUrl'
-              text={localizationKeys('configureSSO.configureStep.samlOkta.modes.metadataUrl')}
+              text={localizationKeys(key('modes.metadataUrl'))}
             />
             <SegmentedControl.Button
               value='manual'
-              text={localizationKeys('configureSSO.configureStep.samlOkta.modes.manual')}
+              text={localizationKeys(key('modes.manual'))}
             />
           </SegmentedControl.Root>
 
@@ -674,12 +785,14 @@ type ManualEntryPanelProps = {
 };
 
 const MetadataUrlPanel = ({ field }: MetadataUrlPanelProps): JSX.Element => {
+  const { key } = useConfigureStepTranslations();
+
   return (
     <>
       <Text
         as='p'
         colorScheme='secondary'
-        localizationKey={localizationKeys('configureSSO.configureStep.samlOkta.metadataUrl.description')}
+        localizationKey={localizationKeys(key('metadataUrl.description'))}
       />
       <Form.ControlRow elementId={field.id}>
         <Form.PlainInput {...field.props} />
@@ -698,13 +811,14 @@ const ManualEntryPanel = ({
 }: ManualEntryPanelProps): JSX.Element => {
   const { t } = useLocalizations();
   const certInputRef = React.useRef<HTMLInputElement>(null);
+  const { key } = useConfigureStepTranslations();
 
   return (
     <>
       <Text
         as='p'
         colorScheme='secondary'
-        localizationKey={localizationKeys('configureSSO.configureStep.samlOkta.manual.description')}
+        localizationKey={localizationKeys(key('manual.description'))}
       />
 
       <Form.ControlRow elementId={signOnUrlField.id}>
@@ -748,7 +862,7 @@ const ManualEntryPanel = ({
                   />
                 )}
                 <Button
-                  size='sm'
+                  size='xs'
                   variant='outline'
                   onClick={() => certInputRef.current?.click()}
                 >
diff --git a/packages/ui/src/components/ConfigureSSO/steps/ConfirmationStep.tsx b/packages/ui/src/components/ConfigureSSO/steps/ConfirmationStep.tsx
index 1a9ba7eacbe..f27d381f6d6 100644
--- a/packages/ui/src/components/ConfigureSSO/steps/ConfirmationStep.tsx
+++ b/packages/ui/src/components/ConfigureSSO/steps/ConfirmationStep.tsx
@@ -1,4 +1,4 @@
-import { __internal_useUserEnterpriseConnections, useReverification } from '@clerk/shared/react';
+import { useReverification } from '@clerk/shared/react';
 import { useState } from 'react';
 
 import { Badge, Col, descriptors, Flex, Flow, Grid, Link, localizationKeys, Text } from '@/customizables';
@@ -65,8 +65,7 @@ const SsoStatusSection = (): JSX.Element => {
 };
 
 const EnableSsoSection = (): JSX.Element => {
-  const { enterpriseConnection } = useConfigureSSO();
-  const { updateEnterpriseConnection } = __internal_useUserEnterpriseConnections({ enabled: false });
+  const { enterpriseConnection, updateEnterpriseConnection } = useConfigureSSO();
   const card = useCardState();
 
   const [isChecked, setIsChecked] = useState(!!enterpriseConnection?.active);
@@ -206,7 +205,7 @@ const ConfigurationDetailsSection = (): JSX.Element => {
         >
           <ProfileSection.Button
             id='configureAgain'
-            onClick={() => goToStep('select-provider')}
+            onClick={() => goToStep('configure')}
             variant='ghost'
             colorScheme='primary'
             localizationKey={localizationKeys('configureSSO.confirmation.configurationSection.configureAgainLink')}
@@ -220,8 +219,7 @@ const ConfigurationDetailsSection = (): JSX.Element => {
 const ResetConnectionForm = withCardStateProvider((props: FormProps) => {
   const { onReset, onSuccess } = props;
   const card = useCardState();
-  const { enterpriseConnection } = useConfigureSSO();
-  const { deleteEnterpriseConnection } = __internal_useUserEnterpriseConnections({ enabled: false });
+  const { enterpriseConnection, deleteEnterpriseConnection } = useConfigureSSO();
   const { goToStep } = useWizard();
 
   const deleteConnection = useReverification((id: string) => deleteEnterpriseConnection(id));
diff --git a/packages/ui/src/components/ConfigureSSO/steps/SelectProviderStep.tsx b/packages/ui/src/components/ConfigureSSO/steps/SelectProviderStep.tsx
index 8943d6b122e..882bf513211 100644
--- a/packages/ui/src/components/ConfigureSSO/steps/SelectProviderStep.tsx
+++ b/packages/ui/src/components/ConfigureSSO/steps/SelectProviderStep.tsx
@@ -1,10 +1,13 @@
 import { iconImageUrl } from '@clerk/shared/constants';
+import { useUser } from '@clerk/shared/react/index';
 import React from 'react';
 
 import type { LocalizationKey } from '@/customizables';
 import { Box, Col, descriptors, Flow, Grid, localizationKeys, Span, Text, useLocalizations } from '@/customizables';
+import { useCardState } from '@/elements/contexts';
 import { common, mqu } from '@/styledSystem';
 import { Alert } from '@/ui/elements/Alert';
+import { handleError } from '@/utils/errorHandler';
 
 import { useConfigureSSO } from '../ConfigureSSOContext';
 import { Step } from '../elements/Step';
@@ -38,16 +41,36 @@ const PROVIDER_GROUPS: ReadonlyArray<{
 ];
 
 export const SelectProviderStep = (): JSX.Element => {
-  const { goNext } = useWizard();
-  const { setProvider } = useConfigureSSO();
+  const { goToStep } = useWizard();
+  const { setProvider, createEnterpriseConnection } = useConfigureSSO();
   const [selected, setSelected] = React.useState<ProviderType | null>(null);
+  const { user } = useUser();
+  const card = useCardState();
 
-  const handleContinue = () => {
-    if (!selected) {
+  const handleContinue = async () => {
+    if (!selected || !user) {
       return;
     }
+
     setProvider(selected);
-    void goNext();
+
+    const primaryEmailAddress = user?.primaryEmailAddress;
+    const hasVerifiedPrimaryEmailAddress = primaryEmailAddress?.verification.status === 'verified';
+
+    if (!primaryEmailAddress || !hasVerifiedPrimaryEmailAddress) {
+      void goToStep('verify-domain');
+      return;
+    }
+
+    // Otherwise, set the provider and create the enterprise connection
+    try {
+      await createEnterpriseConnection(selected, primaryEmailAddress);
+    } catch (err) {
+      handleError(err as Error, [], card.setError);
+      return;
+    }
+
+    void goToStep('configure');
   };
 
   return (
@@ -116,6 +139,14 @@ export const SelectProviderStep = (): JSX.Element => {
               variant='warning'
               title={localizationKeys('configureSSO.selectProviderStep.warning')}
             />
+
+            {card.error && (
+              <Alert
+                variant='danger'
+                title={card.error}
+                sx={t => ({ margin: t.space.$3 })}
+              />
+            )}
           </Step.Section>
         </Step.Body>
 
@@ -124,6 +155,7 @@ export const SelectProviderStep = (): JSX.Element => {
 
           <Step.Footer.Continue
             onClick={handleContinue}
+            isLoading={card.isLoading}
             isDisabled={!selected}
           />
         </Step.Footer>
diff --git a/packages/ui/src/components/ConfigureSSO/steps/VerifyDomainStep.tsx b/packages/ui/src/components/ConfigureSSO/steps/VerifyDomainStep.tsx
index ba5a1079036..5600e6c65d1 100644
--- a/packages/ui/src/components/ConfigureSSO/steps/VerifyDomainStep.tsx
+++ b/packages/ui/src/components/ConfigureSSO/steps/VerifyDomainStep.tsx
@@ -1,6 +1,6 @@
-import { __internal_useUserEnterpriseConnections, useReverification, useSession, useUser } from '@clerk/shared/react';
+import { useReverification, useSession, useUser } from '@clerk/shared/react';
 import type { EmailAddressResource } from '@clerk/shared/types';
-import { useCallback, useEffect, useRef, useState } from 'react';
+import React, { useCallback, useEffect, useRef, useState } from 'react';
 
 import {
   Col,
@@ -22,13 +22,13 @@ import { handleError } from '@/utils/errorHandler';
 import { useConfigureSSO } from '../ConfigureSSOContext';
 import { Step } from '../elements/Step';
 import { useWizard, Wizard } from '../elements/Wizard';
-import type { ProviderType } from '../types';
 
 export const VerifyDomainStep = (): JSX.Element => {
   const { user } = useUser();
   const { session } = useSession();
   const { enterpriseConnection } = useConfigureSSO();
   const { t } = useLocalizations();
+  const { goNext: outerGoNext } = useWizard();
 
   const emailToVerify =
     user?.primaryEmailAddress ?? user?.emailAddresses?.find(e => e.verification.status !== 'verified');
@@ -41,6 +41,13 @@ export const VerifyDomainStep = (): JSX.Element => {
     isVerified && enterpriseConnection && enterpriseConnection.organizationId !== activeOrganizationId,
   );
 
+  const wasVerifiedOnMountRef = useRef(isVerified);
+  const emailAddressRef = useRef<EmailAddressResource | undefined>(emailToVerify);
+  const preExistingEmailIdRef = useRef<string | undefined>(emailToVerify?.id);
+  const initialInnerStepIdRef = useRef<'provide-email' | 'verify-email-address'>(
+    emailToVerify ? 'verify-email-address' : 'provide-email',
+  );
+
   if (isDomainTakenByOtherOrg) {
     const conflictingDomain = enterpriseConnection?.domains[0] as string;
 
@@ -84,13 +91,43 @@ export const VerifyDomainStep = (): JSX.Element => {
     );
   }
 
+  if (wasVerifiedOnMountRef.current && emailToVerify?.emailAddress) {
+    return (
+      <Flow.Part part='verifyDomain'>
+        <Step
+          elementDescriptor={descriptors.configureSSOStep}
+          elementId={descriptors.configureSSOStep.setId('verify-domain')}
+        >
+          <Step.Header
+            title={t(localizationKeys('configureSSO.verifyEmailDomainStep.title'))}
+            description={t(localizationKeys('configureSSO.verifyEmailDomainStep.subtitle'))}
+          />
+
+          <Step.Body>
+            <Step.Section
+              sx={{ flex: 1 }}
+              align='center'
+              justify='center'
+            >
+              <EmailAlreadyVerified emailAddress={emailToVerify.emailAddress} />
+            </Step.Section>
+          </Step.Body>
+
+          <Step.Footer>
+            <Step.Footer.Continue onClick={() => outerGoNext()} />
+          </Step.Footer>
+        </Step>
+      </Flow.Part>
+    );
+  }
+
   return (
     <Flow.Part part='verifyDomain'>
       <Step
         elementDescriptor={descriptors.configureSSOStep}
         elementId={descriptors.configureSSOStep.setId('verify-domain')}
       >
-        <Wizard>
+        <Wizard initialStepId={initialInnerStepIdRef.current}>
           <Step.Header
             title={t(localizationKeys('configureSSO.verifyEmailDomainStep.title'))}
             description={t(localizationKeys('configureSSO.verifyEmailDomainStep.subtitle'))}
@@ -100,11 +137,14 @@ export const VerifyDomainStep = (): JSX.Element => {
 
           <Step.Body>
             <Wizard.Step id='provide-email'>
-              <ProvideEmailStep />
+              <ProvideEmailStep
+                emailAddressRef={emailAddressRef}
+                preExistingEmailIdRef={preExistingEmailIdRef}
+              />
             </Wizard.Step>
 
             <Wizard.Step id='verify-email-address'>
-              <EnterVerificationCodeStep emailToVerify={emailToVerify} />
+              <EnterVerificationCodeStep emailAddressRef={emailAddressRef} />
             </Wizard.Step>
           </Step.Body>
         </Wizard>
@@ -125,12 +165,21 @@ const InnerStepCounter = (): JSX.Element => {
 
 const isEmail = (str: string) => /^\S+@\S+\.\S+$/.test(str);
 
-export const ProvideEmailStep = (): JSX.Element => {
-  const { goNext, goPrev, isFirstStep } = useWizard();
+type ProvideEmailStepProps = {
+  emailAddressRef: React.MutableRefObject<EmailAddressResource | undefined>;
+  preExistingEmailIdRef: React.MutableRefObject<string | undefined>;
+};
+
+const normalizeEmail = (value: string): string => value.trim().toLowerCase();
+
+export const ProvideEmailStep = ({ emailAddressRef, preExistingEmailIdRef }: ProvideEmailStepProps): JSX.Element => {
+  const { goNext, goPrev } = useWizard();
   const { user } = useUser();
   const card = useCardState();
   const { t } = useLocalizations();
-  const [email, setEmail] = useState('');
+  // Pre-fill with whatever email the parent is currently tracking so navigating back from the
+  // verify step shows the user what they previously submitted instead of an empty field.
+  const [email, setEmail] = useState(() => emailAddressRef.current?.emailAddress ?? '');
   const createEmailAddress = useReverification((value: string) => user?.createEmailAddress({ email: value }));
 
   const canSubmit = isEmail(email) && !card.isLoading;
@@ -139,18 +188,41 @@ export const ProvideEmailStep = (): JSX.Element => {
       return;
     }
 
+    const current = emailAddressRef.current;
+    const submittedEmail = email.trim();
+
+    // Same email address as previously submitted, skip the flow
+    if (current && normalizeEmail(current.emailAddress) === normalizeEmail(submittedEmail)) {
+      await goNext();
+      return;
+    }
+
     card.setError(undefined);
     card.setLoading();
 
     try {
-      await createEmailAddress(email);
+      const created = await createEmailAddress(submittedEmail);
+      const previous = current;
+      emailAddressRef.current = created ?? undefined;
+
+      // Clean up the previous in-flight address so the user doesn't accumulate orphans on
+      // their account
+      if (previous && previous.id !== preExistingEmailIdRef.current && previous.id !== created?.id) {
+        try {
+          await previous.destroy();
+        } catch {
+          // A leftover unverified address is preferable to surfacing a cleanup
+          // error after a successful create.
+        }
+      }
+
       await goNext();
     } catch (err) {
       handleError(err as Error, [], card.setError);
     } finally {
       card.setIdle();
     }
-  }, [canSubmit, email, createEmailAddress, card, goNext]);
+  }, [canSubmit, email, createEmailAddress, card, goNext, emailAddressRef, preExistingEmailIdRef]);
 
   return (
     <>
@@ -223,7 +295,7 @@ export const ProvideEmailStep = (): JSX.Element => {
       <Step.Footer>
         <Step.Footer.Previous
           onClick={() => goPrev()}
-          isDisabled={isFirstStep}
+          isDisabled
         />
         <Step.Footer.Continue
           onClick={handleSubmit}
@@ -236,51 +308,30 @@ export const ProvideEmailStep = (): JSX.Element => {
 };
 
 export const EnterVerificationCodeStep = ({
-  emailToVerify,
+  emailAddressRef,
 }: {
-  emailToVerify?: EmailAddressResource;
+  emailAddressRef: React.MutableRefObject<EmailAddressResource | undefined>;
 }): JSX.Element | null => {
   const { user } = useUser();
-  const { session } = useSession();
-  const { provider, enterpriseConnection } = useConfigureSSO();
-  const { createEnterpriseConnection } = __internal_useUserEnterpriseConnections();
+  const { provider, createEnterpriseConnection } = useConfigureSSO();
   const card = useCardState();
-  const codeSubmittedRef = useRef(false);
-  const { goNext, goPrev, isFirstStep } = useWizard();
+  const { goNext, goPrev } = useWizard();
+  const primaryEmailAddress = user?.primaryEmailAddress;
 
+  const emailToVerify = emailAddressRef.current;
   const isVerified = emailToVerify?.verification.status === 'verified';
   const isPrimary = emailToVerify?.id === user?.primaryEmailAddressId;
-  const hasVerifiedEmail = emailToVerify?.emailAddress && isVerified && !codeSubmittedRef.current;
 
   const prepareEmailVerification = useReverification(() =>
-    emailToVerify?.prepareVerification({ strategy: 'email_code' }),
+    emailAddressRef.current?.prepareVerification({ strategy: 'email_code' }),
+  );
+  const attemptEmailVerification = useReverification((code: string) =>
+    emailAddressRef.current?.attemptVerification({ code }),
   );
-  const attemptEmailVerification = useReverification((code: string) => emailToVerify?.attemptVerification({ code }));
   const setPrimaryEmailAddress = useReverification((emailAddressId: string) =>
     user?.update({ primaryEmailAddressId: emailAddressId }),
   );
-  const createConnection = useReverification(
-    useCallback(
-      async (selectedProvider: ProviderType) => {
-        if (enterpriseConnection) {
-          return;
-        }
-        if (!user?.primaryEmailAddress) {
-          throw new Error('Primary email required');
-        }
 
-        const emailDomain = user.primaryEmailAddress.emailAddress.split('@')[1];
-        const organizationId = session?.lastActiveOrganizationId ?? null;
-
-        await createEnterpriseConnection({
-          provider: selectedProvider,
-          name: emailDomain,
-          organizationId,
-        });
-      },
-      [enterpriseConnection, user, session, createEnterpriseConnection],
-    ),
-  );
   const prepare = useCallback(
     () => prepareEmailVerification()?.catch(err => handleError(err, [], card.setError)),
     [prepareEmailVerification, card],
@@ -288,7 +339,6 @@ export const EnterVerificationCodeStep = ({
 
   const otp = useFieldOTP({
     onCodeEntryFinished: (code, resolve, reject) => {
-      codeSubmittedRef.current = true;
       attemptEmailVerification(code)
         .then(() => resolve())
         .catch(reject);
@@ -297,9 +347,10 @@ export const EnterVerificationCodeStep = ({
       void prepare();
     },
     onResolve: async () => {
-      if (emailToVerify && !isPrimary) {
+      const target = emailAddressRef.current;
+      if (target && !isPrimary) {
         try {
-          await setPrimaryEmailAddress(emailToVerify.id);
+          await setPrimaryEmailAddress(target.id);
         } catch (err) {
           handleError(err as Error, [], card.setError);
           return;
@@ -312,7 +363,7 @@ export const EnterVerificationCodeStep = ({
       }
 
       try {
-        await createConnection(provider);
+        await createEnterpriseConnection(provider, emailToVerify);
       } catch (err) {
         handleError(err as Error, [], card.setError);
         return;
@@ -322,10 +373,12 @@ export const EnterVerificationCodeStep = ({
     },
   });
 
+  // Send a code on mount, but only when the target address is not already verified
   useEffect(() => {
     if (emailToVerify && !isVerified) {
       void prepare();
     }
+    // eslint-disable-next-line react-hooks/exhaustive-deps
   }, []);
 
   if (!emailToVerify) {
@@ -339,44 +392,40 @@ export const EnterVerificationCodeStep = ({
         align='center'
         justify='center'
       >
-        {hasVerifiedEmail ? (
-          <EmailAlreadyVerified emailAddress={emailToVerify.emailAddress} />
-        ) : (
-          <Col
-            gap={4}
-            sx={{ textAlign: 'center' }}
-          >
-            <Col gap={1}>
-              <Heading
-                textVariant='h1'
-                sx={t => ({ fontSize: t.fontSizes.$sm })}
-                localizationKey={localizationKeys('configureSSO.verifyEmailDomainStep.emailCode.formTitle')}
-              />
-              <Text
-                as='p'
-                variant='body'
-                colorScheme='secondary'
-                localizationKey={localizationKeys('configureSSO.verifyEmailDomainStep.emailCode.formSubtitle', {
-                  identifier: emailToVerify.emailAddress,
-                })}
-              />
-            </Col>
-            <Form.OTPInput
-              {...otp}
-              resendButton={localizationKeys('configureSSO.verifyEmailDomainStep.emailCode.resendButton')}
+        <Col
+          gap={4}
+          sx={{ textAlign: 'center' }}
+        >
+          <Col gap={1}>
+            <Heading
+              textVariant='h1'
+              sx={t => ({ fontSize: t.fontSizes.$sm })}
+              localizationKey={localizationKeys('configureSSO.verifyEmailDomainStep.emailCode.formTitle')}
+            />
+            <Text
+              as='p'
+              variant='body'
+              colorScheme='secondary'
+              localizationKey={localizationKeys('configureSSO.verifyEmailDomainStep.emailCode.formSubtitle', {
+                identifier: emailToVerify.emailAddress,
+              })}
             />
           </Col>
-        )}
+          <Form.OTPInput
+            {...otp}
+            resendButton={localizationKeys('configureSSO.verifyEmailDomainStep.emailCode.resendButton')}
+          />
+        </Col>
       </Step.Section>
 
       <Step.Footer>
         <Step.Footer.Previous
           onClick={() => goPrev()}
-          isDisabled={isFirstStep}
+          isDisabled={!!primaryEmailAddress}
         />
         <Step.Footer.Continue
           onClick={() => goNext()}
-          isLoading={otp.isLoading}
+          isLoading={otp.isLoading || card.isLoading}
           isDisabled={!isVerified}
         />
       </Step.Footer>
@@ -401,8 +450,8 @@ const EmailAlreadyVerified = ({ emailAddress }: { emailAddress: string }): JSX.E
         })}
       />
       <Col
-        gap={1}
-        sx={t => ({ textAlign: 'center', maxWidth: t.sizes.$94 })}
+        gap={2}
+        sx={t => ({ textAlign: 'center', maxWidth: t.sizes.$66 })}
       >
         <Heading
           textVariant='h1'
@@ -410,7 +459,7 @@ const EmailAlreadyVerified = ({ emailAddress }: { emailAddress: string }): JSX.E
           localizationKey={localizationKeys('configureSSO.verifyEmailDomainStep.emailCode.verified.title')}
         />
         <Col
-          gap={1}
+          gap={3}
           sx={{ flex: 1 }}
         >
           <Text
diff --git a/packages/ui/src/components/ConfigureSSO/steps/__tests__/SelectProviderStep.test.tsx b/packages/ui/src/components/ConfigureSSO/steps/__tests__/SelectProviderStep.test.tsx
index e25efd16fc2..acab32ad1d3 100644
--- a/packages/ui/src/components/ConfigureSSO/steps/__tests__/SelectProviderStep.test.tsx
+++ b/packages/ui/src/components/ConfigureSSO/steps/__tests__/SelectProviderStep.test.tsx
@@ -1,3 +1,4 @@
+import { ClerkRuntimeError } from '@clerk/shared/error';
 import type { ReactElement } from 'react';
 import { describe, expect, it, vi } from 'vitest';
 
@@ -7,6 +8,7 @@ import { CardStateProvider } from '@/ui/elements/contexts';
 
 const goNext = vi.fn();
 const goPrev = vi.fn();
+const goToStep = vi.fn();
 
 vi.mock('../../elements/Wizard', () => ({
   useWizard: () => ({
@@ -19,23 +21,51 @@ vi.mock('../../elements/Wizard', () => ({
     isNested: false,
     goNext,
     goPrev,
-    goToStep: vi.fn(),
+    goToStep,
     registerStep: vi.fn(),
     unregisterStep: vi.fn(),
   }),
 }));
 
 const setProvider = vi.fn();
+const createEnterpriseConnection = vi.fn();
 
 vi.mock('../../ConfigureSSOContext', () => ({
   useConfigureSSO: () => ({
     enterpriseConnection: undefined,
     provider: undefined,
     setProvider,
+    createEnterpriseConnection,
     initialStepId: 'select-provider',
   }),
 }));
 
+const userMockState = vi.hoisted(() => ({
+  current: {
+    primaryEmailAddress: {
+      emailAddress: 'test@clerk.com',
+      verification: { status: 'verified' as 'verified' | 'unverified' },
+    },
+  } as {
+    primaryEmailAddress?: {
+      emailAddress: string;
+      verification: { status: 'verified' | 'unverified' };
+    };
+  } | null,
+}));
+
+vi.mock('@clerk/shared/react/index', async importOriginal => {
+  const actual = await importOriginal<typeof import('@clerk/shared/react/index')>();
+  return {
+    ...actual,
+    useUser: () => ({
+      user: userMockState.current,
+      isLoaded: true,
+      isSignedIn: true,
+    }),
+  };
+});
+
 import { SelectProviderStep } from '../SelectProviderStep';
 
 const { createFixtures } = bindCreateFixtures('ConfigureSSO');
@@ -50,7 +80,16 @@ const renderStep = (
 const resetMocks = () => {
   goNext.mockReset();
   goPrev.mockReset();
+  goToStep.mockReset();
   setProvider.mockReset();
+  createEnterpriseConnection.mockReset();
+  createEnterpriseConnection.mockResolvedValue(undefined);
+  userMockState.current = {
+    primaryEmailAddress: {
+      emailAddress: 'test@clerk.com',
+      verification: { status: 'verified' },
+    },
+  };
 };
 
 describe('SelectProviderStep', () => {
@@ -137,8 +176,11 @@ describe('SelectProviderStep', () => {
     setProvider.mockImplementation(() => {
       callOrder.push('setProvider');
     });
-    goNext.mockImplementation(() => {
-      callOrder.push('goNext');
+    createEnterpriseConnection.mockImplementation(async () => {
+      callOrder.push('createEnterpriseConnection');
+    });
+    goToStep.mockImplementation(() => {
+      callOrder.push('goToStep');
     });
 
     const { wrapper } = await createFixtures();
@@ -148,11 +190,12 @@ describe('SelectProviderStep', () => {
     await userEvent.click(screen.getByRole('button', { name: /Continue/i }));
 
     await waitFor(() => {
-      expect(goNext).toHaveBeenCalledTimes(1);
+      expect(goToStep).toHaveBeenCalledWith('configure');
     });
 
     expect(setProvider).toHaveBeenCalledWith('saml_okta');
-    expect(callOrder).toEqual(['setProvider', 'goNext']);
+    expect(createEnterpriseConnection).toHaveBeenCalledWith('saml_okta');
+    expect(callOrder).toEqual(['setProvider', 'createEnterpriseConnection', 'goToStep']);
   });
 
   it('forwards the Custom SAML backend provider id when selected', async () => {
@@ -164,10 +207,32 @@ describe('SelectProviderStep', () => {
     await userEvent.click(screen.getByRole('button', { name: /Continue/i }));
 
     await waitFor(() => {
-      expect(goNext).toHaveBeenCalledTimes(1);
+      expect(goToStep).toHaveBeenCalledWith('configure');
     });
 
     expect(setProvider).toHaveBeenCalledWith('saml_custom');
+    expect(createEnterpriseConnection).toHaveBeenCalledWith('saml_custom');
+  });
+
+  it('does not advance when failing to create enterprise connection', async () => {
+    resetMocks();
+    createEnterpriseConnection.mockRejectedValue(
+      new ClerkRuntimeError('failed to create enterprise connection', {
+        code: 'enterprise_connection_creation_failed',
+      }),
+    );
+
+    const { wrapper } = await createFixtures();
+    const { userEvent } = renderStep(wrapper);
+
+    await userEvent.click(screen.getByRole('radio', { name: 'Okta Workforce' }));
+    await userEvent.click(screen.getByRole('button', { name: /Continue/i }));
+
+    await waitFor(() => {
+      expect(createEnterpriseConnection).toHaveBeenCalledWith('saml_okta');
+    });
+
+    expect(goToStep).not.toHaveBeenCalled();
   });
 
   it('disables Previous on the first step', async () => {
@@ -177,4 +242,45 @@ describe('SelectProviderStep', () => {
 
     expect(screen.getByRole('button', { name: /Previous/i })).toBeDisabled();
   });
+
+  it('routes to verify-domain when the user has no primary email address', async () => {
+    resetMocks();
+    userMockState.current = {};
+
+    const { wrapper } = await createFixtures();
+    const { userEvent } = renderStep(wrapper);
+
+    await userEvent.click(screen.getByRole('radio', { name: 'Okta Workforce' }));
+    await userEvent.click(screen.getByRole('button', { name: /Continue/i }));
+
+    await waitFor(() => {
+      expect(goToStep).toHaveBeenCalledWith('verify-domain');
+    });
+
+    expect(setProvider).toHaveBeenCalledWith('saml_okta');
+    expect(createEnterpriseConnection).not.toHaveBeenCalled();
+  });
+
+  it('routes to verify-domain when the user has an unverified primary email address', async () => {
+    resetMocks();
+    userMockState.current = {
+      primaryEmailAddress: {
+        emailAddress: 'test@clerk.com',
+        verification: { status: 'unverified' },
+      },
+    };
+
+    const { wrapper } = await createFixtures();
+    const { userEvent } = renderStep(wrapper);
+
+    await userEvent.click(screen.getByRole('radio', { name: 'Okta Workforce' }));
+    await userEvent.click(screen.getByRole('button', { name: /Continue/i }));
+
+    await waitFor(() => {
+      expect(goToStep).toHaveBeenCalledWith('verify-domain');
+    });
+
+    expect(setProvider).toHaveBeenCalledWith('saml_okta');
+    expect(createEnterpriseConnection).not.toHaveBeenCalled();
+  });
 });
diff --git a/packages/ui/src/components/ConfigureSSO/steps/configureStepTranslations.ts b/packages/ui/src/components/ConfigureSSO/steps/configureStepTranslations.ts
new file mode 100644
index 00000000000..b38efd6921f
--- /dev/null
+++ b/packages/ui/src/components/ConfigureSSO/steps/configureStepTranslations.ts
@@ -0,0 +1,35 @@
+import type { __internal_LocalizationResource } from '@clerk/shared/types';
+
+import { useConfigureSSO } from '../ConfigureSSOContext';
+import type { ProviderType } from '../types';
+
+type ConfigureStepProviderKey = Extract<
+  keyof __internal_LocalizationResource['configureSSO']['configureStep'],
+  `saml${string}`
+>;
+
+export type TranslationKeyPrefix = `configureSSO.configureStep.${ConfigureStepProviderKey}`;
+
+export const PROVIDER_TRANSLATION_KEY_PREFIX = {
+  saml_okta: 'configureSSO.configureStep.samlOkta',
+  saml_custom: 'configureSSO.configureStep.samlCustom',
+} as const satisfies Record<ProviderType, TranslationKeyPrefix>;
+
+export function getConfigureStepKey<P extends ProviderType, S extends string>(
+  provider: P,
+  suffix: S,
+): `${(typeof PROVIDER_TRANSLATION_KEY_PREFIX)[P]}.${S}` {
+  return `${PROVIDER_TRANSLATION_KEY_PREFIX[provider]}.${suffix}`;
+}
+
+export function useConfigureStepTranslations() {
+  const { provider } = useConfigureSSO();
+  if (!provider) {
+    throw new Error('useConfigureStepTranslations called without a selected provider.');
+  }
+
+  return {
+    provider,
+    key: <S extends string>(suffix: S) => getConfigureStepKey(provider, suffix),
+  } as const;
+}