andrea-chiarelli

I have over 20 years of experience as a software engineer and technical author. Throughout my career, I've used several programming languages and technologies for the projects I was involved in, ranging from C# to JavaScript, ASP.NET to Node.js, Angular to React, SOAP to REST APIs, etc.

In the last few years, I've been focusing on simplifying the developer experience with Identity and related topics, especially in the .NET ecosystem.

Principal Developer Advocate

Andrea Chiarelli

Checking your customers' email addresses is a basic rule for securely onboarding them in your B2B SaaS application. Learn how to do it in your Blazor Web App.

The very first thing to do when a user signs up for your application is to verify that they actually have access to the email address they provide. Although email verification is not the only security measure you should take to ensure the user's identity, this contributes to reducing spam and fraud. Auth0 provides [a few approaches to email verification](https://auth0.com/docs/manage-users/user-accounts/verify-emails), depending on your specific use case. In this article, you will learn how to leverage the built-in email verification process based on verification links to validate the email address provided by the user during their signup for a Blazor Web application.

## The Sample Application

A previous article showed [how to manage the onboarding of a customer](https://auth0.com/blog/enable-self-subscription-in-blazor-b2b-saas-application/) who signs up for a service offered by a B2B SaaS application implemented with Blazor. On that occasion, we did not consider verifying the client's email address as we wanted to focus mainly on self-registration and creating an Organization via code. Now, we will integrate that application by adding the verification step for the self-registering customer's email address.

Download the sample project to start with this command:

```shell
git clone --branch organization-via-code --single-branch https://github.com/andychiare/MyBlazorSaaS
```

Follow the attached README file instructions to register and configure the application with Auth0. If you don't have an Auth0 account, [you can sign up for free](https://a0.to/blog_signup).

## The Email Verification Process

By default, Auth0 sends a verification link to users when they sign up, but it's up to you to check if their email is verified before allowing them to access your application or perform specific actions.

In the context of your Blazor application, you will implement the following email verification process:

1. Once the customer signs up, Auth0 automatically sends an email to the user, and your application shows a message inviting the user to check their inbox.
2. The page showing the message provides a button to resend a new verification link in case the user didn't receive the first email.
3. If the user attempts to access any other application page, your app checks if the user's email has been verified before granting access.
4. Once the email is verified, the customer can create the Organization for their new subscription.

## Wait for Email Verification

The current customer onboarding flow implemented in your Blazor App allows users to create their Organizations as soon as they sign up. From a visual perspective, they pass from the signup form to the Organization creation form. You need to make sure the customer's email has been verified before allowing them to create their new Organization. Let's start by implementing a page that fulfills points 1. and 2. mentioned earlier.

### The verification waiting page

In the `MyBlazorSaaS/Components/Pages/Onboarding` folder, create a new file named `Verify.razor` and add the following code:

```csharp


@page "/Onboarding/Verify"
@rendermode InteractiveServer
@using Auth0.ManagementApi.Models
@using System.Security.Claims

@inject NavigationManager NavigationManager
@inject IAuth0Management auth0Management

<h1>Verify your email</h1>
<p>
 Please check your inbox for a verification link to continue creating your account.
</p>

<div>
  <button class="btn btn-primary" @onclick="ResendVerificationEmail">Resend Verification</button>
</div>

<div>
@Message
</div>

@code {
  [CascadingParameter]
  private Task<AuthenticationState>? authenticationState { get; set; }
  private string Message = "";

  private async Task ResendVerificationEmail()
  {
    if (authenticationState is not null)
    {
      var state = await authenticationState;
      var userId = state?.User?.FindFirst(c => c.Type == ClaimTypes.NameIdentifier)?.Value;

      try {
        var managementClient = await auth0Management.getClient();
        await managementClient.Jobs.SendVerificationEmailAsync(new VerifyEmailJobRequest() { UserId = userId });
        Message = "The verification e-mail has successfully been sent. Please check your inbox";
      } catch (Exception) {
        Message = "Failed to resend verification e-mail.";
      }      
    } else {
        NavigationManager.NavigateTo("/Onboarding/Signup");
    }
  }
}
```

This page will display a message that invites the user to check their inbox and offers a button to resend the verification link if needed. It will be rendered as shown in the following image:

![Verify email screen in your Blazor Web app](https://images.ctfassets.net/23aumh6u8s0i/72gdEry0IJzomAqT4P95gF/a099d96c8531367d3c8b567ac3853081/blazor-verify-email-screen.png)

Since the current onboarding flow shows the Organization creation page after the user signup, you need to change it. Open the `Program.cs` file in the `MyBlazorSaaS` folder and replace the line of code shown below:

```csharp
// MyBlazorSaaS/Program.cs

//...existing code...

app.MapGet("/account/signup", async (HttpContext httpContext, string login_hint) =>
{
  var authenticationProperties = new LoginAuthenticationPropertiesBuilder()
          //.WithRedirectUri("/onboarding/createOrganization") // 👈 old code
          .WithRedirectUri("/onboarding/verify")  // 👈 new code
          .WithParameter("screen_hint", "signup")
          .WithParameter("login_hint", login_hint)
          .Build();

  await httpContext.ChallengeAsync("OnboardingScheme", authenticationProperties);
});

//...existing code...
```

This ensures that the user will be redirected to the verification waiting page instead of the Organization creation page.

### Resend the verification link

The verification waiting page shows a "Resend Verification" button. Let's take a closer look at the code triggered by that button to learn how to resend the verification link:

```csharp

  
//...existing code...

@code {
  [CascadingParameter]
  private Task<AuthenticationState>? authenticationState { get; set; }
  private string Message = "";

  private async Task ResendVerificationEmail()
  {
    if (authenticationState is not null)
    {
      var state = await authenticationState;
      var userId = state?.User?.FindFirst(c => c.Type == ClaimTypes.NameIdentifier)?.Value;

      try {
        var managementClient = await auth0Management.getClient();
        await managementClient.Jobs.SendVerificationEmailAsync(new VerifyEmailJobRequest() { UserId = userId });
        Message = "The verification e-mail has successfully been sent. Please check your inbox";
      } catch (Exception) {
        Message = "Failed to resend verification e-mail.";
      }      
    } else {
        NavigationManager.NavigateTo("/Onboarding/Signup");
    }
  }
}
```

The `ResendVerificationEmail()` method gets the user ID from the authentication state, gets an instance of the management client, and uses the `SendVerificationEmailAsync()` method, passing an instance of `VerifyEmailJobRequest` with the user ID value. This method of the Management API client corresponds to calling [the email address verification endpoint](https://auth0.com/docs/api/management/v2/jobs/post-verification-email), which will generate a new ticket, include it in a verification link, and send it to the user via email.

## Customize the Email Verification Template

The default email message with the verification link sent to the user will look like the following:

![Email verification message](https://images.ctfassets.net/23aumh6u8s0i/6cP7skL9tqxBUnCAwC1cOa/0e31a5311fbd6506e75e010c091218a9/email-verification-message.png)

You can customize this message using your Auth0 dashboard. Go to the [Branding > Email Templates](https://manage.auth0.com/#/templates) page, select the *Verification Email (Link)* template, and apply the changes you want. You can customize the sender address, the subject, and the message body using [HTML and Liquid syntax](https://auth0.com/docs/customize/email/email-templates/use-liquid-syntax-in-email-templates). You can also customize other settings and use [common variables](https://auth0.com/docs/customize/email/email-templates#common-variables) to include some contextual values in your message. Read [this document](https://auth0.com/docs/customize/email/email-templates) to learn more about email template customization.

By default, nothing visible happens on your application when a user clicks the verification link. Auth0 will mark the user's email field as verified and show a page confirming that the email verification process was successful, as you can see in the following image:

![£mail address verified by Auth0](https://images.ctfassets.net/23aumh6u8s0i/4pgKFqZDlk93OnekyTrElS/1b3bf679d107f68279e8c4f711267836/email-address-verified.png)

However, in our self-subscription flow, we would like the user to be redirected to the next onboarding step after their email is verified, which is the organization creation screen. The email verification template provides a *Redirect To* field that allows you to specify the URL of the page you want the user to land after the email verification. You can parametrize the URL using one of the common variables mentioned above. Specifically, enter the following value in the *Redirect To* field and click the *Save* button:

```
{{ application.callback_domain }}/onboarding/createOrganization
```

That's all! Now, your user will be redirected to the Organization creation page after the email verification.

<include src="Auth0TemplatesForDotnetCTA" />

## Require Email Verification

One small piece is missing to complete the customer onboarding flow. You need to ensure that they cannot access the protected pages of your application if their email has not been verified yet. This means that when you check if the user is authenticated, you also need to consider checking that their email is verified too.

### A basic approach

You don't need to check if the user's email is verified when they access the `Home.razor` page, `Signup.razor`, and `Verify.razor` pages: the first two are public pages, and the third one is specifically designed for users who haven't verified their email yet.

You need to check the validity of the user's email on the `CreateOrganization.razor` page. To this purpose, apply the changes highlighted here on the `CreateOrganization.razor` page:

```csharp


//...existing code...

  protected override async Task OnInitializedAsync()
  {
    if (authenticationState is not null)
    {
      var state = await authenticationState;

      // 👇 new code
      var isEmailVerified = state.User?.FindFirst(c => c.Type == "email_verified")?.Value?.ToLowerInvariant() == "true";
      // ☝️ new code

      // 👇 changed code
      if (state.User?.Identity?.IsAuthenticated??false && isEmailVerified)
      // ☝️ changed code
      {
        Email = state.User?.FindFirst(c => c.Type == ClaimTypes.Email)?.Value??String.Empty;
        UserId = state.User?.FindFirst(c => c.Type == ClaimTypes.NameIdentifier)?.Value??String.Empty;
      } else {
        NavigationManager.NavigateTo("/Onboarding/Signup");
      }
    }
  }

//...existing code...
```

You can see that a new variable `isEmailVerified` has been introduced. This variable gets a boolean value coming from the value of the `email_verified` claim. You will use this variable as an additional condition to go ahead with the Organization creation step.

### A more structured approach

You need to apply the email verification check to most of the protected pages of your application. This depends on your application, of course. In our case, you should also apply the same check to the `Weather.razor` page on the server side and the `Counter.razor` and `FetchDat.razor` pages on the client side.

Applying the earlier approach would work, but it's ineffective in terms of code duplication and maintenance. You will use [ASP.NET Core policy-based authorization](https://learn.microsoft.com/en-us/aspnet/core/security/authorization/policies) instead.

First, open the `Program.cs` file in the `MyBlazorSaaS` folder and add the code highlighted below:

```csharp
// MyBlazorSaaS/Program.cs

//... existing code...

// 👇 new code
builder.Services
    .AddAuthorization(options => {
      options.AddPolicy("VerifiedEmail", policy =>
        policy.RequireAssertion(context =>
          context.User.HasClaim(claim =>
            ( claim.Type == "email_verified" &&
              claim.Value?.ToLowerInvariant() == "true")
          )
        )
      );
    });
// ☝️ new code

// Add services to the container.
builder.Services.AddRazorComponents()
    .AddInteractiveServerComponents()
    .AddInteractiveWebAssemblyComponents()
    .AddAuthenticationStateSerialization();

//... existing code...
```

This code defines an authorization policy named `"VerifiedEmail"`. This policy checks if the current user has a claim `email_verified` set to `true`. This is the [standard claim](https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims) coming from the ID token issued by Auth0.

Now, let's create a page to which the user will be redirected when attempting to access a page without the required authorization. By default, Blazor redirects unauthorized users to an `Account/AccessDenied` page. So, create an `Account` folder in the `MyBlazorSaaS/Components/Pages` folder and add an `AccessDenied.razor` page with the following code:

```csharp

  
@page "/account/accessdenied"

<PageTitle>Access Denied</PageTitle>

<h2>You are not authorized to access this page</h2>

<p>@Reason</p>

@code {
  [CascadingParameter]
  private Task<AuthenticationState>? authenticationState { get; set; }
  private string Reason = "";

  protected override async Task OnInitializedAsync()
  {
    if (authenticationState is not null)
    {
      var state = await authenticationState;

      var isEmailVerified = state.User?.FindFirst(c => c.Type == "email_verified")?.Value?.ToLowerInvariant() == "true";

      if (state.User?.Identity?.IsAuthenticated??false && isEmailVerified)
      {
        Reason = "Your email is not verified yet!";
      }
    }
  }
}
```

This page shows a generic message to the unauthorized user and attempts to show a specific message about the actual reason. In particular, it checks if the user has the `email_verified` claim set to `true` and displays a message accordingly.

Finally, specify the policy `VerifiedEmail` in the `Authorize` attribute of your protected pages as shown below:

```csharp

  
@page "/weather"
// 👇 changed code
@attribute [Authorize(Policy = "VerifiedEmail")]
// ☝️ changed code
@attribute [StreamRendering]

//...existing code...
```

Apply this change to the `Counter.razor` and `FetchData.razor` pages in the `MyBlazorSaaS.Client/Pages` folder as well.

That's all! Your customer onboarding flow now includes the email verification step to mitigate the risks of spam and fraud.

<include src="SignupCTA" text="Try out Auth0 authentication for free." linkText="Get started →" />

## Recap

Auth0 always sends an email verification message when a user signs up for your application. However, it's up to you to determine in which scenario to check whether the user's email has been verified.

In the example shown in this article, we took the case of onboarding a customer of a B2B SaaS application developed with Blazor and added the email verification step before allowing them to create a new Organization.

We also saw how to allow the resend of the verification email and prevent access to the application's protected pages when the user's email has not been verified yet.

You can find the final code of the project created during the article on [this GitHub repository](https://github.com/andychiare/MyBlazorSaaS/tree/email-verification).

Enforce Customer Email Verification in Your B2B Blazor Web App

Aliyah Winfrey

I'm Aliyah Winfrey, a staff design researcher who’s passionate about creating clarity and alignment in complex research spaces. I thrive on asking the right questions and uncovering insights that drive meaningful design. Outside work, I tend to my garden, experiment with new baking recipes, or get lost in a classic PS2 game.

Staff Design Researcher

Brandon Simons

Brandon Simons is a Principal Product Manager at Auth0, where he has spent over three years dedicated to empowering customers to build great login experiences. His focus is on providing the right balance between ease of development and maintenance, while ensuring a delightful end user journey. Prior to his role at Auth0, Brandon spent over a decade working in SaaS at companies large and small.

Principal Product Manager

The benefits of leveraging social connections for your customers

Social Login has become a login method across [numerous regions, ages, and community types](https://auth0.com/blog/digital-identity-what-users-think-about-devices-and-logins/). Globally, we are connected through social media, and leveraging social login allows us to fortify those connections through a seamless and secure login. However, many everyday people don’t understand [how social login or social connections work](https://auth0.com/blog/analysis-of-social-connection-data/) or, more importantly, if [social login is a safe way](https://auth0.com/blog/social-login-on-the-rise/) to log in or sign up. 

Social login uses existing social media accounts, such as Google, Facebook, X (Formerly Twitter), Apple, and Microsoft, to sign in or go up for websites. It reduces the cognitive load of users remembering another username and password or, worse… _reusing a password_ 😱 over 70% of general users do. Over thousands of our customers have integrated Social Login in their authentication flow. Social login offers the following.

1. Frictionless and rapid method for users to sign up/log in via a 1-click solution
2. Implementing social login significantly increases the conversion rate.<sup><a href="https://auth0.com/blog/how-to-use-social-login-to-drive-your-apps-growth/#Increase-Your-Sign-Up-Conversion-Rate-by-20-">1 </a></sup><sup><a href="https://www.marketone.com/articles/maximizing-conversion-rates-with-social-sign-in">2</a></sup>
3. Security of social login 

However, internal research of general population users cited the sentiment that social login is the most vulnerable identifier to cyberattacks.

![Social login](https://images.ctfassets.net/23aumh6u8s0i/13wdcxqs5xSsqyzL1bkQjx/2dad6f825cb64537ce2ae1dd1d4884c5/Social_Login.png)

Given this sentiment, let’s break down three common myths about Social Login among general users and share some key points to keep in mind when using it in your applications.

## The Myths of Social Login

> **Myth #1**: Logging in via my social account (Facebook, Google, or Microsoft)  gives away the data in my social account.

Social account hacking is a huge and serious concern for everyday users. However, many social login services such as Google, Facebook, Apple, and Microsoft do not grant full access to your account and share only what’s necessary, such as name and email. Social Login providers share limited information with the application or website users are logging in to. Social login minimizes the data you store when signing up for accounts. The less data you store, _the better_.

This means they are not sharing your data on your social login account. Social login only grants authentication rights to create or log into an account. Additionally, many social login providers allow users to review, control, and revoke access to their account settings, meaning users must grant permission to access _any_ account data. Social login does not give the application or service users a sign-up for access to data such as private messages, browsing history, or other sensitive information.

> **Myth #2**: Social login is less secure than a password.*

Social login is often more secure than using a password for a few reasons. Traditional login methods, such as passwords, are prone to reuse and have general weaknesses, such as hackers guessing simple passwords. Social login reduces the risk by offering a passwordless way to authenticate. Moreover, users' risk of credential theft and phishing is diminished, given they are not creating and storing credentials to log in to third-party sites and services. Social Login often provides built-in Multi-Factor Authentication (MFA) as an added layer of security in comparison to relying on a password, which may or may not offer MFA.

Social login utilizes big companies like Google, Microsoft, and Apple's investment in keeping users’ accounts safe with a team of security experts working 24/7. These companies monitor accounts for unusual and suspicious activity, unauthorized access, and hackers. \

> **Myth #3**: Social Login isn’t safe cause it’s too easy.*

It’s really that simple. Ease of access ≠ lacks security. Social Login simplifies authenticating users as who they say they are while leveraging leading security measures. In other words, it’s simple authentication that does not sacrifice security. Remembering a password is more challenging and less secure. Weak or reused passwords pose a greater risk to personal data and security.

## Let’s Enable Our Users and Build Trust

Building trust with users is about more than just convenience. It requires a strong commitment to security, clear communication, and giving users the tools to protect themselves. Social login makes signing in easier while keeping accounts secure, but users should take extra steps to stay safe. Enabling MFA, reviewing permissions in Google, Microsoft, or Apple account centers, and staying aware of account activity all help strengthen security. When an organization provides these options and offerings, such as Auth0, allow for seamless integration, users take advantage of them, and online interactions become both safer and simpler.

Ready to rethink social login? Start implementing it in your apps, and learn more [here](https://auth0.com/learn/social-login)! Or [review some of our social login Labs](https://developer.auth0.com/resources/labs?topic=authentication)”

Demystifying Social Login

samantha-murphy

Samantha Murphy is a Principal Product Marketing Manager for Okta. She leads the Customer Identity Security portfolio, driving go-to-market strategy, messaging, launches, and strategic growth initiatives. Before Okta, Sam spent over six years in product management roles in Identity and Access Management.

She holds a Bachelor of Commerce degree from Queen’s Smith School of Business and is from Ottawa, Canada.

In her free time, Sam makes the most of winter by playing an awesome ice skating sport called ringette.

Principal Product Marketing Manager, Customer Identity

Samantha Murphy

Find out how you can improve your customers' security and authentication experience using CIBA.

Imagine you're a customer trying to resolve an urgent issue over the phone—for example, a bank transaction, an online order, or a technical support request. Before the agent can help, they need to verify your identity. They ask you for your security passcode, which you’ve forgotten. Then come the security questions: your birthday, your last bank transaction, your best friend's name. These questions are easily compromised and create security concerns.

This frustrating experience is all too common across industries. From financial services to retail, organizations face the challenge of verifying customers securely and efficiently for online, over-the-phone, and in-person interactions. That's where CIBA comes in.

In this blog post, we’ll explore how our new [**Client-Initiated Backchannel Authentication (CIBA**](https://auth0.com/docs/get-started/authentication-and-authorization-flow/client-initiated-backchannel-authentication-flow/user-authentication-with-ciba)**)** feature, part of Auth0, improves customer authentication for call centers and in-person interactions. CIBA makes authentication faster, more secure, and eliminates the need for outdated PINs or security questions.

## Moving Beyond Less Secure Security Questions and OTPs

Call centers are just one out-of-band scenario currently burdened with inconvenient and insecure authentication protocols. Say you’re trying to verify your Identity so you can personalize the settings in your new car, but in order to do so you need to go through a cumbersome process: open the car’s app, scan a QR code, open a browser and log in –all before you can update your personal settings. Or maybe you’re trying to pick up a retail order in person, but in order to do so, you need to authenticate yourself with security questions or personal information. The problem is that these questions are vulnerable to data breaches and phishing attacks (just like passwords) and revealing private information directly to agents creates obvious privacy concerns that customers shouldn’t have to deal with.

Some organizations may try to get around this by using SMS or emailing one-time passwords (OTPs). However, these methods often introduce an additional, cumbersome step into the authentication process and present security challenges. SMS for example is vulnerable to SIM Swapping, which allows attackers to intercept SMS OTPs. Email OTP assumes that the email account is secure, which may not be the case. Plus, both email and SMS OTPs are vulnerable to the typical phishing and social engineering attacks that trick people into compromising their OTP, and they lack biometric authentication methods (e.g. face ID, fingerprint, etc.).

CIBA offers a more consumer-friendly and secure way of authenticating “out-of-band” customers.

## CIBA: A Superior Approach to Out-of-Band Authentication

Safe, seamless brand experiences go beyond the login box. They extend to critical customer touchpoints—like when customers seek support over the phone, online, or in person. CIBA empowers businesses to deliver **both enhanced security and a smoother user experience**, leading to stronger customer satisfaction and better business outcomes. Let’s unpack what CIBA is and how it drives business success:

**Client Initiated Backchannel Authentication (CIBA)**—also known as a **decoupled authentication flow**—is a protocol that enables a client application (e.g., call center systems, POS terminals, in-person service tools, or autonomous AI Agents) to initiate the authentication process on behalf of the customer.

Let’s walk through an example workflow.

A user would like to withdraw from their bank and agrees to initiate the CIBA mobile app verification process.

![Initiate the CIBA verification process](https://images.ctfassets.net/23aumh6u8s0i/4Z2y3Etq6z8cYdxMHwEHDJ/636c00a03bb28fc64e73e1daebff455d/Uploaded_from_Okta_CIBA_blog_v1)

Right away, the user gets a notification on their phone to approve the request and authenticates with biometrics through the app.

![CIBA flow: the user gets a notification on your device](https://images.ctfassets.net/23aumh6u8s0i/3F7yYxI2qaHLys12sLQcuB/dcb6b0227f0388a95f369023b95f69f3/Uploaded_from_Okta_CIBA_blog_v1)

Lastly, the user approves the request and seamlessly and securely continues their withdrawal.

![CIBA flow: User approves the authentication request](https://images.ctfassets.net/23aumh6u8s0i/QOu1PqIN7gV6Bn5Mars8Q/bd13772e469354c82bfb62a0c780c77a/Uploaded_from_Okta_CIBA_blog_v1)

## Achieving Better Business with CIBA

CIBA improves your business and your customer experience with some great features:

### Stronger Security and Privacy

Traditional out-of-band authentication methods, like security questions or email/SMS one-time passwords (OTPs), are insecure and frustrating. CIBA replaces these outdated approaches with **secure, seamless in-app biometric authentication** (e.g., Face ID or fingerprint). A simple push notification lets customers verify their identity effortlessly with **just one tap**, without sharing sensitive personal information.

### A Financial-Grade Protocol

Trusted by financial institutions, CIBA is a **financial-grade protocol** that provides stronger safeguards against phishing and data breaches. By securing highly sensitive customer interactions, CIBA acts as a **robust fraud prevention tool**, protecting both businesses and customers from scams and breaches.

### Non-Repudiation for Trust

A CIBA authentication flow with the [Guardian mobile SDK](https://auth0.com/docs/secure/multi-factor-authentication/auth0-guardian) supports **non-repudiation**—so that neither party in a communication can deny their involvement. For example, in a call center scenario, this prevents customers or agents from disputing that certain information was exchanged. Non-repudiation builds trust and ensures authenticity for sensitive interactions.

### Enhanced Customer Experience (CX)

CIBA delivers smoother CX with **one-tap in-app authentication** —no browser redirects. This simple, efficient flow reduces abandonment rates, increases app engagement, and empowers customer-facing teams to drive satisfaction and business growth.

With [**Auth0 Guardian SDK**](https://auth0.com/docs/secure/multi-factor-authentication/auth0-guardian), you can further enhance CX by customizing every aspect of the CIBA customer journey to reflect your brand and meet unique business needs—creating an experience that’s as secure as it is smooth.

## CIBA in Action: Real-World Examples

A decoupled authentication flow leveraging CIBA adds a much-needed security boost to sensitive interactions, all while supporting seamless customer experiences across a number of different scenarios and use cases:

*   **Call center verification**.
Say you’re a financial services institution, and a customer is calling in to request help with their bank account. Using CIBA, the bank teller can authenticate the customer by sending a push notification to the banking app your customer has installed on their phone. There, they can confirm their identity using the already-enabled biometric sign-in. No more asking customers to share SMS passcodes or make their social security numbers, and (forgotten!) answers to security questions vulnerable by speaking them out loud.

*   **In-person verification**.
In all kinds of in-person scenarios (e.g., withdrawing money at a bank, checking into a hospital, picking up meds at the pharmacy) CIBA gives employees the option of confirming customers’ Identity in real-time by initiating a push notification sent immediately to their phone. The alternative in these situations is often asking customers to present physical documentation such as utility bills or their driver's licenses––an insecure authentication method that can leave customers vulnerable to fraud if they are stolen or compromised.

*   **Connected device verification**.
CIBA also allows internet-connected devices to initiate push notifications in IoT scenarios. For example, if a customer is registering a new car and customizing their settings, CIBA lets them kick off this process in an easy, authenticated manner by confirming their Identity through a push sent directly to a consumer app. Not only is this a more secure means of authentication, it also allows customers to avoid clunky options currently on the market, e.g., scanning a QR code that redirects to the app.

*   **POS terminal**.
In a retail environment that increasingly favors hybrid shopping experiences (e.g. ordering furniture online and picking it up in person) a CIBA flow allows customers to confirm their Identity on-site through self-serve kiosks that initiate a push notification sent to the customer’s phone. This not only keeps the transaction secure, but it also eases any labor constraints retailers might be experiencing by preventing employees from getting roped into the authentication process.

**Better security. Better CX. Better business.**.
CIBA represents a new addition to the security toolbelt for organizations looking for a more secure, more seamless way of authenticating users in call center scenarios and beyond.

Curious about where CIBA can improve your operations––and your bottom line? [Schedule a demo with your account rep](https://auth0.com/contact-us) to see it in action.

CIBA: Authenticate Customers in Call Centers and Other Out-of-Band Scenarios

eric wu

With over 7 years of experience in product marketing, I am passionate about creating and delivering impactful marketing strategies that drive customer value, business growth, and competitive differentiation. I have a strong background in launching new products, especially in Security, Generative AI and Cloud domains, where I have led several successful end-to-end product releases. I currently work as a Senior Product Marketing Manager at Okta, a leading identity and access management platform that empowers organizations to securely connect their people and technology.

Product Marketing Manager - Customer Identity Cloud

Eric Wu

Self-Service Single Sign-On (SSO) reaches General Availability (GA) status

As Independent Software Vendors (ISVs) quickly learn, in addition to building the core functionality of your software-as-a-service (SaaS) apps, you must also provide features that support your business customers’ administration, integration, and security needs.

One of the most challenging features to implement is Single Sign-On (SSO) due to the many competing standards and protocols available. Plus, merely supporting SSO is only one piece of the puzzle — it also has to get deployed:

* **From the perspective of each of your business customers**, setting up SSO for each and every app they’ve adopted can be a tedious process, often involving lots of back and forth with your customer service reps — and perhaps even your developers
* **For you as an ISV**, helping each and every business customer set up SSO for your app is just as tedious and time-consuming

Both parties benefit from a quick and simple deployment approach, which is why we’re excited to announce that our Self-Service SSO feature has reached General Availability (GA) status.

## SSO Is an Enterprise Imperative

Due to its associated benefits, Single Sign-On (SSO) — an Identity solution that allows multiple applications to use the same authenticated session — is an essential element of modern Identity and Access Management (IAM). SSO is so important, in fact, that it’s a foundational element of [the emerging Interoperability Profile for Secure Identity in the Enterprise (IPSIE) security standard](https://www.okta.com/blog/2024/10/oktane-2024-the-future-of-identity-security/).

On top of providing a convenient user experience, SSO dramatically reduces the number of credentials in use and helps to ensure that security policies are consistently applied across all of an organization’s applications, since the policies can be enforced at an organization’s Identity Provider (IdP).

Now that Identity has emerged as the primary enterprise security entry point, and with [organizations deploying more apps than ever before](https://www.okta.com/businesses-at-work/), SSO is needed more than ever.

### Simplifying SSO configuration saves time, reduces errors, and manages information risk

Self-service SSO refers to a flow that allows your business customers to set up and edit SSO connections themselves.

This capability delivers several valuable benefits, including:

* **Saving time for everyone:** Building Identity solutions isn’t your core business, and any time spent doing so pulls your team from product extension and innovation. With Self-Service SSO, your developers can focus more on your product instead of SSO integrations.
* **Reducing the potential for errors:** Manually configuring SSO introduces the risk of errors that impede productivity and undermine security. Self-Service SSO keeps manual tasks to a bare minimum.
* **Eliminating the need to share sensitive information:** Configuring SSO often requires the ISV and the business customer to share sensitive information (e.g., client IDs, SAML certificates, etc.), but Self-Service SSO eliminates these exchanges.

## How Self-Service SSO Works

Self-Service SSO requires minimal configuration in your Auth0 tenant and provides your customers with a setup assistant that guides them through the enablement process. After a customer completes their setup, the SSO integration is automatically added to your tenant as an [Enterprise connection](https://auth0.com/docs/authenticate/enterprise-connections).

Diving a little more deeply, Self-Service SSO uses three components to delegate setup to your customers:

* **Self-Service profile:** Defines key elements of customer SSO implementations, such as the IdPs they can use for SSO and which user attributes they must capture (e.g., email address)
* **Self-Service access ticket:** Grants customer admins access to the SSO setup assistant and sets specific details for their resulting SSO integration
* **SSO setup assistant:** A Self-Service Wizard that guides customer admins through the SSO setup process — enabling your business customers’ administrators to create, edit, and test SSO connections

You also benefit from additional **observability** features, including new tenant logs to monitor ticket consumption and the creation and enablement of connections; you can monitor logs to promptly initiate any tasks once the connection has been created.

At a high level, the Self-Service SSO workflow includes the following tasks:

1. You (the Auth0 by Okta customer) create a self-service profile in your tenant using the Auth0 Dashboard or the Management API.
2. Next, you use the Management API to create a self-service access ticket that allows customer admins to configure SSO.
3. You retrieve the ticket URL from the asset created in Step 2 and send this link to your customer admin.
4. Your customer admin launches the SSO setup assistant and follows the steps provided to create an application with their identity provider.
5. After the customer completes their setup, the SSO integration is automatically added to your tenant as an [Enterprise connection](https://auth0.com/docs/authenticate/enterprise-connections).

<include src="Vidyard" id="UPTUao1LfxdMLrnD38Gsxc" />

## Getting Started

As enterprises continue to adopt best-of-breed tools, IT and security leaders will increase their focus on access management strategies, like SSO, that can simultaneously support productivity and contribute to a strong security posture.

Whether you include SSO within your base product or offer it as a premium add-on, Self-Service SSO enhances your overall value proposition.

By empowering your customers to configure their own SSO integrations with your app, you can streamline your onboarding process and grant them more autonomy over their sign-on experience — while reducing the time and costs associated with managing SSO across your customer base.

**If you’d like to learn more about this new feature**, we invite you to peruse [the Self-Service Single Sign-On documentation](https://auth0.com/docs/authenticate/enterprise-connections/self-service-SSO).

**Want to launch a B2B SaaS application quickly?** Check out our reference application, [SaaStart,](https://auth0.com/blog/speed-up-your-customer-identity-journey-with-auth0-saastart/), a complete, working example of how to implement SaaS Identity with Auth0, built with the most popular frameworks developers use today. You can gain hands-on experience on Self-Service SSO and other essential CIAM features and quickly deploy a sample Auth0 template directly within the SaaStart [repo](https://github.com/auth0-developer-hub/auth0-b2b-saas-starter) or from [our new integration](https://vercel.com/integrations/auth0) in the Vercel marketplace.


Empower Your Enterprise Customers to Set up Their Own SSO Implementations

Nelson Matias

As a Group Product Manager at Auth0, I focus on delivering innovative solutions that enhance security and user experience for both businesses and developers. With hands-on experience as a Developer, Consultant, and Solution Architect, along with years of working in Technical Account Management, I’m passionate about solving complex problems and shaping the future of identity management.
Outside of work, I often watch football, listen to music, or spend quality time with my kids.

Group Product Manager

Continuous Session Protection empowers customers to meet a wide range of session and refresh token security needs, including custom lifetimes and revocation capabilities. Let’s dive deeper into how these features can enhance your security strategy.

Continuous Session Protection Now Available for Enterprise Customers

Nesh Popovic

As a Developer and Solutions Engineer for the past 20+ years, I've been involved in developing and selling secure and robust software solutions. When not helping my sales team deal with the complexities of software platforms, you can usually find me playing pickleball, basketball or backgammon.

Principal Solutions Engineer - CIAM

Learn how to set up an Amazon API Gateway and secure the REST API with Okta Customer Identity Cloud (CIC) Adaptive MFA Risk Score

Protecting REST APIs Behind Amazon API Gateway Using Okta

milan-khan

Milan is the Product Manager for advanced identity security features for customers operating in highly regulated industries. Milan is especially keen on solving consumer identity problems balancing user experience, security and compliance.

Senior Product Manager

Milan Khan

An introduction to Strong Customer Authentication (SCA), a mechanism for providing a higher level of security in sensitive contexts.

Strong Customer Authentication (or SCA for short) is a versatile authorization mechanism that first made waves in the financial services industry for digital payments, and adoption is picking up pace, even for non-financial transactions.

SCA was enacted in 2019 as a requirement of the [revised European Union (EU) Payment Services Directive (PSD2)](https://www.ecb.europa.eu/press/intro/mip-online/2018/html/1803_revisedpsd.en.html). Its main purpose is to raise security standards and reduce fraud for online and contactless payments, and it's now a part of life for millions of consumers in the EU.

PSD2 and its regulatory technical standards (RTS), along with inputs from the European Banking Authority in the form of opinions, questions, and answers, describe how SCA should be implemented by financial services organizations in EU member states. In summary and in relation to user security and authentication, this means:

- The payer needs to authenticate themselves with multi-factor authentication in order to authorize the payment.
- Multi-factor authentication (MFA) must comprise two (or more) of the following elements: knowledge, possession, and inherence.
- The payer (the consumer) gives informed consent to the payment amount and the payee's account.
- The payment transaction must be (cryptographically) linked to an amount and a payee specified by the payer (known as Dynamic Linking – this is what makes SCA different from typical “step-up MFA”).

In this blog post, we'll explore these SCA components and show how you can implement them using Auth0 by Okta! 

## Exemptions from Applying SCA

Strong Customer Authentication takes a risk-based approach, and there is a provision for exemptions to be applied to SCA. Low-risk scenarios that allow service providers not to apply SCA include:

- Payments to existing payees that have been previously authorized using SCA.
- Payments from one account to another account, where both accounts belong to the same account holder and are with the same service provider.
- The service provider has judged the payment transaction to be low risk through real-time risk and fraud analysis. The level of historic fraud will determine the threshold for amounts that can be exempted from SCA; i.e., lower levels of fraud will mean higher payment amounts can be exempt from SCA.
- Payments transactions below EUR 30 (or local equivalent) are considered "low value" and may be exempt from SCA. Service providers will have to request the payer to perform an SCA if the exemption has been used five times since the payer's last successful SCA or if the sum total of previously exempted payments exceeds EUR 100 (or local equivalent).

## Multi-Factor Authentication &mdash; Something You Know, Have, or Are

As discussed earlier, SCA mandates the use of at least two distinct authentication factors out of the three categories: knowledge, possession, and inherence.

- The **knowledge factor** is something the user knows, such as a password, a personal identification number (PIN), or an answer to a security question.
- The **possession factor** is something the user has, such as a telephone SIM card, a mobile device, or a smart card. Each of these typically has a cryptographic key, so the possession factor is essentially possession of a cryptographic key, preferably the private key of an asymmetric key pair.
- The **inherence factor** is something you are and is typically biometric verification where a user's captured biometric is compared to a reference template. This can be, for example, a fingerprint, facial, or voice biometric.

## Consent

Authorizing payments and any other sensitive transaction requires that the user know what they are authorizing and consenting to. SCA requires the user to view the payee and the payment amount before any authorization.

This concept of providing informed consent can also apply outside of payment scenarios for any sensitive transactions such as:

- Changing login and/or security settings
- Changing user profile settings, e.g., home address
- Sharing personal data

![Strong Customer Authentication user consent](https://images.ctfassets.net/23aumh6u8s0i/6kC16xojBEnAQLynhGuUM/bfb4bbeb85b87c2ab28e00faaff2a1a0/strong-customer-authentication-user-consent.jpg)

## Dynamic Linking &mdash; What Makes SCA Different

Dynamic Linking is what sets SCA apart from a regular step-up authentication prompt. Linking transaction details to the approval prompt allows users to double-check accuracy and avoid transaction tampering before approving the transaction.

When a payer (the consumer) initiates a payment, the transaction itself must be linked to the amount and payee specified by the payer. This dynamic linking generates an “authentication code,” which is unique and specific to the transaction (payee and amount). 

The authentication code is transferred through the payment and authorization processes. Any changes to the payment data (amount, payee) will invalidate the authentication code and, thus, the transaction.

> If you want to learn more about the details of SCA, here are some related documents:
>
>- Revised EU Payment Services Directive “PSD2”: [2015/2366 - EN - Payment Services Directive >- EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32015L2366) 
>- SCA Publication: [Strong customer authentication requirement of PSD2 comes into force - European Commission](https://finance.ec.europa.eu/publications/strong-customer-authentication-requirement-psd2-comes-force_en)
>- Regulatory Technical Standard for SCA: [Delegated regulation - 2018/389 - EN - EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32018R0389) 
>- Amendment on the RTS for SCA: [Final Report on the amendment of the RTS on SCA & CSC](https://www.eba.europa.eu/sites/default/files/document_library/Publications/Draft%20Technical%20Standards/2022/EBA-RTS-2022-03%20RTS%20on%20SCA&CSC/1029858/Final%20Report%20on%20the%20amendment%20of%20the%20RTS%20on%20SCA&CSC.pdf) 
>- Opinion of the European Banking Authority on SCA: [Opinion of the European Banking Authority on the implementation of the RTS on SCA and CSC](https://www.eba.europa.eu/sites/default/files/documents/10180/2137845/0f525dc7-0f97-4be7-9ad7-800723365b8e/Opinion%20on%20the%20implementation%20of%20the%20RTS%20on%20SCA%20and%20CSC%20%28EBA-2018-Op-04%29.pdf) 

## Strong Customer Authentication with Auth0 by Okta

[Highly Regulated Identity](https://auth0.com/docs/secure/highly-regulated-identity) (HRI) is a solution suite on the Customer Identity Cloud powered by Auth0 that delivers Financial Grade Identity™ that helps organizations elevate security, privacy, and user experience beyond login. HRI enables developers to meet the high levels of security required by companies operating within highly regulated industries like banking, insurance, and health care. You can also use HRI for other sensitive operations that require enhanced security, such as users updating their account information, admin or security settings, accessing sensitive data or apps, and more.

Here, we look at how Highly Regulated Identity can be used to build a Strong Customer Authentication solution.

### Solution architecture

The diagram below describes a possible architecture and interactions for a Strong Customer Authentication solution built on Auth0 by Okta using HRI features.

![Strong Customer Authentication flow in Auth0 by Okta](https://images.ctfassets.net/23aumh6u8s0i/31xqfrkhJVa87fbeplvGpz/459e46a7bcb42fd79aafbf1576eebdb6/strong-customer-authentication-flow-in-auth0-by-okta.png)

Important points to note:

- The blue  components are Okta-owned and part of Auth0 and Highly Regulated Identity solution suite.
- The green  components are built and maintained by the customer, e.g., customer mobile apps, applications, and services. 

### Sequence of operations

1. The user has initiated a payment transaction via their web browser at a digital banking web application, e.g., they may be making a payment from their bank account.

2. The digital banking web application sends the transaction request to Auth0:

   a. The transaction request may contain the “authentication code” for the amount and payee as part of the transaction. 

   b. The request is sent to the `/par` endpoint and avoids exposing sensitive transaction details at the browser.

3. Auth0 validates the request and generates: 

   a. A `linking_id` when the Consent Policy is configured as “Transactional Authorization with MFA” and the API audience is configured with this Consent Policy.

   b. A `request_uri` as a reference to the next step in the authorization process.

4. Auth0 sends the request_uri back to the calling web application .

5. The web application redirects the browser with the `redirect_uri`, which opens the login page in Auth0:

   a. The user can perform the login with their knowledge-based factor (i.e. their password). 

   b. This login step can be avoided if there is already a single sign-on session. 

   c. The user will wait here on this “holding page” until the decoupled flow completes.

6. Meanwhile, a [post-login trigger](https://auth0.com/docs/customize/actions/flows-and-triggers/login-flow#login-post-login) can run custom an Action code that extracts the authorization details (e.g., amount, payee, authentication code) from the transaction request.

   a. At this point, the Action code can integrate with third-party risk and fraud engines to determine whether a step-up authentication (i.e., SCA) is needed.

7. The Action writes the `linking_id` and contextual authorization details into a message store, i.e., a data store, for future retrieval.

8. Auth0 performs a lookup for the MFA mechanism to use; here, we will use a mobile push notification to a custom mobile app which embeds the Okta [Guardian SDK](https://auth0.com/docs/secure/multi-factor-authentication/auth0-guardian):

   a. Auth0 sends a mobile push notification to the mobile app, along with the `linking_id`.

   b. No transaction details are sent over the push notification.

9. The customer mobile app receives the push notification with the transaction `linking_id` and calls the message store to retrieve the transaction details for the user to authorize and consent to.

10. The customer mobile app extracts the authorization details for the requested transaction, i.e., payment amount and payee, and displays this to the user for consent.

    a. The user reviews the transaction details and proceeds to accept or decline.

11. The customer mobile app with embedded Guardian SDK calls the Okta MFA endpoint with the result of the user authorization:

    a. Was the MFA action completed successfully or not?

    b. If the MFA was completed successfully, did the user accept or decline?

12. Once the mobile push-based MFA completes, the web browser is redirected from Auth0 and the MFA page back to the digital banking web application:

    a. The digital banking web application receives an authorization code.

13. The digital banking web application exchanges the authorization code for an access token:

    a. The access token contains the details from the original transaction request, including the payment amount and payee and “authentication code”.

14. The digital banking application uses the access token to consume APIs in order to initiate the payment transaction in the appropriate back-end systems.

15. The user is informed of the outcome of the payment transaction.

### Supported authentication mechanisms

The solution architecture describes SCA using a mobile push notification to a customer's mobile app with embedded Guardian SDK. However, there are alternative options that are also compliant with SCA:

- Authentication by one-time passcode (OTP) sent via SMS.
- Authentication by WebAuthn.

For both of these authentication options, the user performs the authentication on the login page and then is shown the transaction details to authorize and consent to.

## Final Words

The Highly Regulated Identity solution suite on Auth0 delivers Strong Customer Authentication for financial services and payments. The SCA solution also applies to non-payment use cases and can be applied to any sensitive operation where step-up authentication, user authorization, and consent are required.

You can read more about [Highly Regulated Identity on the Auth0 by Okta documentation](https://auth0.com/docs/secure/highly-regulated-identity).


Strong Customer Authentication Explained

SaaStart allows devs to easily explore, gain experience with, and demonstrate key Customer Identity functionality

Getting started with Customer Identity and Access Management (CIAM) — especially for B2B SaaS apps — can be intimidating. What began as a fairly straightforward login box has grown into a comprehensive set of capabilities encompassing authentication, authorization, user lifecycle management, federation, and Identity security — all of which must comply with [a daunting array of ever-evolving regulations and standards](https://auth0.com/security).

At the same time, there’s no substitute for learning through hands-on experience. But the reality is that devs are already under enough time constraints and don’t always have the luxury of building sandboxes or proofs-of-concept from scratch.

That’s why we’re excited to unveil [SaaStart](https://saastart.app/), a reference B2B SaaS application built using Next.js and Auth0 by Okta.

Intended primarily for developers building B2B SaaS apps, [SaaStart](https://saastart.app/) provides a fast, safe, and accessible way for devs to explore, experiment, and get up and running with Customer Identity. You can easily deploy a sample Auth0 template from within [the SaaStart GitHub repository](https://github.com/auth0-developer-hub/auth0-b2b-saas-starter).

## Get Hands-on with Customer Identity

In Identity terms, essential features of an effective B2B CIAM solution include:

* **User registration**, to create the record that makes everything else possible
* **Authentication,** to establish with confidence that the users logging into accounts are who they say they are, using one or more factors to do so
* **Authorization,** to help organizations provide a user with the appropriate level of access to resources or applications
* **Delegated administration,** to enable customers and administrators to make updates and changes to users’ data and access

But — just as describing a car as a combination of engine, drivetrain, wheels, and steering mechanism is woefully insufficient at capturing what you can do with one or how to build one — simply summarizing these Identity elements doesn’t come close to telling the CIAM story.

To help fill in the blanks with practical experience, [SaaStart](https://saastart.app/) allows devs to explore CIAM within the look, feel, and functionality of a modern B2B SaaS application.

Using [SaaStart](https://saastart.app/), devs can get hands-on with:

* **Multi-tenant access control,** including administrative roles with control over the app’s configuration

![SaaStart](https://images.ctfassets.net/23aumh6u8s0i/19r62j5wQAyA9WaC03j62T/d4bc78054cbb4e4843d5154a4b8261be/Uploaded_from_Speed_up_Your_Customer_Identity_Journey_with_Auth0_SaaStart)

![SaaStart](https://images.ctfassets.net/23aumh6u8s0i/2g4TA8C7AkVObsBT9LTx4t/57a14e32fb52f571d52db9503c9b0653/Uploaded_from_Speed_up_Your_Customer_Identity_Journey_with_Auth0_SaaStart)

<br>

* **Log-in options for the modern extended workforce,** including Single Sign-On (SSO) for enterprise employees and email-based authentication for early adopters and smaller customers without their own Identity Providers

![SaaStart](https://images.ctfassets.net/23aumh6u8s0i/2HdILnTFaOOb7jfePCuJhG/57087f523ecea46c6a8ee89e5f13d6f0/Uploaded_from_Speed_up_Your_Customer_Identity_Journey_with_Auth0_SaaStart)

* **Security policies,** from enforcing a range of Multi-Factor Authentication (MFA) options and domain-based SSO to configuring session timeouts

![SaaStart](https://images.ctfassets.net/23aumh6u8s0i/35qq2OrUXesaKoxdSyX3ww/5990471670bd41b204cfe0b8d742ba8f/Uploaded_from_Speed_up_Your_Customer_Identity_Journey_with_Auth0_SaaStart)

* **User provisioning,** including just-in-time provisioning or automated user management using the System for Cross-Domain Identity Management (SCIM) - _coming soon_

* **API client management** with self-service create/delete capabilities - _coming soon_

## Everything Developers Need to Implement Customer Identity

SaaStart is just a taste of what’s possible with Auth0 by Okta.

With 10+ years as a pioneer in the CIAM space, we’ve leveraged cutting-edge technologies and architectures to create [a modern solution with an impressive collection of features and functions](https://auth0.com/blog/why-auth0-by-okta/).

Whether you’re building a B2C, B2B, or Hybrid application, Auth0 provides the foundational requirements out of the box with broad support for [open standards](https://auth0.com/learn/how-auth0-uses-identity-industry-standards) and a range of developer resources — including [Quickstarts](https://auth0.com/docs/quickstarts), [APIs](https://auth0.com/docs/api), and [30+ SDKs](https://auth0.com/docs/libraries).

In fact, with a few lines of code, you can integrate Auth0 into any app written in any language and any framework.

Plus, we’re proud to offer a number of discounted offerings that can help you get started and — thanks to a long list of features — are often sufficient for the longer term:

* Self-service options, including a [free trial plan](https://auth0.com/signup) that lets you get off the ground with up to 7,500 active users and unlimited logins — while also including social login, DB connection for securely storing Identity information, branded login, extensibility, and security capabilities (brute force and suspicious IP throttling), support for five regions (US, UK, EU, JP, AUS), and even passkeys
* [Auth0 for Startups](https://auth0.com/startups), which brings the convenience and security of Auth0 to eligible startup customers so they can focus on their core value propositions rather than spending more time than is necessary on Identity
* Our [Nonprofit Offering](https://auth0.com/nonprofits/get-started), which provides preferential pricing that makes the leading Identity service even more accessible to organizations on a mission to make the world a better place

## Speed up Time-to-Market with Auth0

We understand that developers would rather spend their time solving hard problems and leveraging their creative side to build really fun solutions. Auth0 enables you to do those by offloading some of the more mundane and frankly dull parts of creating a standards-based CIAM solution.

And [there’s ample evidence](https://auth0.com/customers) that outsourcing Customer Identity is the prudent approach. For instance, Okta’s 2023 report [How Development Teams Purchase SaaS](https://www.okta.com/resources/whitepaper-how-development-teams-purchase-saas-report/thankyou/) revealed that:

* **Authentication takes the third-most time and work to build and maintain in-house**, behind only “data management and storage” and “DevOps tooling and automation.”
* **Third-party authentication reduces time to market more than any other SaaS component** — 88% of organizations that use a third-party SaaS platform for authentication report reducing time to market

We invite you to visit our [Developer Center](https://developer.auth0.com/) to learn about Auth0, explore tutorials, download code samples, connect with us, find resources, and more.

If you have feedback about SaaStart or suggest other features to explore in future versions or new apps, please drop us a comment or open an issue on [the GitHub repo](https://github.com/auth0-developer-hub/auth0-b2b-saas-starter).

<include 
    src="LinkCard" 
    title="A B2B SaaS Application Primer Using Auth0" 
    link="https://auth0.com/blog/b2b-saas-application-primer-using-auth0/" 
    description="Are you building a B2B SaaS application using Auth0? Then check out our primer for more on delivering IAM functionality using the Auth0 Organizations feature."
img="https://images.ctfassets.net/23aumh6u8s0i/44Jbuzdh6CvHDaCJ6LJNLh/2a8d0114b1bd7b03a92a386cced73e6b/square-hero.jpg"
/>

Speed up Your Customer Identity Journey with Auth0 SaaStart

auth0_by_okta_hero copy

Auth0 Team

Offering expanded access and optionality for self-service plans and features

**TLDR**: 
Self-service customers have access to Auth0 capabilities that previously required a call with sales. Effective immediately: (1) customers can now upgrade to our B2B Professional Plan directly through the dashboard, (2) the Enterprise Connection limit in the B2B Pro plan has been increased from 3 to 5, and (3) Pro plans customers can now add a single Enterprise MFA factor (called 'Enterprise MFA Lite') via self-service.

In November 2023, we introduced [updated self-service plans and pricing](https://auth0.com/blog/upcoming-pricing-changes-for-the-customer-identity-cloud/) to scale with our customers. As a continuation of this work and based on your feedback, we now offer self-service customers easier access to plans and capabilities that previously required a discussion with sales.

### Here’s what’s new, effective May 2024:

* You can now choose our [B2B Professional Plan](https://auth0.com/pricing) using your dashboard! The B2B Pro Plan includes: 
    * 5,000 M2M Authentications (more available as add-ons)
    * M2M Add-on
    * External Database
    * Cross App SSO
    * 5 Enterprise Connections (increased from 3)
    * 100 organizations
    * And other features included in the B2B Essentials plan.

    _To upgrade: [Dashboard > Settings (Subscription Tab)](https://manage.auth0.com/#/tenant/billing/subscription) > Select Plan & Quota > Click Upgrade or you can continue to purchase this plan through our Sales team._

* **5 Enterprise Connections** for the B2B Professional Plan's Enterprise Connection limits have increased from 3 connections to 5 connections via self-service. This will allow more of our SaaS customers to scale more effectively. As a reminder, there is no limit on [Okta Enterprise Connections](https://auth0.com/docs/authenticate/identity-providers/enterprise-identity-providers/okta) for customers on all of our B2B plans.
* **Enterprise MFA Lite** is now available through self-service for both B2C and B2B Professional. This capability was only available via a contract with Sales, but it can now be added via the dashboard.
    * Enterprise MFA Lite allows you to add either SMS, push, or voice notifications to Professional plans for an additional fee. Fees vary by the amount of MAUs; find more information on [Dashboard > Settings (Subscription Tab.)](https://manage.auth0.com/#/tenant/billing/subscription)
    * This includes the support of push, [SMS, and voice notifications](https://auth0.com/docs/secure/multi-factor-authentication/multi-factor-authentication-factors/configure-sms-voice-notifications-mfa), (SMS charges for MFA are charged separately by carriers supported by Auth0). Under Enterprise MFA Lite, subscriptions will be limited to one MFA factor on the subscription. 

### MFA Offerings Explained

MFA ([Multi-Factor Authentication](https://auth0.com/blog/multifactor-authentication-mfa/)) provides a method to verify a user's identity by requiring them to provide more than one piece of identifying information. For example, **something you know**: a password, PIN, or security question, **something you have**: a smartphone, security token, or smart card, or **something you are**: your fingerprint, face scan, or voice pattern.

Some of our MFA offerings include: 

* **Pro MFA** &mdash; included in B2C Professional, B2B Essentials, B2B Professional, and Enterprise plans 
* **Enterprise MFA Lite Add-on** &mdash; an add-on for B2B and B2C Professional plans and Enterprise plans
* **Enterprise MFA** &mdash; included in our Enterprise Plans 

![Pro Plan Improvements for Self-Service Customers - May 2024](https://images.ctfassets.net/23aumh6u8s0i/sTrHbEBf42kTVlbfp6mRt/2459de4604259c2031a9808dd2111efa/MFA_Table.png)

<div class="alert alert-info alert-icon">
  <i class="icon-budicon-487"></i>
  <b> Please note that upgrading to B2B Professional and adding Enterprise MFA Lite to B2B and B2C Professional plans will incur additional fees. Visit our <a href="https://auth0.com/pricing">pricing page</a> for more information.</b><br> 
</div>

### Which MFA factor(s) are best for my product?

Choosing the right [MFA factor](https://auth0.com/docs/secure/multi-factor-authentication#mfa-factors) is all about striking a balance between security and user experience. Consider the sensitivity of the accounts you're protecting, the technical comfort level of your users, and the accessibility of the MFA factor across different devices. 

![Not All MFA is Created Equal](https://images.ctfassets.net/23aumh6u8s0i/5TgjqFrUJwTDkldGCqov7o/6d80ca9d9c0d29faebea01578a02e0b6/Not_All_MFA_is_Created_Equal.png "Not All MFA is Created Equal")
<p align="center"><i>From blog post: <a href="https://auth0.com/blog/not-all-mfa-is-created-equal/">Not All MFA is Created Equal</a></i></p>

<p align="left"</p>
To help evaluate our MFA offerings, visit this [blog post](https://auth0.com/blog/not-all-mfa-is-created-equal/) to learn about your options and for more details on factor types and authentication assurance levels, check out [this datasheet](https://www.okta.com/resources/datasheet-factor-assurance/).

### Have more questions about your plan or our MFA offerings?

We’re here to help! If you’re on a paid plan, our [Support team](https://support.auth0.com/) can help, and if you’re on a free plan, you can post in our [Community forum](https://community.auth0.com/). Thanks for being a valued customer. We hope this allows for more flexibility and optionality during your auth journey. Happy authenticating!

Pro Plan Improvements for Self-Service Customers - May 2024

Calah Vargas

Calah Vargas is the Associate Manager of Product Led Growth, focusing on nonprofits, startups, and partnerships. She works on product marketing and customer marketing initiatives. Outside work, you can find her cooking, trying new restaurants, and traveling with friends and family.

Associate Manager, PLG

Upgrading made easy: from in-house authentication to modern login flows, flexible user profiles, and the convenience and security of passkey

Imagine you’re working on a monolithic application that includes a home-grown authentication system. Over the years, the authentication function has received upgrades here and there to improve security and to stay reasonably up-to-date in a changing world.

Sooner or later — perhaps triggered by considering different growth paths and how best to make use of developer time — you start to recognize that your in-house Identity stack is a limiting factor:

* Integrating with partners and other technology components requires custom work
* Maintenance obligations are distracting from work on your core app
* Meeting regulatory requirements for privacy is an ongoing challenge 
* Providing different access privileges to different types of end users is becoming more complicated than ever anticipated
* With every breach headline, you’re reminded of the constant need to strengthen security

Shopper Approved found themselves in a similar situation — in 2017, the company’s ambitions were outgrowing the home-grown Customer Identity capabilities of their monolithic PHP app.

With that realization, the search was for a third-party authentication solution.

# Why Shopper Approved chose Auth0 by Okta 

Since its launch in 2010, [Shopper Approved](https://www.shopperapproved.com/) has helped over 20,000 eCommerce brands — from mom-and-pop shops to global enterprises — generate more online trust, visibility, and conversions.

> “We knew we wanted to replace our login and authentication mechanism, and we needed a solution that would ‘tango’ with our [Laravel](https://laravel.com/) front-end templating engine,” Christopher Budge, Shopper Approved’s CTO recalled, “but we didn't know which direction we wanted to go in.”

<include src="QuoteCard" body="The Self-Service pricing was really attractive to us. The other providers that we found were prohibitively expensive for what was initially an experimental project, and not a lot of them had the adaptability that we needed to integrate into our existing application." name="Christopher Budge" title="CTO" team="" company="Shopper Approved" />

While searching online for ideas and options, Budge came across Auth0 — and, in particular, the Self-Service plans.

> “The other providers that we found were prohibitively expensive for what was initially an experimental project, and not a lot of them had the adaptability that we needed to integrate into our existing application.”

The Self-Service option gave Budge and the wider team plenty of time to perform due diligence. “_We looked for a long time before ultimately deciding upon Auth0,_” he shared. “_The more I dug into it, the better it looked._”

The ability to explore the solution in a hands-on manner, without a commitment, helped the team to make an informed choice. Budge explained that:

<include src="QuoteCard" body="I got together with our technical lead and programming contractor, and they started playing with it — and then they said, 'Yeah, we think this is going to work." name="Christopher Budge" title="CTO" team="" company="Shopper Approved" />

While every organization’s Identity journey is unique, here’s how Shopper Approved implemented Auth0.

## Migrating Users from the Legacy System to Auth0	

No matter how much preparation is done, a migration is always a nervy thing. As it turns out, those nerves were unnecessary — Shopper Approved’s migration from their legacy, home-grown authentication system to Auth0 went off without a hitch.

Budge recalled, “_We weren't sure how well our system would adapt to having its old authentication system ripped out and something new put in its place, but the migration actually exceeded expectations. Within 24 hours, we were able to ingest our entire user database into Auth0 and have them set up as users able to log in._”

However, migrating users was simply the foundation for modernizing the experience for Shopper Approved’s customers, with Budge adding, “_The universal login allows for such a smooth application login and flow. And our marketing team has really appreciated the customization and branding options that allow us to deliver a better customer experience._”

### Letting quickstarts guide the way

One of the first things Budge’s team did was explore Auth0’s step-by-step [quickstart guides](https://auth0.com/docs/quickstarts) to get a feel for the overall migration process.

“The quickstart guides were dead easy. Plus, between your host documentation and the notes in GitHub, it’s really, really easy as a developer to figure out ‘where am I and where do I need to go?’” and ‘What’s next?’”

![quickstarts](https://images.ctfassets.net/23aumh6u8s0i/58lZcrqemW0dCDEIrlLxef/fd17a831afcbbe647abd73d3420e9d95/01-migration.png)

### Leveraging SDKs

SDKs reduce the developer effort required to implement specific use cases, and Budge’s team found exactly what they needed among Auth0’s 40+ SDK libraries.

“Your SDKs are written really well, and your APIs are documented really well. So, code-wise, it’s extremely easy to interact with the platform — you can get going and don’t really have to think hard about it.”

![SDKs](https://images.ctfassets.net/23aumh6u8s0i/1cSZQDXlQ1VDHD7RFG71vu/6922a4a4409f3bab6453b7b48f12541e/02-migration.png)

## Building User Profiles

User data can come from many sources, including your own databases as well as social, legal, and enterprise identity providers. Some examples include Google, Facebook, Active Directory, and SAML.

In Shopper Approved’s case, there was an added complication — practically every user profile that had ever been created in their system still existed, and collectively, many of these profiles had inconsistent and incomplete data. But, perhaps counterintuitively, the upgrade actually presented an opportunity to clean up the user database. Budge’s migration script identified existing user records that were poorly formatted, allowing the team to quickly correct any issues — ultimately improving the overall structure of the company’s user data and laying a strong foundation for efficient scalability.

“The way your user profiles are set up — they’re just really easy to understand, manipulate, and customize. The data structure was easy to map to what we had and what we needed.” Maybe even more importantly, Budge recalled that “It just worked. When we were playing around with it, we saw that it does exactly what [your documentation](https://auth0.com/docs/manage-users/user-accounts/user-profiles) says it does.”

![User Profiles](https://images.ctfassets.net/23aumh6u8s0i/3EfvAVkkj9Ornz9JcTH5CJ/1783bd310eb0cd0722dbbe754aa606c4/03-migration.png)

## Innovating With Identity: Exploring Passkeys

The Identity domain is always evolving, with new specifications, standards, and [regulatory requirements](https://auth0.com/security) frequently appearing.

Unsurprisingly, one of the reasons why Budge was so eager to introduce a leading off-the-shelf solution was that it would allow the company to keep pace with these changes — while at the same time allowing the team to apply their finite resources on their core value proposition. In short, he knew that choosing Auth0 meant that Shopper Approved’s CIAM needs would be met today, tomorrow, and as far into the future as he could imagine.

Like many CTOs, Budge had closely been following [passkeys](https://learnpasskeys.io/) — FIDO credentials that are discoverable by browsers or housed within native applications to enable — and was excited by their potential to provide [a highly secure and very convenient user authentication experience](https://auth0.com/blog/webauthn-and-passkeys-for-developers/).

> “I’ve been watching passkeys for a long time, and — literally the day I got [the announcement that they were available](https://auth0.com/blog/activate-passkeys-let-users-log-in-without-password/) — I jumped right in. We really enjoyed rolling them out early to our organization, and we’ve had zero issues. And it’s great that we didn’t have to build passkey support ourselves!”
> _Christopher Budge_

![Passkeys](https://images.ctfassets.net/23aumh6u8s0i/3qOGVNCBexcnp5LqxkAcNB/7a0c5eaa7bdb2cd37987795f7a504712/passkeys.png)

## Enjoying Ongoing Value

Budge’s hopes for lower support and maintenance obligations have come to fruition. “We have not had to spend a single development hour at all on user authentication and login — it's never failed, and it's never broken.”

Similarly, the upgraded security is evident. 

> “We've had many security researchers and penetration testers try to break in. Every time they run smack-dab into Auth0.”

<include src="QuoteCard" body="We have not had to spend a single development hour at all on user authentication and login — it's never failed, and it's never broken." name="Christopher Budge" title="CTO" team="" company="Shopper Approved" />

### Get started in minutes — for free — with no humans (other than yourself) required!

We’ve always tried to make things less complex for developers, which is why [our Self-Service plans](https://auth0.com/pricing) allow you to create a trial account with nothing more than an email address. During your 22-day trial period, you can create a simple app, configure its look and behavior, and explore the Auth0 solution in detail — giving you plenty of time to really get your hands dirty.

![Get started](https://images.ctfassets.net/23aumh6u8s0i/3s3e2u6XsF3BitzYgE3TpY/1097a71343e41a488444684c12c2c248/identity_journey.png)

Plus, anyone using our products can take advantage of resources including [quickstarts](https://auth0.com/docs/quickstarts), [40+ SDKs](https://auth0.com/docs/libraries), [detailed guides](https://developer.auth0.com/resources/guides/web-app/nextjs/saas-basic-authentication), and [extensive (but easy-to-follow) documentation](https://auth0.com/docs/articles) to help get started and implement a strong Customer Identity function.

In fact, with only a few lines of code, you can have Auth0 integrated into any app, written in any language, and in any framework.

[Try for free](https://auth0.com/signup?utm_source=whitepaper&utm_medium=auth0&utm_campaign=whyauth0) and see for yourself.


A Customer Identity Migration Journey

Shreya Gupta

Shreya is the Developer Advocate for Auth0 for Startups. She previously founded a non-profit called Bit Project, worked at a YC-backed Startup as a Developer Advocate, and currently hosts The Developer Diaries podcast. Through each experience, she has found her love for building resources and tools that help move the needle for developers. Outside of work, she enjoys traveling, watching K-Dramas, and drinking boba.

Developer Advocate, Startups

Before you start working with AI developer tools, understand what it could mean for you, your product, and your customers.

<div class="alert alert-info alert-icon">
  <i class="icon-budicon-487"></i>
  <strong>Note:</strong><br> 
  This blog post is based on interviews conducted with startup founders, engineering managers, data scientists, and risk analysts in the Artificial Intelligence and Machine Learning space.<br> 
</div>

Evaluating tools that can help optimize your development processes? Maybe you’re entirely building alongside [Devin, the first AI software engineer](https://www.cognition-labs.com/introducing-devin) to get your app to market faster, generating code snippets for your React app with [V0.dev](https://vercel.com/blog/announcing-v0-generative-ui), or using [GitHub CoPilot](https://thehackernews.com/2024/03/github-launches-ai-powered-autofix-tool.html) to help patch your website’s security flaws.

While productivity and efficiency are hallmarks of development success, security and privacy are just as paramount to protect your product and maintain customer trust. According to [Snyk’s 2023 AI Code Security report](https://snyk.io/reports/ai-code-security/), **80% of developers are bypassing security policies to use AI**.

But modern-day [Generative AI](https://news.mit.edu/2023/explained-generative-ai-1109) tools don’t typically have the built-in capability to determine whether the data it is exposed to is sensitive. It’s completely up to the user to take precautions and set up the proper protocols when choosing to use one of these tools. Let’s explore the potential risks of using AI tools in the dev process and what questions you could ask yourself to help make more informed decisions – for you, your product, and your customers.

## Productivity vs. Risk

According to Snyk’s blog, [How to Embed Security in AI-assisted software development](https://snyk.io/blog/snyk-and-atlassian-embed-security-ai-assisted-software-development/), “Code generation, using generative AI… is the area that stands to offer the greatest productivity benefits — **and the highest potential for introducing risk**.“

AI tools can help accelerate the process of taking an idea and building an MVP with limited resources. Although engineering productivity cannot be tracked by a single metric for all, it’s easy to see how these tools are already helping developers reduce time spent in generating code and improving the quality of code.

Like with all third-party tools, to strike the perfect balance between productivity and risk, it’s important to recognize ways in which these tools can hurt your product and customer security, now and in the future. In many situations, risk cannot be quantified, but companies can have an increased or decreased risk factor (risk tolerance) depending on:

* Industry
* Product type and use case
* Company stage

For example, risk tolerance can be higher for startups in growth mode, especially in industries outside of security.

## Risk Prevention Strategies

Let’s explore the most common risks associated with AI tools and mitigation strategies outlined by some engineers. 

Nonprofit OWASP (The Open Worldwide Application Security Project) documented a [list of potential security risks](https://owasp.org/www-project-top-10-for-large-language-model-applications/) when deploying and managing Large Language Models (LLMs) – some examples include:

* Sensitive Information Disclosure (LLM06) - LLMs can inadvertently disclose sensitive, proprietary, or confidential information leading to privacy breaches, intellectual property theft, and unauthorized access
* Prompt Injection (LLM01) - Attackers can manipulate LLMs through crafted inputs, causing the LLMs to execute the attacker’s intentions
* Overreliance (LLM09) - Systems or people overly dependent on LLMs without oversight may face misinformation, miscommunication, legal issues, and security vulnerabilities due to incorrect or inappropriate content generated by LLMs

When adding these tools to your tech stack, do these questions come to mind?

* How are you deciding which tools to use to increase your efficiency and productivity? 
* Do you have an internal vetting process for third-party vendors? How are you updating this for AI tools?
* Will you be prompting the AI tools with customer data and PII or proprietary restricted information? Are you in line with your applicable regulatory compliance frameworks? (GDPR, etc.)
* Does this tool abide by your corporate guidance?
* Do you have customer permission to use their data in this way?
* How could these tools impact you?
* What risks will you, your product, and your customers face?
* What guidance or guardrails does the tool have to protect your data as a user? Two popular types of AI developer tools are those for engineering productivity and those for general use, and the available configurations may vary.

We interviewed a few engineers (anonymously) about what they’re doing to minimize the risks associated with AI developer tools. Here’s a breakdown of some of the most common concerns and questions engineers are asking to reduce any harmful and inadvertent impact while coding with Gen AI tools.

* PI and copyright concerns
    * Once one of these tools generates code, who is the owner?
    * What happens if the tool is suggesting the same code to another customer, maybe even a competitor?
    * If you use AI tools in order to create a customer-facing chatbot, and a customer includes PII in their prompt – who is in charge of monitoring and removing this data and ensuring it isn’t being used to re-train models?
* Overreliance
    * Generating a few lines of code vs a few files of code – how familiar are you with the code in your product, and how much do you trust it?
    * Are you aware of the potential risk of [AI hallucinations](https://www.ibm.com/topics/ai-hallucinations) and how are you reducing it?
        * AI hallucinations are outputs from models that are nonsensical or inaccurate. For example:
            Question: where can I find the help center?
            Context: you’re looking for a website like [domain].com/help or support.[domain].com
            AI answer: the help center is located on the ground floor of this building.
* How are you updating your code and content review processes to deal with Gen AI?
* Data Exposure
    * Can you make sure your own data won't be used to answer prompts for competitors or malicious actors?
    * What are practical and technical strategies you can take to prevent data exposure?
    * Do you have strict policies and training for engineers when they are using these tools, or are you exploring third-party tools that tackle data leak prevention?

There’s no specific path to being completely secure from the risk of AI tools today, but there are many different strategies you can take to build strong guardrails to protect code and mitigate risk. Ensuring restrictions are very specific when engineers are using AI tools like Devin and code review is a must.

## AI Developer Tools Now and Tomorrow

AI tools for developer productivity are becoming increasingly popular. Further down the line, a startup founder might be able to ideate, possibly write [pseudocode](https://builtin.com/data-science/pseudocode), and use these tools to bring their idea to life. They might be able to start testing in a matter of minutes, not months.

If you’re an early-stage company, you might be eager to get started and may not have as much internal guidance as a large corporation. We hope this blog helps you start to outline the potential risks and considerations when evaluating AI tools for developer productivity. 

[Auth0 for Startups](https://auth0.com/startups) is empowering early-stage startups – tell us what we can do to best support you and your team!

_These materials and any recommendations within are not legal, privacy, security, compliance, or business advice. These materials are intended for general informational purposes only and may not reflect the most current security, privacy, and legal developments or all relevant issues. You are responsible for obtaining legal, security, privacy, compliance, or business advice from your own lawyer or other professional advisor and should not rely on the recommendations herein. Okta is not liable to you for any loss or damages that may result from your implementation of any recommendations in these materials. Okta makes no representations, warranties, or other assurances regarding the content of these materials. Information regarding Okta's contractual assurances to its customers can be found at [okta.com/agreements](http://okta.com/agreements)._

Security Considerations in the Time of AI Engineering

How to Evaluate a Customer Identity and Auth Solution


<div class="alert alert-info alert-icon">
  <i class="icon-budicon-487"></i>
  <b>This blog post references information found in our ebook: <a href="https://auth0.com/resources/ebooks/why-auth0-by-okta/">Why Auth0</a>.</b><br> 
</div>

**TL;DR:** Your login box must find the right balance between user convenience, privacy, and security. There are other solutions on the market that can help with that, but at Auth0, we know Identity is so much more than just the login box.

<AmpContent>
<amp-youtube
    data-videoid="ftnhO8EKkvo"
    layout="responsive"
    width="480" height="270">
</amp-youtube>
</AmpContent>
<NonAmpContent>
<div class='embed-container' style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%;margin-bottom:40px;"><iframe style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;" src='https://www.youtube.com/embed/ftnhO8EKkvo' frameborder='0' allowfullscreen></iframe></div>
</NonAmpContent>


When you’re deciding how your customers will log in to your website or application, your first step is probably figuring out if you’ll [build auth in-house or buy an out of the box solution](https://www.okta.com/resources/whitepaper-build-vs-buy/thankyou/). If you’re trying to get your app to market faster, want to reduce engineering costs, and want to mitigate security and compliance risks, a pre-built solution is the best option. It’ll help you achieve these goals and ultimately allow you to focus on what matters most - your core product. 

Once you're ready to take the next step and purchase, it's time to evaluate your best option. Here’s a list of what to consider when choosing a solution:

**Ease of Implementation**: Will the solution help you build your product and achieve product-market fit quicker than your competitors? There’s a big difference between getting some basic login functionality working and having a stable, scalable, and prime-time-ready Identity infrastructure in place. Depending on your industry and customer requirements, you’ll need to optimize your Identity flow for security and privacy, user experience, and, in most cases, convenience – while also building an experience that can easily be updated and maintained. 

**Scalability and Reliability**: Will the solution support you today, tomorrow, and in the future? Can the solution quickly adapt and scale to meet your website’s or app’s needs? Identity might be too large of a domain for your team to tackle all at once. Most companies start with the basics and then gradually add features over time. By understanding where you are today and where you could be in the future, the solution should support your team in delivering an Identity roadmap that enables growth, addresses security, and meets ever-growing customer expectations.

![A Comprehensive Guide for Your Customer Identity Maturity Journey](https://images.ctfassets.net/23aumh6u8s0i/1PbSZDO561aYL0h4xJvND5/6d4f881c91e7db71b93a12bc73c07f03/why01.jpg)
Source: [_A Comprehensive Guide for Your Customer Identity Maturity Journey_](https://www.okta.com/resources/whitepaper-a-comprehensive-guide-for-your-customer-identity-maturity-journey)

<p align="right"></p>

**Security and Compliance:** Last but definitely not least, does the solution comply with new and evolving regulations? Does it meet the requirements for multiple compliance frameworks and certifications? Identity as a domain is governed by an increasing — and increasingly complex — array of data regulations that require you to implement effective safeguards and put users in control of their own data. 

![Security and Compliance](https://images.ctfassets.net/23aumh6u8s0i/3D6mlCWBdASCBOzIXrpDEv/f4818a5d14aa504d334fdd648bc1181f/2176574_Why_Auth0_Feature_Table_Copy_013125_1080x1080_2_021924.jpg)

Whether you’re building a B2C, B2B, or Hybrid application, Auth0 provides the foundational requirements out of the box with broad support for [open standards](https://auth0.com/learn/how-auth0-uses-identity-industry-standards), allowing you to customize your solution with [APIs](https://auth0.com/docs/api), [30+ SDKs](https://auth0.com/docs/libraries), and [Quickstarts](https://auth0.com/docs/quickstarts). With a few lines of code, you can have Auth0 integrated in any app written in any language and any framework. 

At Auth0, security is not an afterthought. We have you covered with features to protect your organization and customers. Our product is an extension of yours – as customers, your requirements and feedback guide our product development. We also do the hard work of complying with [new and evolving regulations](https://auth0.com/security), so you have one less thing to worry about. These include:

* Researching threat actor tactics, techniques, and procedures (TTPs) and introducing the advanced security features needed to combat these threats
* Host, platform, and application-layer defenses to filter malicious entities before they can even access the login box or API
* [Adaptive MFA](https://auth0.com/docs/secure/multi-factor-authentication/adaptive-mfa), an extensible MFA policy that can help you protect your tenant from bad actors without increasing friction for real users
* Login-layer defenses that prevent fraudulent signups and account takeovers, including [Attack Protection features](https://auth0.com/docs/secure/attack-protection) that can be turned on with a simple toggle
* [Observability tools](https://auth0.com/docs/secure/security-center) that allow you to see potential attack trends and quickly respond to them in real-time
<br><br>

Extensibility is at our core. With [Actions](https://auth0.com/docs/customize/actions), you can write custom Node.js functions that fire during specific events in your Identity flow – develop complex Identity flows on our platform instead of piling on your own infrastructure. [Actions Integrations](https://auth0.com/blog/actions-integrations-are-now-ga/) make extending Auth0 with partner-built innovations even easier, often with no-code, drag-and-drop ease. Instead of building and maintaining custom code, Actions Integrations are easily integrated third-party solutions that can be quickly added to extend your Identity flow. Since launching in late 2020, the [Auth0 Marketplace](https://marketplace.auth0.com/) has helped developers quickly find and install third-party Identity solutions for their applications and APIs. Today, the Marketplace includes more than 300 third-party solutions.

Identity is important to your organization, but it’s not the reason you exist — and whatever that reason is should be the main focus of your engineering resources. Identity also requires significant effort and deep expertise. Choose an Identity provider that doesn’t just provide a login box but a service based on learnings from helping 18,000+ customers. See why customers are choosing Auth0, the comprehensive Identity solution, and solving Identity with [Passkeys](https://learnpasskeys.io/), [Organizations](https://auth0.com/blog/digital-identity-management/#B2B-Ready-with-Auth0-Organizations), and more: [okta.com/customers](https://www.okta.com/customers/). 

[Try Auth0 free today](https://auth0.com/signup?utm_source=blog&utm_medium=auth0&utm_campaign=whyauth0) with up to 7,500 active users and unlimited logins; no credit card is required. If you’re an early-stage company, check if you’re eligible for our Auth0 for Startups program [here](https://auth0.com/startups). We are also proud to offer [preferential pricing for nonprofits](https://auth0.com/nonprofits/get-started)—making the leading Identity service even more accessible. 

<div class="alert alert-info alert-icon">
  <i class="icon-budicon-487"></i>
  <b>If you’re interested in learning more about build versus buy, Auth0’s features, or anything else included above, check out our ebook: <a href="https://auth0.com/resources/ebooks/why-auth0-by-okta/">Why Auth0</a>.</b><br> 
</div>

_These materials and any recommendations within are not legal, privacy, security, compliance, or business advice. These materials are intended for general informational purposes only and may not reflect the most current security, privacy, and legal developments or all relevant issues. You are responsible for obtaining legal, security, privacy, compliance, or business advice from your own lawyer or other professional advisor and should not rely on the recommendations herein. Okta is not liable to you for any loss or damages that may result from your implementation of any recommendations in these materials. Okta makes no representations, warranties, or other assurances regarding the content of these materials.  Information regarding Okta's contractual assurances to its customers can be found at[ okta.com/agreements](http://okta.com/agreements)._


Why Auth0?

michael-swanson

I live in Austin, TX with my wife, Anneke, and our two kiddos, Ilya (5) and Everett (2). I am a native Texan but lived in multiple places across the southern US as a kid. I have family in Houston TX and Midland TX that we visit on a regular basis. Prior to joining Okta, I worked with early stage startups as a hands-on Product Manager, team lead, and product designer, while also writing (mostly frontend) code. 
<br>

When I am not working you can usually find me chasing my kids around, reading sci-fi or fantasy novels, or playing needlessly complex strategy board games with friends. I am also a huge Star Wars fan and am always down to talk about the latest Star Wars movies, TV, and/or books. Additionally, Anneke and I love to travel and have been all over the world together. Much of our travel focuses on getting out of the Texas heat, tasting and learning about wine, and sampling the amazing food we find along the way!


Michael Swanson

Customers and trial customers on Enterprise and Professional plans can now customize signup and login flows to address unique needs.

Each company has unique user registration and login requirements, for example, needing to capture a first and last name during signup or requiring users to agree to terms and conditions before they can create an account. 

In order to meet specific business needs and use cases, companies often have to build and maintain different experiences – hosted pages and sites – within their account registration and login flow(s). Unfortunately, this approach slows down the time to market by introducing separate code bases that require localization and maintenance while also creating an inconsistent customer experience.

To solve this problem, we have introduced custom prompts for signing up and logging in to Universal Login. This capability is now open for early access (EA) and available to our customers and trial customers on Enterprise and Professional plans. 

## Addressing Unique Use Cases

With custom prompts for signup and login, our customers can customize and add new fields to existing signup and login prompts; this includes client and server-side validation to ensure that required data and requirements, such as Terms of Service (TOS) acceptance, are completed and validated before completing the signup or login process. 

Leveraging Universal Login and our extensibility framework, our customers can tailor these two experiences to address data capture, security, regulatory, and customer experience requirements. Use cases included:

- Add new fields in order to collect necessary customer data (name, phone number, email, preferences, consent, etc.) 
- Add new form elements for presenting and capturing TOS/privacy policy and opt-in before sign up
- Add custom content such as URLs, images, marketing information
- Localize custom text in different languages

## Getting Started

During open early access, this feature will be automatically available to all of our Professional and Enterprise customers and trial accounts. To get started, please check out our documentation [here](https://auth0.com/docs/customize/universal-login-pages/customize-signup-and-login-prompts). If you have any questions, please reach out to your Account Executive.  

Before closing, I want to give a shout-out to our customers who provided feedback during the limited EA. We had over 75 customers join and received invaluable feedback. This underscores the importance of this capability, which we’ll continue to evolve and shape based on customer feedback, so please let us know how it goes.  


_Any products, features, or functionality referenced in this material that are not currently generally available may not be delivered on time or at all. Product roadmaps do not represent a commitment, obligation, or promise to deliver any product, feature, or functionality, and you should not rely on them to make your purchase decisions._


Customizations for Sign up and Login Now in Open Early Access

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

Compromised credentials are a threat to your business and customers. Here’s how to reduce the risk.

Credential stuffing is a type of cyberattack in which a cybercriminal uses stolen usernames and passwords from one organization (obtained in a breach or purchased off of the dark web) to access user accounts at another organization.

Credential stuffing attacks are one of the most common causes of data breaches because[ 64% of all people](https://f.hubspotusercontent20.net/hubfs/3791228/2022%20SpyCloud%20Annual%20Identity%20Exposure%20Report.pdf) reuse the same password on multiple (and sometimes all) accounts. In fact, on Auth0's platform alone,[ nearly half of all login requests](https://auth0.com/resources/whitepapers/credential-stuffing-attacks) we receive each day are attempts at credential stuffing.

The opportunity for cybercriminals to use credential stuffing is only growing as more credentials are exposed through breaches; at present, literally billions of compromised credentials are circulating on the dark web. 

However, credential stuffing attacks are preventable if you implement the right cybersecurity measures. Below is what executives need to know about credential stuffing attacks and what can be done to reduce or prevent the likelihood that their organizations will be a victim of one.

> More in the following:
>
> - **[Credential stuffing whitepaper](https://auth0.com/resources/whitepapers/credential-stuffing-attacks)**
> - **[What is broken authentication](https://auth0.com/blog/what-is-broken-authentication/)**

## How Credential Stuffing Works

To execute a credential stuffing attack, cybercriminals add a list of stolen username and password pairs to a botnet that automates the process of trying those credentials on multiple sites at once. Large-scale botnet attacks can overwhelm a business' IT infrastructure, with websites experiencing as much as[ 180 times](https://auth0.com/blog/auth0-reveals-50000-credential-stuffing-attempts/) their typical traffic during an attack.

![Anatomy Credential Stuffing](https://images.ctfassets.net/23aumh6u8s0i/ohyMA4nbwQgkGF77RnSOs/b8997e017022790f156a985fb97c375d/anatomy-credential-stuffing.jpg)

Once cybercriminals find a site where a set of credentials works, they’ll have access to a user's account and personal data to do with as they please, which most commonly includes:

* **Selling access to compromised accounts:** This is particularly common for media streaming services. [Disney+](https://www.cpomagazine.com/cyber-security/new-disney-plus-streaming-service-hit-by-credential-stuffing-cyber-attack/),[ Netflix, and Spotify](https://www.engadget.com/2019/03/13/wickedgen-admin-arrested-stolen-passwords-netflix-spotif/) have all been victims of attacks in which hackers sold access to user accounts for less than the cost of a subscription.
* **E-commerce fraud:** Hackers can impersonate legitimate users at retailers' websites and order a high-value product, either for their own use or for reselling. This is a common (and for criminals, potentially lucrative) form of identity theft, which makes retail the most vulnerable vertical for credential stuffing, according to[ research from Akamai](https://www.akamai.com/newsroom/press-release/akamai-research-commerce-remains-top-target-with-over-14-billion-web-application-and-api-attacks).
* **Corporate/institutional espionage and theft:** While the above crimes have serious consequences for companies and their customers, this third form of attack has the potential to be most devastating for businesses. If an attacker successfully hijacks the account of an employee or admin, they could gain access to all sorts of sensitive personal information, like credit card numbers, social security numbers, addresses, and login credentials as well, all of which they can sell to the highest bidder.

## The Costs of Credential Stuffing Attacks

Although credential stuffing attacks often have a low success rate ([usually one to three percent](https://www.recordedfuture.com/credential-stuffing-attacks/)), their impact on organizations is often anything but small.

For example, the Ponemon Institute's ["Cost of Credential Stuffing" report](https://library.idgcommunications.net/idgcampaigns/documents/uploaded_data/d40/97b/1c-/original/the-cost-of-credential-stuffing_EN.pdf) found that businesses lose an average of $6 million per year to credential stuffing in the form of application downtime, lost customers, and increased IT costs.

Increasingly, regulators, as well as the public, are also holding companies accountable for credential stuffing attacks with stiff fines. Companies may be subject to legal action under data privacy laws such as [GDPR](https://auth0.com/docs/compliance/gdpr) if they fail to implement adequate security measures to prevent such attacks, fail to inform the public of a breach, or don't do enough to protect passwords.

For example, in 2018, the UK's [Information Commissioner's Office (ICO) fined Uber](https://www.computerweekly.com/news/252453244/ICO-fines-Uber-385000-for-data-protection-failings) £385,000 for "a series of avoidable data security flaws" that exposed the data of approximately 2.7 million UK customers. And in 2021, the French Data Protection Authority (CNIL) fined a data controller and its data processor €225,000 “for failure to implement adequate security measures to protect customers’ personal data against credential stuffing attacks on the website of the data controller.”

## Credential Stuffing Attacks vs. Brute Force Attacks

Credential stuffing is considered a type of brute force cyberattack. But in practice, the two are very different, as are the best ways to secure your systems against them.

Brute force attacks attempt to guess passwords by changing the characters and numbers (often in prescribed patterns or with commonly used base password phrases). To protect against them, you can limit the number of failed login attempts with[ brute force protection](https://auth0.com/docs/attack-protection/brute-force-protection), use a CAPTCHA, or require your users to use a stronger password.

However, a strong password won’t stop a cybercriminal from gaining access to an account via credential stuffing because the password is already known. Even CAPTCHA's or brute force protection’s ability to protect users is limited since users often[ change their passwords in predictable patterns](https://www.sans.org/security-awareness-training/blog/time-password-expiration-die) and cybercriminals have a breached password to iterate from.

## How to Prevent Credential Stuffing Attacks

Most people know password reuse is unsafe but choose to use the same password on multiple sites anyway because they have roughly[ 100 passwords to remember](https://tech.co/news/average-person-100-passwords). Password managers are an option, but [adoption rates are low](https://www.security.org/digital-safety/password-manager-annual-report/). So to prevent credential stuffing attacks, it’s up to organizations to take measures — such as removing passwords altogether — to ensure cybercriminals can’t use stolen credentials to access their users’ accounts. Based on [OWASP's Credential Stuffing Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Credential_Stuffing_Prevention_Cheat_Sheet.html), below are several methods for doing so.

### Credential hashing

Credential hashing is the first step to protecting your user's credentials from theft. [Hashing](https://auth0.com/blog/hashing-passwords-one-way-road-to-security/) scrambles a user's password before you store it in your database so that in the event that it is stolen, a hacker won’t be able to use them (in theory, at least).

In practice, not all password hashing is uncrackable. As Rick Redman, a penetration tester at KoreLogic, [explains](https://www.wired.com/2016/06/hacker-lexicon-password-hashing/), “The strength of the hash is the insurance policy. It tells you how much time users have to change their passwords after a data breach before they come to harm... If it’s just SHA1, there is no window... If it’s bcrypt, you have time to run away and change all your passwords.”

So although hashing user passwords won’t prevent a credential stuffing attack, it will limit what a cybercriminal can do with those passwords once they’ve stolen them.

### Breached password protection

Breached password protection compares the password a person uses to log in against databases of compromised credentials (like[ haveibeenpwned](https://haveibeenpwned.com/)) to prevent credential stuffing in real-time. 

For example,[ Auth0's breached password detection](https://auth0.com/docs/attack-protection/breached-password-detection) can be configured to notify a user, block them from logging in, or request an additional authentication factor (MFA) if it suspects their credentials were part of a published security breach or if a login attempt came from a suspicious IP address.

### Bot detection

As mentioned earlier, attackers use bots to execute a credential stuffing attack. [Auth0's bot detection](https://auth0.com/docs/secure/attack-protection/bot-detection) feature is able to identify a bot attempting to authenticate with [a high percentage of success](https://auth0.com/blog/auth0-bot-detection-reduces-bot-attacks-by-79/). It provides protection against credential stuffing attacks with very little friction to legitimate users. When a bot attack is detected, it displays a CAPTCHA step in the login experience to eliminate bot and scripted traffic.

### Anomaly detection

Monitoring what is happening is always a good approach to intervene earliest and stop an attack. If you have visibility of your traffic, you can understand when you are under attack, and you can take action to mitigate attacks. In Auth0, you can use [Log Streams](https://auth0.com/docs/customize/log-streams) to monitor your traffic in near real-time. After creating and configuring a Log Stream, you will start seeing Auth0 events being ingested into your chosen monitoring service. Based on your monitoring service, you can build your anomaly detection dashboard by anayzing the [Attack Protection Log Events](https://auth0.com/docs/secure/attack-protection/view-attack-protection-events).

### Multi-Factor Authentication (MFA)

[Multi-factor authentication (MFA)](https://auth0.com/multifactor-authentication) is a highly effective way to prevent credential stuffing because it requires users to log in with another form of authentication in addition to a username-password combination. For example, this could mean biometric authentication such as a fingerprint, a one-time code sent to a device associated with the user, or an email sent to a secured account — none of which a cybercriminal will have access to.

Although the adoption of MFA has been slow due to concerns about its impact on customer experience, the increase in sophistication and customizability of MFA are helping it catch on. For instance, in February 2020,[ Google announced](https://siliconangle.com/2020/02/12/google-require-nest-users-use-two-factor-authentication-enhanced-security/) it would require Nest smart home users to use two-factor authentication.

### Continuous authentication

Continuous authentication systems use factors like biometrics or behavioral patterns to verify a user’s identity in real-time (while they use an application) instead of a password. As a result, credential stuffing attacks (as well as a number of other cyberattacks) are no longer a viable method for cybercriminals to gain unauthorized access to a user’s account.

### Passwordless authentication

[Passwordless authentication](https://auth0.com/passwordless/) can prevent credential stuffing altogether because it verifies a user with something they have (a device or another account) or something they are (biometrics) instead of a password (something they know).[ Passwordless](https://auth0.com/passwordless/) also creates a better login experience for users and saves organizations time and money from dealing with password resets.

## Passwordless Authentication Is Better for Businesses and Users

Not only does passwordless authentication eliminate credential stuffing attacks, but numerous studies and reports show that it is a[ more secure](https://auth0.com/blog/is-passwordless-authentication-more-secure-than-passwords/),[ more user-friendly](https://www.lastpass.com/solutions/passwordless-access/from-passwords-to-passwordless), and[ more cost-effective](https://www.weforum.org/press/2020/01/forgotten-your-password-not-having-one-will-make-you-safer-says-world-economic-forum) solution overall than traditional username-password authentication for both businesses and their users.

“Relying on passwords as the primary means for authentication no longer provides the security or user experience that consumers demand,” Andrew Shikiar, Executive Director of the FIDO Alliance, [explains](https://www.weforum.org/press/2020/01/forgotten-your-password-not-having-one-will-make-you-safer-says-world-economic-forum) in a joint report with the World Economic Forum. Adrien Ogee, Project Lead from the World Economic Forum, adds, “Better authentication practices are not just possible; they are a necessity.”

Auth0’s platform makes it easy to implement secure, user-friendly passwordless authentication using biometrics, social logins, and more. Learn how to eliminate the risks associated with traditional username and password authentication with Auth0’s Passwordless authentication platform[ here](https://auth0.com/passwordless/).

What Is Credential Stuffing? How To Prevent Credential Stuffing Attacks

How SafeBase Uses Auth0 to Lead the Way in Customer Trust

## Leading the Way in Customer Trust

The security startup, [SafeBase](https://safebase.io/), is defining the standard for customer trust management. Through the SafeBase [Smart Trust Center](https://safebase.io/showcase), companies are able to share their security posture and eliminate security review friction, ultimately leading to more closed deals. “Implementing good security controls as you’re a growing company is very hard, and it’s always under-invested,” said SafeBase’s Co-Founder & CTO, [Adar Arnon](https://www.linkedin.com/in/adarnon). 

We sat down with Adar, and he shared that their approach was aimed at helping companies grow. Their goal is to eliminate human time spent on security communications like sharing SOC2 or Pentest reports, security questionnaires, or incident breach notifications. While these are crucial to maintaining customer trust, they can be time-consuming and a bottleneck to closing deals. Arnon explains that these processes can be “...super manual, and that’s what we decided is worth solving.” 


<include src="QuoteCard" body="As we’re growing with these customers, something that’s very clear is that big customers really care about identity management and security." name="Adar Arnon" title="CTO & Co-Founder" team="" company="SafeBase" />


The impact SafeBase has had on their [customers](https://safebase.io/customer-love) since their 2020 inception is truly exciting. They’ve taken historically frustrating and tedious security processes and created a product that allows companies to become more efficient, ensuring stakeholders have fewer security review emails in their inboxes. That’s a total win in our book. 

## Choosing Auth0, a Standard in Authentication and Authorization

Once SafeBase started adding users, they determined that it didn’t make sense to implement their own user management system. Upon asking his network, Adar shared, “...it sounded like Auth0 was the agreed-upon standard. Auth0 offered a platform that we felt could grow with us while providing good support.” Other factors that were evaluated were Auth0’s [tech stack](https://auth0.com/docs/quickstarts) and [documentation](https://auth0.com/docs). 

One of the key features the team benefits from is [Universal Login](https://auth0.com/docs/authenticate/login/auth0-universal-login), specifically because they do not have to deal with maintaining the front-end or back-end. The SafeBase team determined Auth0 was a good solution and joined our startup program to help them scale. 


![Why Auth0](https://images.ctfassets.net/23aumh6u8s0i/6fQxARcY6WWbfOE8wiClfN/6521c4ef2961cb12bf461db6ca037f9a/SafeBase_Checklist_-1.png)

## Join SafeBase and the Other 1700+ Startups That Benefit from Auth0

The [Auth0 for Startups](https://auth0.com/startups/profiles) program brings the simplicity, extensibility, and scalability of Auth0 to qualifying startups – **all free for one year**. We are passionate about helping startups get their applications up and running while we take care of identity needs. So much so that we recently [expanded our eligibility](https://auth0.com/blog/auth0-for-startups-expands-eligibility/) by increasing the funding limit to $5M, doubling our previous cap. If you have any questions, you can find us at [startups@auth0.com](mailto:startups@auth0.com) or apply [here](https://autheco.atlassian.net/servicedesk/customer/portal/4/group/9/create/101). 

A special thank you to Adar and the entire SafeBase team. If your organization is looking to build your own Smart Trust Center, [schedule a demo](https://safebase.io/schedule) today. 

_This profile is the fourth installment in our series highlighting members of the Auth0 for Startups program. The Auth0 for Startups program began in 2020 and has since worked with 1700+ startups._

Startup Stories: SafeBase

Catherine Razeto

Catherine Razeto is a Staff Data Scientist on the Machine Learning team for Okta's Customer Identity products. She focuses on developing threat detection models to secure our customers' applications. She led the development of the machine learning engine for the Bot Detection security feature. She is interested in classification problems, anomaly detection and fraud detection at-scale.

Staff Data Scientist

The aggregated score indicates the level of bot activity seen across all CIAM customer login flows

From online retail to social media — and everything in between — bots are (one of the reasons) why we can’t have nice things. As we examine in detail in our[ State of Secure Identity Report](https://auth0.com/resources/whitepapers/2022-state-of-secure-identity-report), these digital automatons plague Identity flows at all parts of the user journey:

* Fake signups defraud registration forms and pollute customer intelligence systems;
* Brute force attacks use breached passwords in account takeover (ATO) attacks; and
* Malicious bots burden app owners with scams and spam, degrading the user experience.

Consumer-facing apps, in particular, must identify and filter out bots as part of their security and growth objectives — and since day one, Auth0 has devoted considerable effort to helping our customers do just that.

## Bot or Not?

As a vital part of the[ Attack Protection](https://auth0.com/docs/secure/attack-protection) add-on in the[ Okta Customer Identity Cloud](https://www.okta.com/customer-identity/), our[ Bot Detection](https://auth0.com/docs/secure/attack-protection/bot-detection) feature mitigates scripted attacks against native applications, passwordless flows, and custom login pages.

By correlating a variety of data sources — like past events associated with an IP address, recent login history, IP reputation data, and an assortment of other factors — we can detect when an Identity request is likely to be coming from a bot. When the Bot Detection feature detects bot or scripted login requests, it triggers a CAPTCHA step in the login flow.

Over the years, we’ve continually refined our bot detection capabilities: today’s version employs a machine learning (ML) model that ingests 60+ inputs — and when we introduced this new system last year, it[ reduced bot attacks by 79%](https://auth0.com/blog/auth0-bot-detection-reduces-bot-attacks-by-79/) above and beyond its precursor.

Importantly, the improved defensive capabilities were achieved without the expense of user friction: even during attacks, fewer than 1% of challenges are shown to legitimate human users.

## Building on Bot Detection: The Identity Threat Level (ITL)

Being at the ‘front door’ of applications with a Customer Identity and Access Management (CIAM) solution that secures billions of login transactions per month, Auth0 has a unique vantage point from which to monitor Identity threats.

This powerful perspective was the genesis of the Identity Threat Level (ITL), a score from 0 to 10 that indicates the level of bot activity targeting CIAM systems: a score of 0 means there’s practically no bot activity to speak of, while a score of 10 means almost all traffic is attributable to bots.

By aggregating (anonymously, of course!) observations across our customer base, we can calculate an ITL for different industries and geographies, with the option of introducing additional slicing and dicing on other common attributes.

Tracking historical trends and daily shifts has the potential to inform of elevated risks to CIAM login and sign-up flows, enabling app providers to increase their own monitoring, proactively tighten thresholds, implement additional defenses — or respond in any other way they see fit.


<div class="alert alert-info alert-icon">
  <i class="icon-budicon-487"></i>
  <strong>Behind the scenes</strong><br> 
Here's a simplified overview of how an ITL is calculated.<br>
Each day, the ITL instrumentation analyzes traffic samples that cover all industries and geographies and includes customers of all sizes.
By cross-referencing the samples against our Bot Detection capabilities, we're able to determine with high accuracy what proportion of those Identity flows are associated with bots.
Finally, for each dimension or combination of dimensions (e.g., Financial Services in North America), we calculate the ITL.<br>
The ITL is based on traffic from Okta's Customer Identity Cloud customers; we believe it's reasonable to conclude that organizations that aren't customers will experience similar threats, but we cannot and do not assert that this is definitely the case.<br> 
</div>

## Sneak-Peak Observations

While future posts will explore the ITL in greater detail, including diving into Identity trends and perhaps even specific attack campaigns, in this post, we’ll stick to some high-level observations.

For example, consider the chart below, which shows the ITL for the Travel/Transportation industry, across all regions, from January 1st, 2023, through April 1st, 2023.

Just from a quick visual examination, we can see that so far in 2023, this ITL fluctuates up and down around an average of about 5.5, with the peaks corresponding to weekends (some industries exhibit this weekday/weekend pattern, and others don’t).

![Battling Bots](https://images.ctfassets.net/23aumh6u8s0i/4ahrXj9vXgxuQnLrwXlU6w/b5df3271d0dee7ac8a87819a8247e38f/Battling_Bots_01.png)

Next, let’s use the ITL to see how the threat of bots varies across industries. In the chart below, we’ve zoomed out to a weekly view to more clearly showcase the general trends in Financial Services, Retail/eCommerce, and Software/SaaS/Tech.

We can see that of the three industries, Retail/eCommerce has experienced the highest peak ITL (nearly 8) and has had an average score of around 6. During the same period, Financial Services peaked at an ITL of 7 but has generally trended downward, while Software/SaaS/Tech has maintained a fairly constant ITL of around 5.5


![Battling Bots](https://images.ctfassets.net/23aumh6u8s0i/29k788paxQ9AF3bksWHWuB/da9f6822e69ea5ed48364c5ab8558561/Battling_Bots_02.png)


For our third example, let’s shift our attention to Healthcare (with a global aggregation and weekly granularity). It’s clear that around the beginning of March, bot activity targeting the Healthcare industry picked up significantly — jumping from a baseline ITL of around 3.5 to repeated peaks approaching 6.0!

Do providers of Healthcare apps know that they’re under siege — and would they configure their defenses differently if they knew?

![Battling Bots](https://images.ctfassets.net/23aumh6u8s0i/Wb4zGX0ZgOOjDzlBYtD2M/1cf104b5bca618e3be5df9e2ed2aba82/Battling_Bots_03.png)

As our final example, let’s return our attention to Travel/Transportation, but this time we’ll go one level deeper and examine the ITL for three different geographies: the Americas (AMER), Asia-Pacific (APAC), and Europe, the Middle East, and Africa (EMEA).

From this breakdown, we can see that while the composite Travel/Transportation ITL tends to be in the range of 5.5 to 6.0, the threat level varies considerably by region: APAC and EMEA are largely in the 3.0 to 4.0 range, while the AMER score has remained above 7.0 for all of 2023!

![Battling Bots](https://images.ctfassets.net/23aumh6u8s0i/68RTbaQaVFgqNYO5rOsmJ0/23995c6abed960115b391617a78f184d/Battling_Bots_04.png)

## Looking Ahead

Anonymous firmographic metadata can help us not only to monitor _what_ is happening but also _why_. As a result, the ITL is about more than just observing attack trends — it’s about surfacing insights and informing actions to protect both providers and users of online services.

At the same time, ITL scores equip the broader security community with data that — until now — has only been available to a handful of organizations.

Ultimately, we’ve really only begun to scratch the surface of the insights that ITL scores can provide, and we invite you to join us on this journey of discovery.

Battling Bots: Introducing the Identity Threat Level (ITL)

Samuel Frank

Sam Frank is Auth0's Sr. Product Manager for new initiatives. He works within the Auth0 Lab to commercialize the team's new ideas so they're available for builders everywhere. As a former platform product manager and startup product lead, he knows the challenges that developers face when creating new apps and he leverages those experiences to focus our teams efforts delivering the next generation of identity tools.

The Customer Identity Cloud platform can now reference NFTs as profile data and as a means to grant access.

The [Auth0 Lab team](http://labs.auth0.com/) has released a pair of [Marketplace integrations](https://auth0.com/marketplace) bringing more [Web3 capabilities](https://marketplace.auth0.com/categories/web3) to the Okta Customer Identity Cloud ecosystem. As the Web3 ecosystem matures, we’re finding that on-chain data, like NFTs (non-fungible tokens), can be used in the identity ecosystem. 

[Our integration](https://marketplace.auth0.com/integrations/auth-0-inc-fetch-nfts) is a simple NFT fetch [Action](https://auth0.com/docs/customize/actions) that retrieves a list of NFTs the user owns. With them, you can make all sorts of IAM-based decisions. If you’re interested in the Auth0 Lab team’s continued Web3 research, come join the conversation on [Twitter](https://twitter.com/Auth0Lab) and [Discord](https://discord.gg/xkbkz9rZcD).

## NFTs in Identity and Access Management (IAM)

By now, you’ve probably heard of NFTs. If not, here [is a helpful explainer](https://www.nytimes.com/interactive/2022/03/18/technology/nft-guide.html). At their core, NFTs are digitally transferable tokens. Tokens have a long history in identity and access management. They are the keystone of authorization in many apps, primarily through the issuance of [JSON web tokens](https://jwt.io/). 

NFTs could be a big extension to token-based IAM. NFTs are flexible, secure, and easily transferable by their nature of using blockchain consensus algorithms to establish ownership and transference. Like with cryptocurrencies, only a specific private key in a wallet can prove ownership. They can help organizations manage capacity problems because you can limit the number of NFTs you mint. This scarcity helps manage supply while still allowing for a robust secondary market. This makes them ideal for ticketed events and venues, like stadiums, trains, and other physically limited spaces.

One of the biggest barriers to mainstream NFT adoption is the usability hurdle of working with blockchains. With our latest integrations, Auth0 Lab seeks to make it easy. Developers can query a user’s NFTs and incorporate them as identity data in their applications, even controlling access based on a user’s ownership of an NFT. We’re excited to see how developers use these new tools when implementing web3 functionality into their applications.

## Token Gating

[Token Gating](https://tokenizedhq.com/token-gating/) is the practice of managing access to resources based on a user’s Web3 NFTs. Notable examples include [‘members only’ communities](https://rarible.com/blog/9-membership-nfts/) of NFT collectors. This exclusivity extends to video games like [Alien Worlds](https://alienworlds.io/), the [largest web3 game](https://www.statista.com/statistics/1266486/blockchain-games-user-number/) at the end of 2022. NFTs are central to the game and unlock certain content, or game locations are only accessible with specific NFTs. [TravelX](https://travelx.io/) is working on another use case around airline tickets.

Token gating is interesting because of the openness of the attestation. Instead of IAM data being stored on a proprietary server, it’s on a public blockchain for anyone to use and see. We’re just witnessing the first experiments in how that data is used. 

## EVM Compatible, Open Source Coming Soon

The current integration works on all [Ethereum virtual machine (EVM) compatible](https://gocrypto.com/en/what-are-evm-compatible-blockchains/) blockchains. This means you’ll have access to NFTs available on some of the largest NFT marketplaces like [OpenSea](https://opensea.io/). You’ll be able to pull from [Ethereum](https://ethereum.org/en/), [Polygon](https://polygon.technology/), [Avalanche](https://www.avax.network/), [Binance Smart Chain](https://www.bnbchain.org/en), and others. EVM blockchains are the oldest programmable blockchains, and the ecosystem is well supported.

The Auth0 Lab team is working on open-source the code so it can be modified and moved to other blockchain platforms. That process takes some time, so keep an eye out by following us on [Twitter](https://twitter.com/Auth0Lab) or heading to our [GitHub organization](https://github.com/auth0-lab) and give it a follow.

## Unlocking NFTs for Your Application

### How it Works

The Auth0 Lab [fetch-nfts integration](https://marketplace.auth0.com/integrations/auth-0-inc-fetch-nfts) works by relying on a few other pieces of infrastructure.

1. It utilizes the [Sign in with Ethereum integration](https://auth0.com/blog/sign-in-with-ethereum-siwe-now-available-on-auth0/) that SpruceID released in the Auth0 Marketplace in 2022. This allows the integration to grab a public blockchain address for the user, which is critical to querying an NFT smart contract to know if they own an NFT. If a user logs in with a method other than Sign in with Ethereum, NFTs won’t be fetched.
2. During [setup and configuration](https://marketplace.auth0.com/integrations/auth-0-inc-fetch-nfts?tab=install), specify a list of NFT contracts that you’d like the [Auth0 Actions](https://auth0.com/actions) code to query. You’ll also need to specify an API key for [The Graph](https://thegraph.com/en/), a service that queries blockchain data.
3. With a public key in hand, and a list of NFT contracts to search, the Actions code calls out to The Graph’s APIs to query the necessary NFT contracts. It returns a list of caip-22 asset references that your Action adds to the [ID token](https://auth0.com/docs/secure/tokens/id-tokens) as claims.
4. From there, you can utilize the data in your application to make any decision, like token gating access, that you feel necessary!

### Installation

Check out our [installation](https://marketplace.auth0.com/integrations/auth-0-inc-fetch-nfts?tab=install) guide to get started!

## What’s Next?

The Auth0 Lab team is actively exploring the best ways to enable developers to build applications that rely on Web3 identity constructs and help bridge the Web2 and Web3 worlds. You can follow our progress on [Twitter](https://twitter.com/auth0lab). If you’re interested in speaking with the team, join our [Discord](https://discord.gg/xkbkz9rZcD) and start a thread.

The [Auth0 Marketplace](https://marketplace.auth0.com/) is looking for Web3 partners to build new extensions onto Auth0. Visit [https://auth0.com/integrate](https://auth0.com/integrate) to learn more.

Web3 NFTs for Identity and Access Control, Now Available on Marketplace

shiven_ramji

Shiv is an experienced product executive and builder obsessed with creating beautiful products. He is the President of Customer Identity at Okta, managing a $1B ARR business and overseeing the company’s product, data, security, and technology strategy and execution. Before Auth0 and Okta, Shiv was the SVP of Product at DigitalOcean, leading DigitalOcean’s products, pricing, and partnerships. Additionally, Shiv has held product leadership positions at global brands, including Amazon, NBCUniversal, LiveIntent, and The Nielsen Company. Shiv was the recipient of the 2023 Top Global CPO Award by the Products That Count community. 

Beyond his current corporate focus, Shiv is deeply committed to fostering entrepreneurship and innovation, particularly in Africa. He is an active angel investor and startup advisor and also serves on the boards of [Products That Count](https://productsthatcount.com/) and [Aiven.io](http://Aiven.io).

President, Auth0

Shiven Ramji

Convert and protect customers at the login box and beyond

**TL;DR:** Okta has launched the [Auth0](https://www.okta.com/press-room/press-releases/okta-introduces-okta-customer-identity-cloud-to-help-businesses-grow-user/), powered by Auth0, with support for two use cases: Consumer Apps and SaaS Apps. This article explores the Consumer App use case and capabilities, as well as how app builders, digital leaders, and security teams can set their applications up for success with end-users, starting at the login box.

It doesn’t matter if you’re in the public sector or selling pizzas–for every organization, in every industry, digital business is just business now.

As consumers ourselves, we know the best apps are the ones that improve our daily lives, keep us safe online, and are delightful to use. We also know what a terrible login experience feels like: 83% of consumers have [abandoned a cart or signup due to an arduous login process](https://info.auth0.com/expectation-vs-reality), and 48% are frustrated by filling in long login or sign-up forms.

In the identity and access management world, this is called customer identity: Learning about your customers and securely building consent-based trust by understanding who they are and how they want to engage with you.

While managing customer identity is a relatively new concept for marketers, app builders and security teams have been wrestling with the complexity around identity and access for years.

What would happen if we treated identity as the “digital front door”? Could we make end-users more secure, help developers launch the next big app, or put an end to passwords?


## Consumer Identity Without Compromise

Auth0 for Consumer Apps enables app builders, digital marketers, and security teams to give end-users access to everything they need online in a convenient and secure way. Consumer-friendly capabilities like Passwordless, Progressive Profiling, and Adaptive Multi-factor Authentication (MFA) ready to go out of the box help maximize conversion, retention, and loyalty without adding friction or security risk. And our 100% focus on identity means we’re keeping an eye on the latest attacks and technologies for you, too.

“Flo is committed to building a better future for female health with the number one OB-GYN recommended app, a thriving community, and science-backed resources,” said Roman Bugaev, Chief Technology Officer at [Flo Health](https://auth0.com/case-studies/flo-health). “Auth0 allows us to provide personalized insights to our users in a thoughtful and secure way, so they can take control of their health. Improving the authentication experience has also helped us reduce churn during the login process, driving our signups 12 times higher since we made the change.”

Here are a few of the ways our customers are using Consumer Apps today.

### Acquire Customers With Just One Click

Asking consumers to create (yet another) password that meets certain complexity requirements results in lower customer acquisition rates, especially on input-constrained devices. Streamline registration with fewer passwords for users and fewer password resets for your support team with **Single Sign-On (SSO) and social logins**, MFA, and more out of the box. Want to do away with passwords entirely? You can start with multiple passwordless options without adding security risk.


### Personalize Experiences for Long-Term Loyalty

Today, digital marketing teams are effective at personalization and testing around the login box, but very few are doing this within identity. Considering that the login box is the gateway to digital experiences, this is a huge missed opportunity. Features like **Universal Login** make it possible to customize the login experience to your exact audience with any number of authenticators–even without your own dedicated identity team. This is a huge selling point for marketers and the developers they work with, who have a lot on their plates already.


### Collect First-Party Data Without Friction

Have you ever had someone ask for too much information on a first date? Long sign-up forms are the digital equivalent. With web cookies going away, digital teams are turning to features like **Progressive Profiling** to collect first-party data over time as consumers sign up and engage with their website or app. Less creepy? Yes. Even more effective for building trust and personalizing experiences? Definitely.


### Protect Revenue From Bots and Brute Force

[Credential stuffing](https://auth0.com/resources/whitepapers/2022-state-of-secure-identity-report) accounts for 34% of overall login traffic and outpaces normal traffic in some countries (61%) in the U.S. and verticals (more than 80% in retail), according to Okta’s 2022 State of Secure Identity Report. Distinguishing between legitimate users and would-be attackers requires finesse and can quickly become a full-time job. Our **Attack Protection** capabilities like Bot Detection, Breached Password Detection, Suspicious IP Throttling, and Adaptive MFA give security teams the tools they need to fight fraud without damaging the user experience.


## What’s New for Consumer Apps?

New product innovations for Consumer Apps were announced at Oktane22. Okta expects these features to be available by the end of Q2 2023, with support for Highly Regulated Identity as an Enterprise Add-on.

* **Passkeys support:** Passkeys are a replacement for passwords that make it faster and safer to sign into apps and websites on any device. The technology is phishing-resistant and uses a device — usually a fingerprint or facial recognition, or a PIN — to prove a user is who they say they are. We are making it easy for app builders to turn on passkeys with the literal flip of a switch.
* **Highly Regulated Identity:** While we’re enabling app builders to offer the most exciting experiences, we also recognize some of our customers operate in highly-regulated industries like banking or utilities. Highly Regulated Identity is a new toolset that allows customers to safeguard riskier transactions with extra security and policy control. We are taking steps toward enabling customers to reach Financial Grade API (FAPI) compliance with several new product innovations, including:
    * **Pushed Authorization Request (PAR):** A new OAuth endpoint that avoids passing any sensitive information on the front channel (e.g., all authorization details won’t appear in the browsing bar or search history).
    * **Rich Authorization Request (RAR):** A framework that enables fine-grained control over authorization for any use case, including communicating fine-grained details on a transaction (e.g., payment amount) and customized consent gathering (e.g., selecting a bank account as part of the consent step).
    * **Private Key JWT:** An authentication method that improves security posture by signing with a private key rather than a password or secret that can be intercepted and used by someone other than the intended recipient.
    * **Strong Customer Authentication (SCA):** A component of the European Union’s second Payment Services Directive (PSD2) that requires at least authenticating users with at least two factors: something they have (e.g., device or hardware key), something they know (e.g., password or PIN), and something they are (e.g., biometrics).
    * **Mutual Transport Layer Security (mTLS):** A type of authentication where access tokens can only be used by the application they were specifically issued for; thus, if a token is leaked, it can’t be used by the attacker. 
* **Security Center:** At Okta, we have insights from billions of authentications about the threats facing consumer apps. We want to make sure your entire cross-functional team has this same visibility. Security Center is a single pane of glass that enables security professionals to monitor in real-time, detect, and respond to potential identity security events–either directly through your dashboard or by integrating with the security stack of your choice. With comprehensive dashboards, visualizations, and controls tailored to customer identity scenarios, this is a powerful tool for keeping your customers secure and your app operating at the highest level.

Learn more about the Auth0 and how to turn your login box into an engine for growth at [https://www.okta.com/customer-identity](https://www.okta.com/customer-identity/).

**Footnote:** _Any unreleased products, features, or functionality referenced in this blog post that is not currently available, may not be delivered on time or at all. Product roadmaps do not represent a commitment, obligation, or promise to deliver any product, feature, or functionality, and customers should not rely on them to make purchase decisions._

Inside Auth0 for Consumer Apps

Win business customers with enterprise-ready Identity

**TL;DR:** Okta has launched the [Auth0](https://www.okta.com/press-room/press-releases/okta-introduces-okta-customer-identity-cloud-to-help-businesses-grow-user/), powered by Auth0, with support for two use cases: Consumer Apps and SaaS Apps. This article explores the SaaS Apps use case and capabilities, as well as how product and engineering leaders can accelerate growth with an identity solution built for business customers.

The Software as a Service (SaaS) market is booming, with new products coming online every day. The average number of apps companies use increased to 89 this year, with as many as 187 for larger companies, according to [Okta’s Businesses at Work 2022 report](https://www.okta.com/businesses-at-work/).

All of this growth has created intense competition in the SaaS space. The companies that will win are the ones who can successfully onboard business customers quickly and move upmarket while remaining hyper-focused on their core product. 

In identity and access management terms, this is called customer identity: Learning about your customers and securely building consent-based trust by understanding who they are and how they want to engage with you.

Historically, there have been very limited customer identity options on the market for the SaaS use case, and product and engineering leaders end up using some combination of consumer and workforce identity solutions.

What if you didn’t have to use baling wire and duct tape? Could identity help you capture your market opportunity–instead of slowing you down?

## Customer Identity for SaaS Apps, Simplified 

Auth0 for SaaS Apps enables every app builder to become enterprise-ready and accelerate growth without having to become an identity expert. SaaS-specific capabilities like Enterprise Federation, Delegated Administration, Multi-factor Authentication (MFA), custom branding, and security features are available out of the box. And our robust identity product roadmap means we’re constantly innovating for you, too.

“Kandji is committed to being a pioneer in the future of work by helping companies manage their Apple devices at scale,” said Weldon Dodd, senior vice president of Product Strategy at [Kandji](https://auth0.com/case-studies/kandji). “Delivering the best experience for our customers means making onboarding as slick as possible, managing and customizing workflows, and providing the most secure experience from both an administrator and end-user perspective. We did all of this with Auth0 four times as fast as our DIY solution. And it’s working–we’re already seeing customer revenue trending up.” 

Here are a few of the ways our customers, like Kandji, Blackboard, and TripActions, are using SaaS Apps today.

### Acquire and Onboard New Customers

As your business scales, you want to streamline the onboarding process to your applications, so business customers can start using your product quickly and collaborating with their coworkers. This increases your “stickiness.” With our APIs and SDKs, you can build **Self-Service Onboarding** directly into your application so that your customers can provision access control, set up Single Sign-On (SSO), and invite other members of their organization without burdening your engineering team.

### Personalize Experiences For Your Customers

Technical teams can spend weeks configuring identity manually for each new customer, with lots of back-and-forths to implement changes. **Organizations** is our toolset that helps SaaS companies manage and model identity for business customers as organizations (under a single tenant). It allows you to provide last-mile customization on a per-organization basis to ensure the authentication experience meets their needs, including enterprise federation with any source, account provisioning, onboarding and migration flows, customized branding, and security policies that meet the most stringent requirements.

### Achieve On-Demand Security

[Credential stuffing](https://auth0.com/resources/whitepapers/2022-state-of-secure-identity-report) accounts for 34% of overall login traffic and outpaces normal traffic in some countries (61%) in the U.S. and verticals (more than 80% in retail), according to Okta’s 2022 State of Secure Identity Report. **Attack protection with [Credential Guard](https://auth0.com/blog/auth0-credential-guard-detects-breached-passwords-faster-to-prevent-account-takeover/)** and **[Bot Detection](https://auth0.com/blog/auth0-bot-detection-reduces-bot-attacks-by-79/)** enables you to secure the data of your business customers, and help prevent the most common identity-based attacks. We take the burden of managing identity security off your internal teams, so they can focus on shipping new features for your product.

### Customize Authentication For Complex Use Cases

No two business customers are the same, and there will be frequent requests to customize your platform for complex use cases. **Extensibility**–custom code blocks and extensibility points that allow for secure customization at any point in the authentication pipeline–has long been an Auth0 differentiator and is now available through Auth0. And because we maintain the extensibility framework, you can meet unique authentication needs and confidently check off RFP requirements today, with adaptability for tomorrow.

### Become Enterprise Ready and Scale

Your customer identity platform should help you grow and land larger customers more often. With SaaS Apps, customer requirements around **SSO and MFA** are available out of the box. Coupled with cloud choice across AWS and Azure, regional infrastructure for data residency, and our 99.99% SLA, you can grow your business anywhere in the world, one login at a time–without needing to host, manage, or scale an identity solution yourself.

## What’s New for SaaS Apps?

New product innovations for SaaS Apps, announced at Oktane22, are now available for all Okta customers:

* **Okta Workforce Enterprise Connection:** Okta Workforce Enterprise Connection makes it easy for SaaS app builders to offer out-of-the-box integrations to Okta Workforce Identity Cloud, providing end-users with a seamless and trustworthy login experience. This enterprise connection is included on all Enterprise and B2B self-service plans for no additional charge and is now easier to discover and configure for SaaS Apps use cases.
* **Organizations Enhancements:** To support our customer's business growth, Organizations now support greater scalability with up to two million organizations per user (tenant) and two million members per organization. We have also made it easier to search for organizations within the Manage Dashboard, making it even easier to find and administer those millions of business customers in your multi-tenant application.

Ready to accelerate your business with identity? Learn more about Auth0 for SaaS Apps at [https://www.okta.com/customer-identity](https://www.okta.com/customer-identity/).

Auth0 for SaaS Apps Explained

New partnerships aim to bring secure customer identity to the platforms developers use every day in one click, or less

Almost a decade ago, _The New Kingmakers_ made reference to the rise of a developer class that would fundamentally reshape technology decision-making. Today, two-thirds of professional developers have a voice when their organizations are purchasing new technologies, according to [Stack Overflow](https://survey.stackoverflow.co/2022/#technology-most-loved-dreaded-and-wanted). Product-led growth is official “a thing,” and companies that make life easier for developers have been crowned with success again and again.

The acquisition of Auth0 accelerated Okta’s own journey with developers. Over 2.8 million unique developers look to [Auth0, now the Okta Customer Identity Cloud](https://www.okta.com/press-room/press-releases/okta-introduces-okta-customer-identity-cloud-to-help-businesses-grow-user/) each month for expertise on how to implement customer identity, across in-person events, the Auth0 Ambassador program, and digital channels like docs, technical blogs, and JWT.io.

Today, at [Oktane22](https://www.okta.com/oktane22/), we announced the next giant leap in our journey toward making identity easier for developers: New partnerships with three of the leading developer platforms: DigitalOcean, Netlify, and Vercel. These are like-minded platforms that put developers at the heart of their missions. Together, we intend to bring expert advice and easy integrations to where developers already spend their time–with the ultimate vision of providing secure customer identity in one click or less within each platform environment.

“Creating compelling experiences is hard enough without having to be an identity expert, too. And the stakes are too high to get it wrong,” said Shiven Ramji, Chief Product Officer, Customer Identity at Okta. “Okta Customer Identity Cloud powered by Auth0 can be called by your app and hosted in your cloud of choice, but we don’t want to stop there. This is the first step in a multi-year journey to fully integrate secure identity capabilities where developers are building the future. We are honored to have DigitalOcean, Netlify, and Vercel join us on this quest.”

## Abstracting Away Complexity

Developers are facing all kinds of application complexity and maintenance work that takes them away from innovation. The Covid-19 pandemic only amplified the need to be hyper-focused on shipping differentiated, user-centric products. Security has become a cat-and-mouse game as attackers shift their tactics and new privacy laws are established. Developers need to balance all of these priorities while dealing with resourcing and talent pressures.

Customer identity stands at the intersection of these forces: security, privacy, and user experience. Getting it right enables everyone to safely access any technology and developers to integrate customer identities across the stack. But according to a [Gartner](https://www.gartner.com/en/documents/4009255)® report, “The cost of maintaining a homegrown CIAM toolset has grown, compared with commercial offerings. There is a growing preference for buying versus building, which is enabling the business to refocus development resources.”

## Empowering Developers for a Safer Internet

Together, we believe Okta, DigitalOcean, Netlify, and Vercel can streamline the education, implementation, and activation of customer identity for developers across the globe. Today, we’re starting with improving education and awareness around the complexity of identity, followed by improving discoverability for our integrations along the developer journey, with the ultimate vision of one-click integrations.

Democratizing access to enterprise-grade customer identity for developers will have a massive impact on the security of end-consumers and empower developers to focus on innovation. As part of Okta Customer Identity Cloud, we can put adaptive multi-factor authentication (MFA), bot detection, passkeys, and more in the hands of developers with the literal flip of a switch. Meeting developers where they are is a key part of our strategy, and we couldn’t be more excited to welcome DigitalOcean, Netlify, and Vercel to our network.

“We’re very excited to be working with Okta to better equip developers and small businesses to add customer identity into their Apps built on DigitalOcean,” said Tyler Healy, Vice President of Security at [DigitalOcean](https://www.digitalocean.com/). “When it comes to developers and digital entrepreneurs, simplicity is vital. This partnership will only further DigitalOcean’s ability to simplify innovation on our platform and enable builders to spend more time creating software that changes the world.”

“Developers are moving to a decoupled, composable web architecture because they want more flexibility to use any tool or framework to build faster, better-performing web experiences. At the same time, they need a great developer experience in a simple workflow. That’s where Netlify plays a key role as the platform connecting all developer’s tools, including Auth0 by Okta, and APIs in one place to build and run web apps. Working with Okta, we look forward to making identity and authentication as easy and simple as possible for millions of developers,” said Matt Biilmann, CEO and co-founder [Netlify](https://www.netlify.com/)

“As a leading cloud platform for frontend developers, Vercel provides innovators with the speed and reliability they need to create at the moment of inspiration. Security and identity are at the core of building delightful digital experiences,” said Malte Ubl, CTO at [Vercel](https://vercel.com/). “By joining forces with Okta, we’re not only simplifying the role that identity plays on the web but also making a commitment to enhancing the speed and breadth of developer-friendly cybersecurity in an increasingly digital world.” 

## Neutrality to Build Your App, Your Way

Developers want the freedom and power to choose the best solutions for their digital ecosystem. Okta’s commitment to neutrality means not being restricted to a specific technology stack and having the ability to control and customize identity now and in the future. We are designing easy-to-integrate solutions that free developers to use any technology, regardless of platform, device, or infrastructure. We are 100% focused on identity, so developers can focus on innovation.

## Availability and Signup

Developers can learn more about Okta’s new developer platform partnerships and get started with Okta Customer Identity Cloud [on our Developer Center](https://developer.auth0.com/resources/get-started/cloud?utm_source=blog&utm_medium=website&utm_campaign=partnerships). We will release more information about the DigitalOcean, Netlify, and Vercel integrations as they become available.

If you’re a developer platform interested in joining our quest to make identity easier for developers, [please reach out to our tech partnerships team](https://docs.google.com/forms/d/e/1FAIpQLSfGzaE5a6-OSy1D1N8PMeSE8pXCfsr4UkzDqUpW-vUGq2rYHg/viewform).

## About Okta

Okta is the World’s Identity Company. As the leading independent Identity partner, we free everyone to safely use any technology—anywhere, on any device or app. The most trusted brands trust Okta to enable secure access, authentication, and automation. With flexibility and neutrality at the core of our Okta Workforce Identity and Customer Identity Clouds, business leaders and developers can focus on innovation and accelerate digital transformation thanks to customizable solutions and more than 7,000 pre-built integrations. We’re building a world where Identity belongs to you. Learn more at [okta.com](http://okta.com/).

Okta Partners with DigitalOcean, Netlify, and Vercel to Simplify Identity for Developer

Nabeel-Saeed

Nabeel is a product marketer focused on all things security and identity. He has contributed to publications like Wirecutter, Information Age, and Professional Security. He has also been a guest speaker at the Bay Area Cybersecurity Meetup, and delivered talks on IAM across the US, Canada, Israel, and Singapore. He is passionate about helping build secure auth experiences that amaze users and delight businesses.

Product Marketing

Nabeel Saeed

Attackers are getting better at compromising customer accounts. Here's how to stop them

Customer Identity (CIAM) is a unique segment of the wider Identity and Access Management (IAM) space, as customer-facing applications face a different threat landscape and must deliver an experience that's user-friendly — as well as secure and private. It must rely on subtle techniques to achieve and maintain a strong security posture while also driving conversions and building trust with consumers.

Our [2022 State of Secure Identity Report](https://auth0.com/resources/whitepapers/2022-state-of-secure-identity-report) presents trends, examples, and observations unearthed from observing the billions of authentications on our platform in the hope that bringing light to such insights will help organizations understand the threats against customer identity and drive informed conversations around Zero Trust.

### Fraudulent registrations are an ever-present and growing threat

In the first 90 days of 2022, signup fraud accounted for approximately 23% of signup attempts on our platform, up from 15% in the same period last year (per last year's report). Financial Services and Energy/Utilities experienced the highest proportion of signup attacks, with such threats accounting for 64.8% and 72.5% of registration attempts in those two industries, respectively.

### Credential stuffing is on a record pace

2022 has already delivered the two largest such credential stuffing attacks we have ever witnessed, and across all industries, credential stuffing accounts for 34% of overall traffic/authentication events on our platform. While most industries experienced a credential stuffing rate of less than 10% of login events, in several cases — Retail/eCommerce (more than 80%), Financial Services, and Entertainment — these attacks represented the majority of login attempts.

### Threat actors are targeting MFA

Because of its proven merits, more application and service providers are recommending or requiring MFA. Consequently, the first half of 2022 has seen a higher baseline of attacks against MFA than any previous year in our dataset. As attackers become more sophisticated at targeting this important defensive measure, it's critical that MFA be implemented correctly and that strong secondary factors are chosen.

### Breached Passwords are a pervasive but poorly understood threat

Account takeover attacks with stolen credentials are one of the most common and costly cyber threats. Entire marketplaces exist to sell lists of user credentials leaked in third-party breaches. In fact, 58% of all Auth0 customer applications have experienced login attempts using breached/leaked credentials, illustrating the widespread nature of these attacks. What's more, most of the services that purport to protect against breached passwords use web scanners and scrapers that rely on breach data being made public, which can be months or even years after the initial breach. Reusing passwords across sites increases the risk of an attack and makes it more difficult for organizations to prevent fraudulent access to user accounts. In order to defend apps and users against this pervasive threat, it's imperative that breached passwords are detected as soon as they are compromised and accounts notified.

### CIAM at the vanguard of identity security

In an enterprise environment, security trumps convenience, so administrators can impose controls with comparatively little regard for the user experience — but customer identity management must maintain security and privacy while minimizing friction. Because of this restriction, CIAM exists at the vanguard of identity security and innovation, as it depends upon defenses that can withstand sophisticated threats but that are nearly invisible to users.

With this report, we aim to increase awareness of both threats to customer identity and the techniques that can be layered to build reliable defenses.

### Three ways to stop identity-based attacks

1. **Implement MFA everywhere.** It is still one of the best defenses we have against sophisticated attacks.
2. **Augment with defense-in-depth tools. **These work in combination across the user, application, and network layers, such as scanning for bot traffic and breached passwords among your user base.
3. **Invest in a customer identity solution.** Embrace flexibility by default and customize security and ease of use depending on your risk appetite, user requirements, and implementation.

> 📈 [Download the report](https://auth0.com/resources/whitepapers/2022-state-of-secure-identity-report) for a deeper dive into insights gained from a platform that authenticated billions of logins each month.

### Methodology

This report is based on data from Okta customers using the Auth0 platform around the world and so represents real-world observations of identity attacks. The data was retrieved by Auth0's security researchers by running simple and anonymous queries against our aggregate database of operational telemetry. Industry segmentations are based upon each customer's self-reported segment. Observations are from the first 90 days of 2022 unless otherwise noted.

Top Insights From Our 2022 State of Secure Identity Report

Oliver Wang

A product manager at Auth0 focuses on  Ecosystem and Extensibility.  With an engineering background, Oliver always puts developers' experience first.  He has mixed industrial experience as a Product Manager, Software Engineer and Data Analyst. This diverse profile unites different team members to deliver value to our customers. Besides work, you can catch him up on a ski hill in the Canadian Rockies.

Product Manager, Ecosystem

Geoffrey Goodman

I am a curious and driven person. Until my early twenties, I was one of the top-ranked Canadian slalom skiers. While still competing, I pursued dual business majors at a Liberal Arts college in Nevada, funded by academic and athletic scholarships. I then joined EY in Montreal, where I worked with all of the four major service lines and earned my CA title. I now work with the Valuations and Business Modelling group and I am pursuing my CBV designation. 
<br>
I am also a self-taught computer programmer. I am comfortable in any number of programming languages. I built a website and steward a community of thousands of people across the world who rely on and benefit from its services every day.

Staff Engineer

Customers can now add custom prompts or factors in their post-login flow

We are excited to share that our customers that use Actions -  Auth0’s flagship extensibility product - can now add custom prompts or factors in their post-login flow. This enables developers and partners to confidently record the completion of a factor upon returning after a custom redirect. Auth0 delivers more tools, features, and options for developers to give them the support and capabilities they need to customize their customer’s experience through pro-code flexibility.

We have introduced a new method to the API of post-login Actions when continuing the flow after a successful custom redirect. This method allows a customer and/or partner to store the completion of that custom factor right in the user’s session. What is powerful about this is that they can then check whether that customer record is in a user session in each login and skip that prompt if it’s there already. Because it’s stored in the user session itself, it benefits from any current and future session management features within the Auth0 product offering.

## What Is the Problem We Are Solving?

Historically, there was no good way for customers to use Actions to securely implement custom prompts or custom factors in a user-friendly way. They could use user metadata or application metadata, but those objects exist across all user sessions. There was also no good way for customers or partners to see whether a user on a specific device had completed the necessary factors to login. This meant forcing users to re-perform the custom prompt or factor more often than necessary.

As an example, let's say you’re a developer for a banking app that has a special requirement to use a custom multi-factor authentication service, and you want that authentication to be associated with a user's session and or device for added security. That is where the ability to add a custom prompt enables you to build that customer experience and address that need.

## See It in the Real Example!

Let's take a look at a real example! Below is a sample Actions code for a Partner Integration implementing a custom authentication factor.

On the `onExecutePostLogin`, we trigger the custom authentication method by using Actions Redirect to send users to the customer method URL with session token information.

```js
const CUSTOM_METHOD_URL = "https://path.to.prompt";
const PROMPT_TTL = 1000 * 60 * 60 * 24; // 24h

exports.onExecutePostLogin = async (event, api) => {
    if (
        !event.authentication?.methods.some((record) => {
            // Timestamps are rendered as IS08601 strings
            const timestamp = new Date(record.timestamp);

            return (
                record.name === CUSTOM_METHOD_URL &&
                timestamp.value0f() >= Date.now() - PROMPT_TTL
            );
        })
    ){
        const sessionToken = api.redirect.encodeToken({
            payload: {
                user_id: event.user.user_id,
            },
            secret: event.secrets.SESSION_TOKEN_SECRET,
        });

        // Trigger our custom authentication method
        api.redirect.sendUserTo(CUSTOM_METHOD_URL, {
            query: { session token: sessionToken }
        });
    }
};
```

Continue with `onContinuePostLogin`, we validate the session token secret and record the completion of our custom authentication method.


```js
exports.onContinuePostLoqin = async (event, api) => {
    const payload = api.redirect.validateToken({
        secret: event.secrets. SESSION_TOKEN_SECRET,
        tokenParameterName: 'session_token'
    });

    if (!validateSessionToken(payload)) {
        return api.access.deny('Unauthorized');
    }

    // Record the completion of our custom authentication method.
    // THIS NEW API IS ONLY AVAILABLE IN 'onContinuePostLogin'
    api.authentication.recordMethod(CUSTOM_METHOD_URL);
};

function validateSessionToken(payload) {
    // Custom validation logic would go here
    return true;
}
```

Actions is an iterative platform we continually improve upon. [Start creating your Auth0 Actions](https://auth0.com/docs/customize/actions/write-your-first-action) today and customize your logic flow with the seamless low-code integration with Auth0!

New Actions Feature: Build Your Own Custom Factor

Dan McCorriston

Senior Product Marketing Manager

Now, all Auth0 customers - including those on our private cloud platform - have access to all the offerings on the Auth0 Marketplace.

Auth0 is excited to announce a newly expanded offering for [our new private cloud platform](https://auth0.com/blog/a-technical-primer-of-auth0-s-new-private-cloud-platform/) customers - Actions Integrations are now available from the Auth0 Marketplace. What that means is all Auth0 customers that utilize our new private cloud platform have access to all the offerings on the Auth0 Marketplace - SSO, Social Connections, Log Streaming Integrations, and now, Actions Integrations.

Actions Integrations will start to appear in the Development/Staging space now and will be ready in the Production environment in the coming weeks dependent on various release cadences.

### What are Actions Integrations and the Auth0 Marketplace, and why should I care?

At Auth0, we realize that many customers have unique needs, and as a result, they want the ability to customize their identity product. In order to serve these additional customer needs, Auth0 built a variety of tools to extend the functionality of identity. This concept is called **extensibility.**

Auth0 Actions and Actions Integrations is the next generation of **extensibility**. Actions is the low-code offering, and Actions Integrations allows customers to use pre-written no-code, drag and drop options to add other functionality such as ID proofing and consent management. Auth0 provides this additional functionality through integrations with **our Ecosystem partners** offered in the Marketplace.

The Auth0 Marketplace and Auth0 Actions are the two complementary ways we extend Auth0. Customers and their end users need the ability to resolve their unique identity requirements — which may include payments, subscription management, signing terms of services, etc. — to complete a successful user access journey into their application or service.

### What is Private Cloud?

Auth0’s [Private Cloud offering](https://auth0.com/cloud) provides the flexibility and agility offered by cloud deployments but also allows a customer to maintain the control and security they need to protect their customers and their businesses. Many customers that have high security and regulatory concerns - those in the financial services industry, for example - may require certain standards of uptimes, updates, failovers, and support for their deployments. The Auth0 Private Cloud deployment models come in both Standard and Managed levels, depending on the customer’s requirements.

Auth0 [recently invested in retooling the Private Cloud platform](https://auth0.com/blog/a-technical-primer-of-auth0-s-new-private-cloud-platform/) to support more automation, adopt current technologies and help scale the Private Cloud to thousands of environments.

### Benefit of Private Cloud and Actions Integrations

Private Cloud has a strong appeal for customers who have high volume or who are from certain verticals. For example, verticals like banking, where shared databases are a concern. Or customers who have data residency requirements or even those who prefer to deploy in a specific region close to their customers. Private Cloud customers do not have to be concerned with sharing space, public cloud request limits, and multiple customer’s data being present in the same deployment. 

Many of the same customers that have a need for Private Cloud also have extensive use cases for extensibility and the no-code integrations available in the Auth0 Marketplace. Easy-to-use integrations such as Identity Proofing and Customer Data Management. With Actions Integrations, developers no longer need to build or maintain custom code or make changes when we alter programming models or release new versions of Node. These Actions Integrations are built and maintained by our Ecosystem partners and are available right in the Auth0 Marketplace. 

A couple of examples of Actions Integrations available in the Auth0 Marketplace:

* [**Deduce Intelligent MFA**](https://marketplace.auth0.com/integrations/deduce-intelligent-mfa): Deduce prevents consumer-facing Account Takeover (ATO) and registration fraud via the constantly growing Deduce Identity Network, with over 400M profiles and in excess of 1.2B daily activities. Deduce risk signals significantly reduces false positive MFA challenges.
* [**Tealium User Login**](https://marketplace.auth0.com/integrations/tealium): Tealium connects customer data - web, mobile, offline, Internet of Things (IoT) - so brands can connect with their customers. Tealium empowers companies to create a unified, real-time customer data infrastructure and makes customer data more valuable, actionable, and secure.

### Is this an increased opportunity for Ecosystem Partners?

Now that Private Cloud customers have access to Actions Integrations in the Auth0 Marketplace, our Ecosystem Partners have a new and expanded pool of potential customers to reach through building and publishing Actions Integrations into the Marketplace. There’s never been a better time to become an Ecosystem Partner and market your Actions Integrations through the Auth0 Marketplace.

Make sure to visit the [Auth0 Marketplace](https://marketplace.auth0.com/) to see if there is an integration that optimizes your customer’s identity experience. To find out more about becoming a [Private Cloud](https://auth0.com/docs/deploy-monitor/deploy-private-cloud) customer, please [send an inquiry](https://auth0.com/get-started?place=documentation%20post&type=link&text=contact%20auth0%20sales) and someone from Auth0 will contact you about whether it’s a good fit for your business.

Actions Integrations Now Available in Private Cloud

liz-rivera

At Auth0 I'm responsible for clearly and concisely communicating the value of our CIAM platform. What a great role to be in as digital technologies and applications increasingly become ingrained in our everyday lives. I also oversee the Healthcare vertical, which I'm super passionate about, as digital advances are already recreating the way we receive care.

Senior Product Marketing Manager, CIAM

Liz Rivera

Auth0 has a new CDP partner in our Marketplace

Digital interactions are increasingly dynamic as brands accelerate digitization - adding more digital channels and services to cater to consumer demands for convenient and seamless access to services from anywhere. This reality has fueled an explosion of data being collected across a wide array of channels and customer data repositories, which not only makes it difficult for marketing teams to get a single view of customers but also makes it challenging to trust the accuracy of the data.  

When customers cannot be accurately identified, this skews analytics and impedes true understanding of customers, their preferences, and behaviors across all digital properties, which is critical to driving adoption and customer lifetime value. This has sparked a growing need to bridge the gap between marketing and Customer Identity & Access Management (CIAM), combining identity and marketing to create a holistic picture of user behaviors. 

### Breaking down silos with customer data platforms (CDPs)

Brands collect customer data across various channels (web, mobile) and systems (martech, eCommerce, customer care) with the goal of extracting insights to enrich the experience. Unfortunately, these customer data sources act as islands creating siloed views of customers, impacting the ability to effectively analyze and personalize the experience.  

Centralizing customer data is the first step toward fueling the understanding of customers. Today, organizations are turning to customer data platforms (CDPs), which serve as master customer data stores. CDPs aggregate customer data across multiple channels and repositories, unifying previously disparate data silos to create unified customer profiles — the customer 360. 

CDPs enable marketing teams to optimize the timing and targeting of offers, communication, and engagement activities by allowing the analysis of behavior across the customer journey. However, without a proper identity verification source, the legitimacy of the data comes into question.  

Because CDPs aggregate previously collected data, it is difficult to know how valid the data is. The data may have been collected in a channel without gaining proper consent, the customer's identity may still be unknown (e.g., anonymous profiles), and/or the contact details have become outdated or were never validated.

### Source of truth: Customer Identity and Access Management

Traditionally, CIAM has been a form of front-line security. However, it has reciprocal value across an organization as it is the front door to your digital services and products. CIAM is how customers adopt and engage with your digital products and services and gives you the means to accurately identify, collect, analyze and secure their data. 

CIAM provides a unified interface for customers to sign up and sign in to your products and services - it is often the first touchpoint at which customers become identifiable. The data that is collected during these events is not only verified through authentication events but can span deterministic data, customer data brought in from other identity providers (e.g., social or enterprise repositories), the devices being used to access services, and the location services are being consumed from.   

This valuable source of truth can be used to connect customer identity across all digital services, including their preferences, usage patterns, and consent. 

### CIAM and CDPs: Powering the marketing funnel

Investment in a CDP is made to better understand customers in order to drive conversions, ROI, customer retention, engagement, loyalty, funnel optimization, and customer experience. Enriching the customer profile with essential identity data across all applications can further accelerate the value of a CDP investment.

Through bi-directional synchronization with CDPs and other martech systems, CIAM data can be used to:

* **Connect anonymous profiles to known customers **by providing verified identity data at signups, such as IP address and device identifiers. The CDP can ingest this data and correlate it to a previously unknown profile. With third-party cookies going away and mobile devices limiting app tracking, this capability is essential for marketers looking to understand their customers’ behaviors across their pre and post-account creation activity and engagement regardless of application or channel. 
* **Enrich user profiles with accurate, customer-provided data.** CIAM verifies users’ identities during registration and login, using identifiers such as email or mobile number. If the CDP detects a change/update, it will update the user profile with the new data.   
* **Power analytics with actionable identity data spanning how, where, and when users are signing up and signing into applications**. CIAM plays a central role in the conversion funnel. The acquisition is tied to signup, and retention is tied to the login experience associated with your digital services. Not having a unified view of these processes and a way to analyze and take action on this data can lead to friction, which creates frustration and leads to lost conversions. By providing a CDP with this data, which in turn is shared with martech and analytics systems, markets can develop a deeper understanding of customers’ behaviors and transaction patterns to identify threats, points of friction, and opportunities for segmentation. 

### Auth0: Unifying and powering existing tech stacks with identity data

At Auth0, we position ourselves as an essential component in the end-to-end digital relationship. Auth0 serves as a foundation to unify an organization's existing tech stack as it integrates and enables a broad ecosystem of technologies and applications spanning applications, APIs, martech, content management, fraud, privacy, sales, and customer care systems.  

Essentially Auth0 acts as a single source of truth for identity data spanning: 

1. Identifiers a user is providing when creating an account
2. Locales, devices, and IPs that the user is logging in from
3. Number of times a user is logging in
4. Applications the user is logging in to
5. Risk profile of the login that the user completed
6. Verified email or the phone number used during the authentication challenge

By sharing this data with downstream systems, Auth0 can boost business outcomes across an entire organization, for instance: 

* Marketing teams to power analytics to better gauge conversion and derive benefits from clean, trusted data.
* Customer support agents to leverage login activity to better service customers.
* Security teams to utilize transactional data to diagnose a potential account breach.  

We are constantly adding partner integrations to our Marketplace to allow our customers to power their tech stack easily and quickly with identity data. [Tealium](https://tealium.com/) recently launched a new CDP integration on the Auth0 Marketplace - [Tealium User Login](https://marketplace.auth0.com/integrations/tealium).  This integration enables marketing and digital teams to leverage Auth0 identity data to connect anonymous profiles to known users and enrich user profiles with accurate and up-to-date data.  

As we continue to grow our CDP footprint, our partner integrations will have an emphasis on helping consumer businesses better understand customers and drive conversion. These pre-built integrations, like Tealium, allow customers to configure and deploy a CDP without employing developers to build a custom solution. 

Be on the lookout as our partners continue to build out new CDP integrations in the [Auth0 Marketplace](http://marketplace.auth0.com/).

Why You Should Integrate Customer Identity and Your Customer Data Platform (CDP)

Chitra Dharmarajan

A motivated CyberSecurity professional with a specialization in IIOT, Cloud Application & Infrastructure Security, Web Application Security, Product Security, and Solutions Architecture. An innovative technical leader, who has efficiently managed cross-geographical teams to successfully deliver Secure Development Lifecycle, Incident Management, Penetration Testing, Product Development & Release Management initiatives. Excels in translating strategic objectives into actionable plans and solving complex problems while delivering high-quality business results. 

Senior Director, Product Security

Confirmation that no action is needed for Auth0 customers

On July 19, 2022, a security consultancy firm released a blog post with claims related to the security of specific features for the Okta service. The areas of concern highlighted by the security consultancy firm are not vulnerabilities specific to the Okta service. Refer to the [Okta blog](https://www.okta.com/blog/2022/07/okta-response-to-security-report/) in response to the security report for further details. Product & Security teams at Auth0, an Okta product unit, conducted a thorough review and determined that the risks in the referenced report do not apply to the Auth0 product.  

To use SCIM with Auth0, our customers are expected to contact professional services to securely configure and deploy custom SCIM solutions as referenced [here](https://auth0.com/docs/authenticate/protocols/scim).

Additionally, Auth0 enforces HTTPS in all Auth0 controlled data transfer channels. 

### What to do if you are an Auth0 customer

At this point, no action is needed for Auth0 customers. We advise the following best practice recommendations, which you should consider in the context of your specific configuration.

1. Always use HTTPS to ensure the secure transmission of data.
2. Enable MFA for all user accounts. MFA should be enforced for all dashboard users that have privileged tenant access. Auth0 encourages all users, not just admins, to require MFA on their accounts.
3. Utilize Auth0’s [Dashboard Role-Based Access Control](https://auth0.com/docs/get-started/manage-dashboard-access/feature-access-by-role) to provide finer grain access controls to dashboard users. 
4. Perform periodic [access reviews of dashboard role assignments](https://help.okta.com/oie/en-us/Content/Topics/Reports/admin-role-assignments-report.htm) and ensure access is limited to authorized personnel.
5. Monitor and periodically review the actions performed by dashboard users recorded in [the tenant logs](https://sec.okta.com/articles/2022/06/unlocking-mystery-700-okta-system-log-events).

If you are an Auth0 customer who is looking for security best practices, you may find additional information in these links:

- [https://auth0.com/docs/secure](https://auth0.com/docs/secure)
- [https://auth0.com/docs/customize/rules/rules-best-practices/rules-security-best-practices](https://auth0.com/docs/customize/rules/rules-best-practices/rules-security-best-practices)

Auth0 Response to Security Report

Todd McKinnon

Todd McKinnon is the CEO and co-founder of Okta, the leading provider of enterprise identity, which he co-founded in 2009 with Frederic Kerrest. Under Todd’s leadership, Okta has transformed the way millions of people access technology and put identity at the forefront of security.

Todd’s experience as a leader and technology visionary spans more than 25 years, with deep roots in enterprise software and cloud transformation. Prior to Okta, he led engineering at Salesforce.com, where he grew the team from 15 people to more than 250, and the service from two million daily transactions to more than 150 million. Todd started his career at PeopleSoft, where he held a number of engineering and leadership roles throughout his 8-year tenure.

Todd earned his bachelor’s degree in management and information systems from Brigham Young University and his master’s in computer science from Cal Poly San Luis Obispo. A Bay Area native, Todd is an advisor to Family House and an advocate for equality and inclusion. He is a husband and father, an exercise addict, and a mountain bike enthusiast.

Okta CEO and co-founder

eugenio-pace-new-avatar

Pace co-founded Auth0 in early 2013 with CTO and “brother-in-arms” Matias Woloski while living 7,000 miles apart from each other. Since then, Pace has played an instrumental role in growing Auth0 into a leading identity management company that is loved by developers and trusted by global enterprises. He loves traveling and has visited more than 35 countries for business and pleasure. He currently lives in Redmond, Washington with his wife, two sons, and their labrador retriever. In his spare time, he enjoys the outdoors, rowing, riding bikes, spending time with his family, restoring his 1970 Karmann Ghia, writing his blog, and reading history and philosophy.

CEO and Co-Founder

Eugenio Pace

Today marks one year since Okta and Auth0 officially teamed up to lead together in the customer identity and access management (CIAM) market.

Today marks one year since Okta and Auth0 officially [teamed up](https://www.okta.com/blog/2021/04/its-official-okta-joins-forces-with-auth0/) to lead together in the customer identity and access management (CIAM) market. While we’re still early in our journey, we couldn’t be happier with the momentum we’ve generated as a combined company over the last year. Here’s what we’ve learned so far and a look ahead at what’s next.

### Customers need Okta and Auth0

When we first announced the acquisition, the most-asked question we heard was, “which CIAM product are you keeping?” As we answered at [Showcase21](https://www.okta.com/resources/showcase21-content/), we’re keeping both — we partner with many customers who have unique requirements, and two solutions are better than one to meet these diverse customer needs. It’s one assertion coming from us, but industry analysts have likewise acknowledged Okta and Auth0 as leaders.

Gartner® named Okta and Okta (Auth0) as Leaders in their [2021 Magic Quadrant™ for Access Management](https://www.okta.com/resources/access-management-leader-gartner-magic-quadrant-2021/thankyou/). Together, we address a broad set of identity use cases for our customers in pursuit of the incredible $30B CIAM market opportunity.

Okta and Auth0 customers like [Larimer County, CO](https://www.okta.com/customers/larimer-county/) recognize our joint value. Larimer County partners with both Okta and Auth0 to bolster security and increase flexibility for its internal IT department and county residents. Our company values are each firmly rooted in customer success, and together, our identity platforms are robust and flexible enough to support the most innovative developers and the world’s largest organizations.


<script type="text/javascript" async src="https://play.vidyard.com/embed/v4.js"></script>


<img
style="width: 100%; margin: auto; display: block;"
class="vidyard-player-embed"
src="https://play.vidyard.com/NW12EDp5yHu7D4yxsXmfC8.jpg"
data-uuid="NW12EDp5yHu7D4yxsXmfC8"
data-v="4"
data-type="inline"
/>

<include src="QuoteCard" body="Okta and Auth0 coming together PB&J-style is an amazing thing for my developers, our IT staff as a whole, our county, and our residents." name="Gregg Turnbull" title="Director of Innovation and Insights" team="" company="Larimer County" />

### Our shared values and vision set the integration up for success

The success we’ve experienced together in the last year is due largely to our shared values — customer success being just one of them. Our joint commitment to innovation, transparency, integrity, and empowerment has allowed us to collaborate effectively and remain focused on our common vision to enable everyone to safely use any technology and establish identity as a primary cloud. On this strong, shared foundation, we’ve made considerable progress in bringing our teams, products, programs, and systems together.

Our employee ranks now exceed 5,000, and together, we support more than 15,000 customers. Although Auth0 remains a product unit within Okta, we’ve combined several functions to accelerate our ability to collaborate and innovate. Our integrated go-to-market team can support organizations across the globe with both customer and workforce identity.

We’ve united our cultures and rituals, coming together for our first joint [company kickoff event](https://www.linkedin.com/posts/activity-6900902245152509952-rv7p?utm_source=linkedin_share&utm_medium=member_desktop_web) in February and our first joint [Developer Day](https://www.okta.com/developer-day-2021-content) in August. We’ve stayed true to our weekly Company All Hands meetings and enjoy hosting a much larger and more global audience. We’ve combined and opened up our many offices so Okta and Auth0 employees can collaborate and build relationships worldwide. We are truly better together, and we continue to experience momentum across the Okta and Auth0 cultures and businesses.

Acquisitions require a ton of work — especially those taking place in fully remote environments! This reality has never been lost on us, and it’s why we’ve been thoughtful and intentional in leading the integration with our shared values and vision. We’ve made a ton of progress so far, but what excites us most is the future.

### Our path forward is bright

We are on a multi-year journey to build the most comprehensive, neutral identity platform in the market, become the standard for customer and workforce identity, and empower everyone to safely use any technology. We have already made great strides within this massive market – $80B TAM – but opportunity abounds ahead. The past year has reinforced one indisputable fact: identity is critical technology. As always, we’re squarely focused on empowering customers with identity, and we know we can go farther and faster together.

Thank you to employees, customers, and partners for making this an incredible first year. We’re still early in our joint journey, and we can’t wait to see what the next year brings.

Source: “Magic Quadrant for Access Management” by Henrique Texeira, [Abhyuday Data](https://www.gartner.com/analyst/85957) and Michael Kelley, Gartner, November 2021.

_Gartner does not endorse any vendor, product or service depicted in its research publications and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose._

_Gartner and Magic Quadrant are registered trademarks of Gartner, Inc. and/or its affiliates in the U.S. and internationally and is used herein with permission. All rights reserved._

Raising the Bar on Identity: One Year of Okta + Auth0

Build an Actions Integration and connect with Auth0 customers

## Why Should You Become an Ecosystem Partner?

Whether you’re a developer of a newly launched solution, or part of a larger, enterprise-level organization, you want to get your product in front of potential customers. Therefore, developing and growing your reach through an Extensibility Ecosystem strategy is a vital part of any organization’s overall strategy.

At Auth0, we consider extensibility to be one of our essential product capabilities. While our endless options for integrations are an excellent way to customize your own unique solution, it can be difficult and time-consuming for our customers to figure out how to implement them.

Enter the [Auth0 Marketplace](https://marketplace.auth0.com/).

We built the Marketplace as a way to connect our customers with service providers and builders who implement these types of integrations regularly. Listing your integration with Auth0 promotes your company with our customers who are looking to do more with their authentication pipeline.

![Ecosystem](https://images.ctfassets.net/23aumh6u8s0i/5rRXDrFl5g647jL7dPbjR/c7d099307234ef118b05e3c6f1215fda/Marketplace_Partner_Spotlight_Separator_V02A_3x.png)


## What is an Ecosystem Partner?

More and more SasS companies are offering developer customers the flexibility and capability to stay within their own ecosystem as much as possible in order to find solutions that fit their own and their customers’ needs. A rich and diverse catalog of integrations can give developers all the low and no-code capabilities they need to build out their own customer journey.

**Auth0** provides an authentication and authorization service built on open standards like OIDC, OAuth2, SAML, and others. But, more than that, we provide tools so our customers can outsource user centralization and management alongside components of application security, and we also help connect networks of applications to a single source of identity.

An important part of this is enabling partners, such as yourself, to create an ecosystem of integrations that can be used to enhance and extend what we already provide. We do this by providing extensibility points and methods to allow customization. This means more functionality for customers with less maintenance burden for them.

Almost 90% of our customers extend the Auth0 platform for their unique requirements. By working with you to solve common identity problems and use cases, we can expedite the time it takes our customers to implement their identity workflows.

Joining Auth0 as an ecosystem partner by building and marketing your Action Integration has some very important opportunities to take advantage of.

### Opportunities:

#### Audience Reach
Auth0 has more than 90k active tenants in production. Some customers have multiple tenants, and some only have one, but this is a large reach of potential customers for your Action Integration. Once your Action Integration is in the Marketplace, customers will have the opportunity to discover, consider, and install your integration into their customer identification flow.

#### Co-marketing
Once you’ve successfully published your Action Integration into the Marketplace, take the next step to expand your reach through GTM initiatives. While we encourage you to drive some GTM initiatives on your own, we also have many opportunities for you to market your integration with us. From blogs and newsletters to demand generation and webinar programs, we have multiple opportunities to help you market your integration.

#### Early to market
The earlier you create your Action Integration and are published to the Marketplace, the better chance you have of creating your own virtuous cycle of early adopters of your integration, marketing your case study, and growing your customers through the ecosystem.

#### Take advantage of Actions technology
Auth0’s new universal extensibility toolset - Actions - is the latest advancement on our commitment to delivering best-in-class extensibility to developers. Developers can take advantage of the easy-to-use interface, drag and drop functionality, version control, a serverless environment, pre-production testing, and debugging.

## How Do You Start?

If you want to learn more about becoming an ecosystem partner and building an Action Integration, visit [Integrate with Auth0](http://autho.com/integrate) to learn more. Here are the main steps you’ll take on your journey to becoming a partner:

## Develop a Use Case for a Customer Need

Some of the considerations you should make when developing a use case for your integration are:

* What does your service do, and how will this help our end customer? (ex. low conversion rates caused by interrupted security measures like MFA, spam signups and content submission, too much or unhelpful log data).
* Do you target specific industries and customer types? (ex. B2C, B2B)

Some of the most popular categories are:

* Identity proofing where customers need to prove they are who they claim to be
* Multi-Factor Authentication, where customers are required to use more than one step to prove their identity
* Consent Management that asks, records, and stores a customer’s approval or denial to use their information.

<br>
![Ecosystem](https://images.ctfassets.net/23aumh6u8s0i/5J18zBKKTWj49BiFo9cjfz/6363b6e28cf2492c47507b71666e8ca2/Marketplace_Partner_Spotlight_Separator_V02B_3x.png)
<br>

There are dozens of other use cases and perhaps many we haven’t thought of. If you’ve got a great solution that fits into the identity flow, let us know.

#### Start building your Action Integration
Get build support once you have created your solution use case. There are step-by-step instructions on how to develop your Action Integration. As your start building, you can get support from our comprehensive documentation, blogs, and forums. Live developer support is available for certain build scenarios.

#### Get published in the Auth0 Marketplace
Once your code has been tested and gone through the QA process, you are ready to deploy your Action Integration to the Auth0 Marketplace. Your integration will not only be discoverable in the Marketplace but easily found and installed from the developer dashboard.

#### Go To Market Opportunities
Now it’s time to find some customers and get them to install your Action Integration. Auth0 will partner with you on a Go-to-Market plan through newsletter, direct email, and social media marketing, as well as drive customers to webinars and demo content. Your success is our success.

There are more details and information at [Integrate with Auth0](http://auth0.com/integrate), so check it out to find out how to become an Auth0 ecosystem partner.

Become an Ecosystem Partner

Identity leaders combine developer and enterprise expertise, offering customers more flexibility

Okta, Inc, today (May 3, 2021) announced the successful completion of its acquisition of Auth0. Together, Okta and Auth0 address a broad set of digital identity use cases, providing secure access and enabling everyone to safely use any technology. 

Auth0 will operate as an independent business unit within Okta, led by Auth0 Chief Executive Officer and Co-Founder Eugenio Pace, reporting directly to Todd McKinnon, Chief Executive Officer and Co-Founder of Okta. Both Okta’s and Auth0’s platforms will be supported, invested in, and integrated over time — accelerating innovation and making the Okta Identity Cloud even more compelling for the full spectrum of customers and users. 

“Identity is one of the most strategic investments an organization will make today. A single, unified identity platform has the power to transform an organization by providing seamless and secure access for both customers and employees,” said McKinnon. “Okta and Auth0 have always shared a vision for the identity market. We’re also both cloud-first, customer-first companies. By joining forces, we’ll give our customers more choice and flexibility, driving tremendous value and enabling them to accelerate innovation. Together, we will shape the future of identity on the internet, empowering developers to build with identity at the foundation.”

"As Okta and Auth0 join forces today, bringing together two exceptional companies, I'm more confident than ever that we will deliver on our shared vision to secure access for everyone," said Pace. "Auth0's focus has always been on enabling product builders to innovate, and now as one company with a shared vision and combined resources, that innovation will only increase."

Okta’s and Auth0’s comprehensive, complementary, and flexible identity platforms solve every identity use case, regardless of the audience or user. Okta pioneered cloud-based identity, offering enterprise-grade reliability and world-class security while prioritizing customer success for organizations of all sizes. Auth0 was built by developers for developers. Application builders around the world are loyal to Auth0 for its extensibility, ease of use, scope of documentation, and developer-friendly experience. With combined expertise across developer communities and the enterprise, Okta and Auth0 will provide enhanced depth and breadth of identity solutions and will be even better suited to integrate quickly into the modern tech stack of today’s developers. 

“At Kiva, we’re on a mission to expand financial access to help underserved communities around the world thrive. Identity plays an essential role in making that happen," said Ken Leung, EVP of Engineering, Kiva. "Today, we leverage Auth0 to provide secure authentication to Kiva's partners and lenders, and Okta for workforce identity, giving our team access to the critical technologies they need to best serve the millions of global entrepreneurs in our network.  We trust both Okta and Auth0 to connect our people and technology, and are excited to see how they evolve and innovate together."

“Credence goes to those who can help us identify one another in a digital world,” said Jay Bretzmann, Program Director for Cybersecurity Products, IDC.  “Okta and Auth0 provide the cloud-ready, developer-friendly tools to help in the fight. They're building the platforms and technology we’ll need to take the next steps. Simple, elegant, and customer-centric." 

## Cautionary Language Concerning Forward-Looking Statements

This blog contains forward-looking statements relating to expectations, plans, and prospects including statements relating to the anticipated benefits that will be derived from this transaction, the expected acceleration of Okta’s growth as a result of this transaction, the impact to the Okta Identity Cloud, expected synergies resulting from the transaction and expansion of Okta’s customer base. These forward-looking statements are based upon the current expectations and beliefs of Okta’s management as of the date of this release and are subject to certain risks and uncertainties that could cause actual results to differ materially from those described in the forward-looking statements including, without limitation, the risk of adverse and unpredictable macro-economic conditions, the failure to achieve expected synergies and efficiencies of operations between Okta and Auth0, the ability of Okta and Auth0 to successfully integrate their respective businesses, the failure to timely develop and achieve market acceptance of the combined business, the loss of any Auth0 customers, the ability to coordinate strategy and resources between Okta and Auth0, and the ability of Okta and Auth0 to retain and motivate key employees of Auth0. Additional factors that could cause actual results to differ materially from these forward-looking statements are detailed from time to time in the reports Okta files with the Securities and Exchange Commission, including in Okta’s Annual Report on Form 10-K for the fiscal year ended January 31, 2021. All forward-looking statements in this press release are based on information available to Okta as of the date hereof, and Okta disclaims any obligation to update these forward-looking statements.

<include src="asides/AboutAuth0" />

Okta Completes Acquisition of Auth0

1Vitor de Sousa_Auth0

As Regional Vice President, Vitor de Sousa supports Okta and Auth0's German customers in achieving their Identity and Access Management goals. With more than 20 years of experience in the consumer goods industry, as well as in technology and software sales, he develops strategically smart and creative solutions for the interplay of identity authentication, customer experience, and data protection.

Regional Vice President, Enterprise Sales - Germany

Vitor de Sousa

Partnering with a provider to centralize identity lets you maintain control over your data without compromising user experience

Consumers expect the web apps and services they use to be intuitive while also requiring secure and private transactions and a low-friction experience. A good example of this is the increasing demand for biometrics, the use of a person’s physical attributes like a fingerprint or face scan to prove identity and control access. Consumers have become accustomed to the security and convenience that using a fingerprint to unlock their smartphone offers, so using the same technology to secure your web app is an intuitive way to help secure their account data.

[Auth0’s recent global survey](https://info.auth0.com/erwartungen-und-realitat.html), including more than 2,000 consumers and 200 IT/marketing decision-makers in Germany, found that 31% of German consumers are more likely to sign up for a service if it offers biometric authentication. Yet only 17% of German businesses offer this feature. SO biometric authentication is one way for businesses in the DACH region to better align themselves with their customers’ expectations for security without compromising their customer experience (CX). 

Partnering with an [Identity as a Service (IDaaS)](https://auth0.com/blog/what-is-idaas/) provider who understands how to combine an intuitive user interface with strong security measures like that offered by biometrics can bring additional benefits to your organization. For example: freeing your in-house development talent to focus on your core product, helping you meet regional data privacy regulations, and maintaining active control over your user data.

## Let Your Internal Talent Focus on Your Core Product

Germany is not only the largest economy in the EU; it is also home to the largest software developer talent pool in the region. [As of 2019](https://www.cbi.eu/market-information/outsourcing-itobpo/software-development-services/market-potential), there were more than 900,000 developers in the country, with a majority describing themselves as [Full-Stack front-end developers](https://insights.stackoverflow.com/survey/2021). To ensure your in-house dev teams can focus on those strengths, don’t distract them with an identity project. At Auth0, identity is our core product. Our teams built, maintained, and enhanced a Customer Identity and Access Management (CIAM) platform that incorporates industry security standards, an expert understanding of regional data privacy regulations, and a highly customizable set of integrations to bring you exactly the right mix of security, privacy, and CX.

Our identity specialists bring their expertise and knowledge to secure your authentication and authorization processes while also bringing your customers the tailored, low-friction CX they expect. That allows us to help you build a solution that will be capable of incorporating your needs in the present — while remaining extensible enough to scale with your plans for the future. 

The centralized identity solution you build will unify authentication for your platforms, services, and web apps. This single source of truth (SSoT) for your customer identity data is easier to secure than disparate, siloed data stores for each system. It also limits your attack surface by eliminating multiple access points and login boxes. 

By partnering with Auth0, you get a centralized identity platform that’s ready to be customized by your developers to meet your precise requirements. And our extensibility allows that platform to be readily extended to cover all of your existing properties, whether they’re modern cloud-based apps or legacy on-prem systems.

## Understanding Data Privacy Regulations in The DACH Region

EU Member States are allowed to enact national privacy rules to supplement, specify, and modify the GDPR rules as applied to their citizens. It’s important that companies familiarise themselves with these rules that often govern specific situations.

This document is not intended to act as legal advice. Please consult your legal counsel to ensure you are in compliance with all applicable data privacy laws and regulations.

The right to privacy is well established and respected in the DACH region, where such legislation existed long before the GDPR. Today there are additional rules such as the new German Privacy Act (BDSG-new) along with industry-specific regulations for, e.g., telecommunications, banking, and energy. In Austria, too, we see local regulations like the [Federal Act on the Protection of Individuals With Regard to the Processing of Personal Data (DSG)](https://www.dataguidance.com/notes/austria-data-protection-overview), all designed to put the privacy rights of citizens first.

[Switzerland](https://www.dataguidance.com/notes/switzerland-data-protection-overview) has a slightly different take on data protection regulations as well. In addition to GDPR, there are two additional laws that impact data collection and processing there. The first is Article 13 of the Swiss Constitution, which protects Swiss citizens’ rights to privacy in personal and family life, as well as within the home. Meanwhile, the Federal Act on Data Protection (FADP) solidified the language governing how those rights are protected in regards to digital data. Unless you have a team of lawyers and governance specialists for your developers to work with, making sure you’re in full compliance with all of these regulations will soak up a lot of internal resources. Partnering with an IDaaS provider can alleviate these additional strains by taking on the task of helping to assure compliance.

The DACH data privacy landscape can seem complex, and the responsibility for coding privacy into your applications often falls to the people building them. By partnering with Auth0, your developers can help you protect your customer’s personal information without becoming privacy experts themselves. Auth0’s key privacy-enabling features include:

* Easy access to user profiles to enable removal requests
* To export a user’s data in JSON format for data portability
* To enable Log Streaming for continuous security monitoring
* The knowledge that your data is stored locally at an AWS facility in Frankfurt

## Great Customer Experience Includes Choices for Data Location

Part of ensuring your customers get the experience they expect is maintaining control over the data they share when they create an account. Consolidating that data into an SSoT simplifies continuously monitoring its security and detecting threats and other anomalies. Having choices with respect to the location where your data is stored is another asset of partnering with an IDaaS provider like Auth0.

### Data security certification

Auth0 brings knowledge of [regional privacy regulations](https://auth0.com/docs/compliance/gdpr), along with internationally recognized certifications from organizations such as the International Standards Organization (ISO) [27001](https://www.iso.org/obp/ui/#iso:std:iso-iec:27001:ed-2:v1:en) and [27018](https://www.iso.org/standard/61498.html), along with a[ SOC 2 Type II audit](https://auth0.com/blog/auth0-achieves-soc-2-certification/). These are third-party verified certifications, meaning a specialized auditing body has signed off on the security of our processes, infrastructure, [platform](https://assets.ctfassets.net/kbkgmx9upatd/2KxmM5BICQ4GKgeIwA0sKu/d4f59bd579803593edcd571f1aa92ef0/Auth0_Platform_Operations.pdf), policies, and continuous monitoring framework. Auth0 complies with [additional regulations](https://auth0.com/de/security) as well, BaFin, EBA, and HIPAA for example. 

### Customizable user interfaces

[Auth0 Marketplace](https://marketplace.auth0.com/) offers integrations with major line-of-business software, while our [Actions](https://auth0.com/actions) capability allows your developers to work with these integrations with everything from drag and drop to a full Javascript editor. This ease of integration and customization means you can create your login box once and use it across properties.

### All your user data in one place

Being cloud-native gives Auth0 the flexibility to offer multiple data storage options. Access is a key piece of data residency. For organizations in the DACH region, we offer [private cloud deployment options on Microsoft Azure](https://auth0.com/blog/auth0-on-microsoft-azure-as-a-private-cloud-deployment-option/) or AWS infrastructure, as well as public cloud options using an AWS facility in multiple regions such as Frankfurt to help our customers achieve compliance. 

### Iterative deployment to ensure buy-in across the organization

Deploying a new identity and access management system can be a lengthy and complex process from a business perspective. Partnering with Auth0 and taking advantage of our identity experts allows for an iterative deployment and a smooth migration that does not jeopardize the user experience by offering frictionless user migrations without password resets. That way, each department or product team can witness a successful roll-out before giving their buy-in without straining your in-house talent. Cross-departmental collaboration is key to any software project, particularly when that software controls data access, and having a successful proof-of-concept (POC) in hand can help secure buy-in as you move forward.

Work with an identity partner that understands your need for a great digital experience without compromising the security and privacy of your customer data. [Reach out to our identity experts](https://auth0.com/contact-us) when you’re ready to continue the conversation or to find out how to start working with Auth0 today.


Centralize Identity For Security and Customer Experience

Our commitment to delivering a Tier 0 service for our customers

Resiliency, reliability, and adaptability are foundational tenets to how we build at Auth0. Last year, we recognized the need to deliberately double down on our resilience efforts in order to address some of the failures we had seen. In November 2021, I wrote about our [plans to improve the resilience of our platform](https://auth0.com/blog/improving-our-platform-resiliency-and-upcoming-holiday-plans/) and the additional steps we were taking to address the peak holiday traffic. I’m proud of the hard work and diligence by our teams during the holiday season that moved us considerably towards our goal of providing a Tier 0 service. Today, I want to provide updates to that work, share the progress to date, as well as provide insight into our upcoming efforts.

## Update on Our Resiliency Focus Areas to Date

As a reminder, a big focus area for our team was to reduce the load on our datastores. We made significant progress in this area:  

*   Reduced the database read/write workload by 50%. Our initial target was a 10% reduction, so we greatly surpassed our initial estimates
*   Reduced 45% of inserts/deletes from our database in US-1, 50% in EU, and 20% in the rest of our environments. The team's initial target was 40% in US-1 so we also beat this estimate

We also actioned all the initially identified resiliency priorities. These were all implemented either prior to the Thanksgiving holiday in the US or in early December:  

*   Added noisy neighbor protection for our extensibility stack (Webtask)
*   Expanded our caching approach for common Authentication API requests
*   Enforced new Auth API global rate limits for all production tenants
*   Enforced 100 RPS for non-production enterprise tenants
*   Refactored our connections schema and deleted unused entries/rows; in US-1, we reduced the table size by ~25X.
*   Overprovisioning of our stack was done in anticipation of holiday traffic, we’ve since downsized based on usage data and some of the other protections put into place

While we made great progress on our improvement initiatives, I want to acknowledge that in December we experienced a few issues related to our network edge, which caused unfortunate customer impact. We have met with our network edge provider to ensure our expectations around incident response and service levels are understood and upheld. We’ve also initiated a new internal effort to review our Edge resiliency plan and kicked off the discovery work. We’ll provide further updates as we make meaningful progress on this effort.

## What’s Next in 2022

Resiliency has been and remains a top priority for Auth0 in 2022. The work that I outlined above has laid strong foundations that will serve as a springboard for our ongoing priorities. Below are a few key highlights of what to expect this year.

### New Environments
This is one of our top priorities for the first half of 2022. Construction efforts have kicked off for three new production environments that will enable us to shift load as required for our demand response strategies and limit the blast radius of disruptions and outages. These environments will be launched in 1H 2022 and will feature two new options in the US and one in the EU.

### Automated Tenant Migration Process

In addition to new environments, our team has been working on our capabilities to move tenants from one environment to another in order to further reduce the blast radius. The early design work began in Q3 2021, with a focus on high-touch migration of select targeted customers based on feature usage, workload, and configuration. As we iterate and learn from that effort, we will shape up our tenant migration process from “high-touch”/manual intensive to a more automated process.

### New Platform Rollout

We are laser-focused on our platform modernization efforts which have an underlying architecture that is responsive and resilient to meet all current and anticipated customer needs. The new platform is already powering our product that [launched on MS Azure](https://auth0.com/blog/auth0-on-microsoft-azure-as-a-private-cloud-deployment-option/) in November 2021. I will share details about the availability of this new platform on AWS as we get closer to launch in Q1 2022.

Thank you for the continued trust that you place in Auth0 to meet your identity needs. We have exciting things in the works that will enable us to continue our delivery of a Tier 0 service with all of the product innovation you have come to rely on for your applications.

A Look Back to Our Platform Resiliency and What’s Next

auziros:mckenzie-mayer

Customer Identity (CIAM) Product Comms lead, driving collective storytelling across Okta and Auth0. Making technology accessible for everyone.

Customer Identity Product Comms Lead at Okta

McKenzie Mayer

Global travel marketplace uses Auth0 to eliminate passwords and block suspicious login activity for millions of customers

**LONDON – 13 January 2021** –[ Auth0](https://auth0.com), a product unit within[ Okta](https://www.okta.com/) (NASDAQ: OKTA), today congratulates its customer, [Skyscanner](https://skyscanner.net), the global travel marketplace, on receiving the 2021 European Identity and Cloud Award for Customer Authentication, presented by [KuppingerCole Analysts AG](https://www.kuppingercole.com/). The winning customer identity project, designed to put travelers first with a simple and secure user experience, helped Skyscanner eliminate nearly all passwords for millions of customers, while blocking suspicious login activity that could signal an attack.

“Skyscanner’s mission is to lead the global transformation for modern and sustainable travel. This includes leveraging Auth0’s modern identity platform to give our customers a complete booking experience, while keeping their data secure,” said Brett Bunting, principal product manager at Skyscanner. “It is an honor and a privilege to receive this award from KuppingerCole, as we work to make booking travel safe and friction-free for everyone.”

Using the Auth0 platform, Skyscanner’s development team introduced [“passwordless” authentication](https://auth0.com/resources/whitepapers/passwordless-authentication), along with intelligent security features to detect and stop malicious attempts to access user accounts. Travelers can now sign up for a Skyscanner account simply and securely with just one click using either a one-time password (OTP) delivered via email, or Google One Tap, which prompts users to log in with their existing Google account. 

Skyscanner was also among the first to use Auth0’s Attack Protection suite to defend against breached passwords, suspicious IP addresses, and bots and scripted attacks, without adding friction for legitimate customers. Travel and retail brands are targeted most by brute force attacks, followed by organizations in the industrial services, government, and technology sectors, according to [Auth0’s 2021 State of Secure Identity Report](https://auth0.com/resources/whitepapers/state-of-security-identity-report). 

“Eliminating passwords and replacing them with strong yet adaptive and frictionless multi-factor authentication is the approach we as security experts have been promoting for years, and yet successful projects of this kind are still quite rare,” said KuppingerCole Senior Analyst Alexei Balaganski in his laudation at the award ceremony. “All this makes the project we honor today even more impressive, considering its sheer scale: Skyscanner serves millions of users from all around the world, seamlessly supporting a broad range of authentication options and protecting its customers and own infrastructure from cyberattacks.”

For the list of 2021 European Identity and Cloud Award winners, please visit the [KuppingerCole website](https://www.kuppingercole.com/eic-2021-awards).

<include src="asides/AboutAuth0" />

Skyscanner Wins KuppingerCole Customer Authentication Award with Auth0

david-telehowski

David Telehowski is Director of Security Engineering at Auth0 and his team is responsible for securing the Auth0 Identity Platform. He has over 20 years of experience designing and building innovative cybersecurity products and services. Prior to joining Auth0 David led global engineering teams at SonicWall and Dell, and he has been awarded several patents in the areas of remote access and network security. David holds bachelor's and master's degrees in computer engineering from the University of Michigan.

Director, Security Engineering

David Telehowski

How we expanded customer choice while building a security-first architecture.

Choice is good. We like it when our supermarket shelves are stocked with hundreds of varieties of breakfast cereal. We pick the smartphones we use and the cars we drive. The same should be true for businesses and the technologies they use.

Today, we brought the Auth0 Identity Platform to Microsoft Azure, giving our private cloud customers the ability to pick the right infrastructure provider for their needs.

This means a greater selection of regions. Microsoft currently operates in over 60 regions around the world, making it easier to comply with data residency and sovereignty requirements.

And if you’re already running your app on Azure’s cloud servers, you’ll benefit from a converged infrastructure, with every component running on the same underlying cloud platform.

![Azure](https://images.ctfassets.net/23aumh6u8s0i/3LjSNS6Motv1nFGNKkIQn/3f9353b41dd9653536e2e9b9f664689a/72798-Auth0_AzureMap-D2-02-01.jpg)

## Shifting Security Left on Microsoft Azure

We’re equally excited to tell you about the development process. Auth0 has always prioritized security. Last year, we took this a step further with the adoption of “Shift-Left” principles. This puts security-related tasks at the start of the Software Development Life Cycle (SDLC), making it easier to build a stronger, more resilient product.

We remained true to these principles when building the Auth0 Identity Platform for Microsoft Azure, and are thrilled with the end result. The final product is one that reflects our **Secure by Design** philosophy and faithfully adheres to industry best practices.

Let’s talk about what “Shift-Left” means. This is an established term in the software development sphere, and refers to a variety of domains, both security-related and otherwise. In short, you take something that would typically happen at the end of the development lifecycle and tackle it at the beginning. Test-driven development (TDD) is a notable example.

As Auth0’s CISO Jameeka Aaron said: “Nobody wants their CISO to show up at the last minute with 800 vulnerabilities to be fixed before release.” Our security engineering team looks for vulnerabilities during the design and development phases, and remediates issues early on to prevent a last-minute crunch, or worse, having to rework the design.

At Auth0, our Shift-Left process tackles both the human and technical elements of secure software development. All code must meet strict security requirements and is constantly tested against sophisticated static analysis benchmarks.

We also provide all developers with secure coding training, with some designated as “security champions.” These employees act as liaisons between the engineering and our dedicated platform security teams. They also receive additional training to act as security advocates within their teams.

## Security First Architecture

As we developed the Auth0 Identity Platform for Microsoft Azure, we emphasized “shift-left” principles and focused on building a strong security architecture at the start of the development cycle.

We established a dedicated Azure AD tenant and automated governance controls to support resource and identity isolation, required MFA and Azure PIM for privileged access, and enforced security standards with Azure Policy. Prioritizing security in the early stages of the development process is part of our Secure by Design strategy to mitigate risk and keep customers safe from cyberthreats.

The Security Engineering team is also responsible for Azure customer account provisioning and management. In Azure, these are called subscriptions. These are used to isolate private cloud environments and all the associated provisioned resources, like VMs, data storage, and more.

We built a new service for managing Azure subscriptions, and it is integrated directly into our platform infrastructure workflows. This helped to automate how we manage our Azure Private Cloud environments and dramatically improved environment creation time. This was another part of our Azure governance to keep customer environments isolated and secure.

## Cloudflare on the Edge

To help protect against network-based attacks, the Auth0 Identity Platform uses Cloudflare — a popular reverse proxy and content delivery network (CDN) product.

Cloudflare acts as a gateway between the application and the outside world. The service proactively analyzes all inbound traffic, and blocks things that could harm the smooth functioning of the Azure instance, including malicious bots and DDoS attacks. Further protection comes from its customizable rate limiting and firewall rules.

This means a better, more reliable service for your users. It also comes with some significant performance advantages, too. With Cloudflare's CDN, static assets (like images and scripts) are hosted close to the user, thereby reducing load times. Traffic is routed through Cloudflare's Anycast network, which consists of over 250 locations in 100 countries, and provides greater resiliency and latencies below 50ms.

## Detection & Response

In the hands of an IT engineer, security professional, or developer, logs are a powerful tool. They're the first place you look when remediating a fiendishly tricky problem, or trying to identify an attempted intrusion.

When building the Auth0 Identity Platform for Microsoft Azure, we wanted to make it easy to audit and monitor. Logging is enabled by default on all Azure instances, as well as with the back-end databases. By default, we retain logs for 13 months.

Each Azure environment is covered by Auth0's host monitoring agents. This monitors the security, performance, configuration and state of each host. We also enabled Azure Security Center & Defender by default, further bolstering our security monitoring capabilities.

## Disaster Recovery

Identity is fundamental to business. Your CIAM system is the gateway between your application and its users. You can’t afford significant downtime. With this in mind, we spent a lot of time thinking about resilience when designing the Auth0 Identity Platform for Microsoft Azure.

All services are provisioned across three Availability Zones (AZ). In the case of an AZ failure, service are designed to automatically resume in one of the other healthy AZs. Backups are captured every six hours and securely retained in the same region as the deployment, and we can restore an instance from the last snapshot in four hours.

## Azure’s Solid Foundations

Let’s wrap up by talking about Microsoft Azure itself. After all, what’s the point in building a secure platform if the underlying infrastructure isn’t up to standard?

Fortunately, there’s no such concerns here. We have come to appreciate the security features and tools within the underlying Azure platform and ecosystem. Microsoft also has the right mindset. The Azure access control best practices urge users to regard identity as the primary security perimeter. This reflects the changes in enterprise IT, particularly the rise of BYOD and cloud computing, which make it harder to build watertight network defenses.

Identity is the best way to protect your most important data. Well-defined permissions can limit the impact of a security breach, while using MFA and SSO can help prevent an account being compromised in the first place. To find out how the Auth0 Identity Platform on Microsoft Azure can benefit your organization, [click here](https://auth0.com/contact-us).

Why Auth0 “Shifted Left” with Azure

Cosmetics firm replaces home-built authentication with Auth0 to optimise developers’ time and simplify security for customers and staff throughout the business

**LONDON. – 9th November, 2021** – The [Auth0 Identity Platform](https://auth0.com/), a product unit within Okta, has been selected by [Lush](https://www.lush.com/uk/en), the global cosmetics retailer, to provide a superior login experience for customers and staff interacting with the online brand. Auth0 will initially power the login experience for Lush’s new chat function and add website authentication, along with centralising its point-of-sale (PoS) system to simplify access to information throughout the organisation, while helping to ensure privacy.

When it comes to pursuing more [ethical ways of doing business](https://weare.lush.com/lush-life/our-ethics/digital-ethics/), Lush is no stranger to pushing the limits. Founded in the 1990s, its commitment to sustainable, cruelty-free production was initially an outlier in cosmetics, but the brand has influenced the direction of the industry as a whole. In the process, it has grown into a successful multinational business and operates in 47 countries with 937 global Lush shops. The latest business numbers can be found on [Lush’s company information website](https://weare.lush.com/numbers).

Traditionally, Lush preferred to build its digital services in-house following its digital ethics code. However, when it restructured its digital business using a microservices architecture, the company found that its approach to authentication complicated its ability to protect customer data, which raised security concerns within the company. What’s more, the time taken for developers to maintain its internally-built authentication system strained innovation across other parts of the business.

“While we didn't experience any major data leaks, our home-baked solution raised red flags for our internal data privacy team, and that posed a huge risk for us since we are a business built on ethics,” said Simon Ince, Lush’s creative technology and innovation lead. “During the development of a new customer chat function, we hit a roadblock with our existing authentication system. Time was not on our side, so we evaluated open standards as an alternative to building in-house. That’s when we discovered Auth0, and the problem was solved in thirty minutes.”

Following the success of the chat system, Lush evaluated Auth0’s solution for use across other parts of the business — including its website redesign and centralizing its global POS system — to create a more seamless, secure, and personalized end-user experience. With Auth0, just two developers were able to add authentication to Lush's website without impacting Lush's existing timeline or roadmap.

“When business and consumer needs rapidly evolve, and the security landscape becomes even more complex, maintaining in-house systems can be a difficult and time-consuming process — one that takes developers away from other, more pressing tasks,” said Steven Rees-Pullman, SVP International at Auth0. “Auth0’s identity platform enables Lush to refocus its development teams where they can bring the most value, while meeting the company’s ethical standards for data privacy and customer security.”

Learn more about [Lush’s implementation](https://auth0.com/case-studies/lush-cs/) on Auth0.com.

<include src="asides/AboutAuth0" />
### Media Contacts
Auth0 Global Communications<br />
[press@auth0.com](mailto:press@auth0.com)<br />


Lush Transforms its Login Experience with Auth0

We are committed to delivering a Tier 0 service for our customers

Over the last few months, there has been an increase in service degradation and outages that has shaken our customer’s confidence in Auth0. Our number one mission is to provide you with the highest level of service and reliability at all times, for the full spectrum of customers from free users to enterprise. The production environments in US-1 and EU have been impacted the most frequently and, in extreme cases, has caused downtime for some of our customers. As the Auth0 CPO, I sincerely apologize for the pain this caused you and your customers. We take ownership for the failures and recognize how disappointed you are.

We know that identity plays a critical role in your company, and it is our responsibility to make our service reliable. It is also our responsibility to provide guidance to our customers on appropriate architecture patterns. When we experience failures or degradation of our service, we correct them as swiftly as possible. Today, I wanted to share the active measures we are taking to protect against similar issues from occurring in the future.

## First, What Caused the Outages?

Before we explore all of the actions we have taken, it’s good to understand the patterns we have observed in these environments:

### Noisy neighbors in our large multi-tenant environments create throughput bottlenecks

The noisy neighbor phenomenon is a well-known issue in multi-tenant environments. In our case, one co-tenant may experience a spike in traffic which can lead them to monopolize resources available and thus reduce the throughput (requests-per-second) on the environment for the other co-tenants.

Most of our customers in the US-1 and EU environments have enjoyed many years of uninterrupted service. These environments have grown significantly and are now the longest-running and largest, which exacerbates the noisy neighbor impact.

We have not strictly enforced restrictions to the frequency of customer API calls (rate limits) and at times allowed for a 10X increase in requests-per-second (RPS) for certain tenants in a single environment. Typically, our architecture would allow us to absorb these spikes as it is the case in most of our environments, but given the volume and size of the customers in US-1 and EU, these concurrent requests restrict throughput for other tenants. We do not fault our customers for their peak traffic needs and it is on us to put in place the right protections and guardrails around each tenant. Unfortunately, we are not able to actively load shed today (i.e. automatically move tenants to other environments such as US-3, because we don’t currently have the migration tooling nor can we do it without any downtime). There are some customer scenarios where a planned migration by a customer is possible, but it requires time and effort on your part. I will cover migration scenarios and timing in the ‘Looking beyond the next 60 days’ section below.

### Region Mean Time To Recovery (MTTR) outside of our 15-min target

The other item we are solving is meeting our 15 minutes target for region failover. This is caused by dependencies on an underlying managed service that doesn’t support automated failover within our target timeframe. Our teams are in the final stages of completing the switch, a managed service that allows us to automatically failover within 15-minutes, in Q1 2022.

We can successfully failover Availability Zones (AZ) today within our 1-minute target window as validated by quarterly testing.

## What Actions Have We Taken Already?

### Slowing down and invoking our change freeze earlier

Effective Sept. 30, 2021, we’ve significantly reduced the number and frequency of changes that we’re introducing into production for the remainder of the year. This is to introduce increased testing and soak time in pre-production environments. Heading into the holiday season, our protocols may change slightly, however, we anticipate continuing a conservative posture to maintain the stability of our production environments. We are mostly allowing changes that are related to our resiliency initiatives or security patches. Being an authentication platform, security-related changes are non-negotiable, as is our mission to protect you and your customers.

### New staging environment

As of early October, we have a staging environment that has the same load as US-1, so that we can simulate test cases reproducing production traffic at large scale. The volume and high load-related issues described above can now be more easily detected.

### Additional resources and re-prioritization of our roadmap

We have added team members and reprioritized resilience projects in order to complete these improvements in time for the holiday season. I am personally doing a daily stand-up with our Engineering leadership team to ensure there is an elevated review process and all blockers are actively being addressed. In addition, all new product and feature initiatives have been deferred until the new year.

### Resilience and holiday readiness efforts

After our outage on April 20th, a dedicated team of 40 engineers completed a 10-week task force to reduce the load on our environments that resulted in:

*   Reduced cache load by removing unused feature flags and added in-memory caching of multiple per-environment feature flags.
*   Removed 2 collections from our database that reduced total database writes by 10%.
*   Reduced reads to the collection with the most reads within the database by 12%.
*   Added limits to refresh tokens queries from the Management API.
*   Added missing indexes for new collections in the database.

Some of the improvements identified were multi-quarter projects that are still underway and are expected to be completed this November. These projects will:

*   Reduce the read/write workload by 10%.
*   Reduce 40% of inserts/deletes from our database.
*   Reduce 30% of inserts/deletes from our database in US-1 enviroment. This requires a deprecation of opaque access tokens and will take 6 months to complete.

In October, we started the following remediation projects to further reduce the probability of these failures:

*   Refactoring our connections schema to remove high cardinality issues.
*   Addressing noisy neighbor issues in our extensibility stack (also known as Webtask).
*   Implementing an additional caching layer for reading requests.
*   Proactively and significantly over-provisioning our stack in an effort to get ready for holiday traffic.
*   Enforcing global active rate management per tenant at the edge.

The projects listed above are also scheduled to be live and in production by November 10. We know that all of the initiatives above will reduce the load on our environments and should significantly reduce the noisy neighbor issue I referenced above.

We are also initiating code change freeze windows over the holidays:

🟧 **Orange Change Freeze** 10/12 - 11/11 <br>

🟥 **Red Change Freeze** 11/12 - 11/29 <br>

🟧 **Orange Change Freeze** 11/30 - 12/16 <br>

🟥 **Red Change Freeze** 12/17 - 01/03 <br>

🟧 **Orange Change Freeze:** During this window, all production deployments are halted, and only work related to stability for Mission Critical Services, security patches or urgent releases on other components may be deployed. Changes must meet testing and approval criteria. <br>

🟥 **Red Change Freeze**: During this window, all production deployments are halted. Exceptions allowed only to resolve critical customer issues or security patches. Changes must meet testing and approval criteria. <br>

## Looking Beyond the Next 60 Days

### New environments and migration capabilities

We are now actively working on creating new environments in our US and EU regions. Our target is to progressively introduce 4 new environments in the US and up to 3 new environments in the EU in CY Q1 2022. The new environments allow us to dynamically allocate load as part of our demand response strategies and significantly reduce the blast radius of disruptions and outages. Our team is also actively scoping and designing an automated tenant migration process. We expect to have an automated tenant migration tool that will enable us to work with you and migrate you over to one of our newer environments beginning late CY Q1 2022.

### New platform rollout across clouds and regions

We began working on a modern platform last year that is poised to roll out across the regions and clouds that we operate in. This month we began the gradual rollout of this new platform and made it available on Microsoft's Azure cloud. This new platform architecture has been purposefully designed from the ground up to deliver a scalable, reliable, and resilient service that meets the current and future needs of our customers. We are targeting to make this available on AWS starting CY 1H 2022.

Finally, we truly appreciate your trust in Auth0 and will do everything that we can to keep that trust. I will post another public update in early CY Q1 2022 to share the results of all of our work in future blog updates including the progress of the improvement initiatives listed above.

_Please note: any unreleased products, features, or functionality referenced in this disclosure may not be currently available and may not be delivered on time or at all. Product roadmaps do not represent a commitment, obligation, or promise to deliver any product, feature, or functionality, and you should not rely on them to make your purchase decisions._

Improving Our Platform Resiliency and Upcoming Holiday Plans

tyler-clark

Tyler works as a developer advocate engineer at Auth0. He's worked as an engineer at small to enterprise level companies and loves everything about tech. You'll frequently find him ether out with his family, playing sports, or coding something. He's also an instructor on <a target='_blank' rel='noopener noreferrer' href='https://egghead.io'><strong><b>egghead.io</b></strong></a>, and his profile is online at <a target='_blank' rel='noopener noreferrer' href='https://tylerclark.dev'><strong><b>tylerclark.dev</b></strong></a>.

Senior Developer Advocate Engineer

Tyler Clark

Easily manage the business customers that access your applications



We're very excited to announce a new way to enable businesses and teams to access your applications: **Auth0 Organizations!**

Auth0 is a software-as-a-service product. Like many SaaS platforms, Auth0 can be used by individuals, but more often than not, it is used by teams. When building SaaS, or any B2B application, developers need a way to represent and manage those teams.

Often, SaaS products will have dashboards that allow each of their customers’ administrators to manage their organizations:

- Manage membership and access levels of their team members
- Invite new members with predefined roles
- Connect their identity provider for single sign-on
- Define authentication factors and security policies

We’re forced to build this all from scratch each time we create an application, which cuts into the time we have to build the app itself. We’ve struggled with this at Auth0 when building our applications, like [our Dashboard](https://manage.auth0.com/), and when we speak with engineers and architects that work at our customers’ companies, we’ve heard similar stories.

These problems are common enough to deserve a purpose-built solution, and that is why we built Organizations.

## How Does it Work?

We’re introducing a new “organization” entity that will live in your Auth0 tenant. You can create organizations representing teams, business customers, partner companies, or any logical grouping of users who should have different access to your applications.

![Screenshot of a list of organizations within the Auth0 dashboard](https://images.ctfassets.net/23aumh6u8s0i/62tk5hrj3iPvHwgckwvkDJ/3b549543665a5ec999533d4da0ad52a5/approved-asset-three.jpeg.png)

Using Organizations and New Universal Login, you can configure and customize the log-in experience that end users in these organizations have when accessing your product. You can mix and match your branding with your customers in the login experience and email communications and easily configure federation for your larger customers and partners that need it.

![Side by side view of universal logins](https://images.ctfassets.net/23aumh6u8s0i/2UBgf6RIt2WX6kbToKKzg6/28717eead2542bdd0f7c463f030a72ab/asset-blog-2-APPROVED.png)

You can choose from various methods for membership and access management of the different organizations that access your product:

- Define roles for your applications, then invite users to organizations with those roles predefined. Also, the same user can have different roles in different organizations, so you can model user isolation or cross-organizational access as needed for your app.
- Turn on just-in-time membership so that anyone logging in from a specific federated connection becomes a member of the organization.
- Add members via the Manage Dashboard or API, or expose all of this functionality in your application so that your customers can manage their membership!

![Invite members to organizations and edit authentication of organizations](https://images.ctfassets.net/23aumh6u8s0i/12YZpXmHDIoEGhgHuESANn/3c834b9cee90b16711809f80f45b971b/asset-blog-3-APPROVED.png)

## Let’s Build a SaaS App with Organizations!

<AmpContent>
<amp-youtube
    data-videoid="BcUxeThMq74"
    layout="responsive"
    width="480" height="270">
</amp-youtube>
</AmpContent>
<NonAmpContent>
<iframe width="560" height="315" src="https://www.youtube.com/embed/BcUxeThMq74" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>
</NonAmpContent>

Before we walk through a demo application utilizing organizations, let’s chat briefly about who the target audience is again. As the title suggests, SaaS (Software as a service) companies provide cloud-based applications that typically charge on a subscription model. Their platforms help other businesses focus on their core product by relieving stress on other business needs. Think about products like Slack or DataDog. When you log in to these platforms, they need to know what company or workspace you belong to before getting you to the correct login flow and, ultimately, the appropriate tenant in their platform.

With businesses as the target customer for SaaS and B2B companies, handling authentication of users within these businesses can be complicated. How are users organized within a specific target business? What about separate branding, access control, and SSO for each business?

Let’s answer these questions with a demo application and Auth0 Organizations!

### Chat0

Introducing our demo app: Chat0, the demo SaaS company that provides state-of-the-art communication services 😀!

![Screenshot of Chat0 dummy app](https://images.ctfassets.net/23aumh6u8s0i/NlvSED8ZuEQz9KtKjMQ1D/134de05a845d028a5696c84b9e0e9332/orgs-overview-2.jpeg.png)

You can try Chat0 yourself by cloning and installing the repo found [here](https://github.com/twclark0/orgs-sample-app).

Once you have this repo cloned to your local machine, navigate into its directory and then run the following commands:

`npm install`

And then

`npm start`

After running this last command, open Chat0 on your browser of choice at `http://localhost:3000/`.

Chat0 is a React single-page web application for this demo, which means that it doesn’t have a back end. With our artificial SaaS company, we invite businesses to sign up for our communication services.

Once businesses have created an account with Chat0, they can send messages (not included in the demo app code) and view stats of their company’s communications.

![Screenshot of the Chat0 dashboard](https://images.ctfassets.net/23aumh6u8s0i/2Ck8zg899VCR0VrTcJBDiR/e15c935d7db75b7d0ff9260b32efb811/chat0-dashboard.jpeg.png)

As you can see above, we want users of a business to see the data after authenticating. However, we want this page to be branded and have data specific to the user’s business/organization. Again, this is similar to the flow you see when you try logging into Slack and DataDog. The result is your company’s or workspace’s brand and data.

So let’s work with a SaaS company (Chat0), add authentication with organization capabilities, brand those two Universal Login experiences, set up individual connections, and invite new users to an organization.

### Set up Auth0 and Configure the React SDK

![Screenshot of Auth0 applications dashboard](https://images.ctfassets.net/23aumh6u8s0i/ECqJSSY7cAaG82huQqHGc/5b064214fb171f3bbf1a3112cd335d92/applictions.png)

You will first need to [sign up for an Auth0](https://a0.to/blog_signup) account if you do not already have one.

Once you’ve signed up for or logged into your account, you’ll land on the dashboard.

Within the left navbar, click on _Applications_ and then _Applications_ again. Press the _Create Application_ button in the top right corner. Choose the Single Page Web Applications option and give it a good name.

After the application is created, the only configuration you need to do is to update three text boxes:

- _Allowed Callback URLs_
- _Allowed Logout URLs_
- _Allowed Web Origins_

We will update these text boxes with `localhost` for local development.

![Screenshot of Auth0 magic mirror application](https://images.ctfassets.net/23aumh6u8s0i/4HphywO1Dwx0bLISHm8kYc/72cc3194241080779688cf8932013621/applicationsettings.jpeg.png)

I filled out those text boxes as follows:

_Allowed Callback URLs_

`http://localhost:3000/`

The above value is the URL that Auth0 can use to redirect your users after they successfully log in.

_Allowed Logout URLs_

`http://localhost:3000/`

The above value is the URL that Auth0 can use to redirect your users after they log out.

_Allowed Web Origins_

`http://localhost:3000/`

Now inside Chat0’s code, we need to update the React SDK provider values with the ones created when we created the new application within Auth0.

On the `AuthWrapper.js` page, we need to update the props provided to the `Auth0Provider` component. We need to update the `domain` and the `clientId` with the _domain_ and _clientId_ shown within the Auth0 Application page we just created.

```javascript
export const AuthWrapper = ({ children }) => {
const currentOrganization = localStorage.getItem("organization_id");
const options = {
domain: "dev-rm3u1yq4.auth0.com",
clientId: "OgdvG5snvJGpeIrW9FKXbB5D9UmSQufP",
redirectUri: window.location.origin,
...(currentOrganization ? { organization: currentOrganization } : null)
};
return <Auth0Provider {...options}>{children}</Auth0Provider>;
};
```

The `redirectUri` value is where you want your application to redirect to when logging out.

The `organization` prop is being conditionally passed depending on if we've stored an organization id within the browser yet. We'll talk more about this after we configure Organizations within this application. So hang tight!

If you want to learn more about the Auth0 React SDK, check out this [video](https://www.youtube.com/watch?v=1rgeO_EbSGg)!

### Brand Your Auth0 Application

Auth0 provides easy customization of your Universal Login. Back within your Auth0 account dashboard, click on _Branding_ and then _Universal Login_. This is the login page that Chat0’s business customers will see when they want to authenticate.

If you scroll down to the bottom of the page, you can provide a link to your SaaS company’s logo and colors. As you can see, these are the values I provided for Chat0.

![Screenshot of Auth0 Universal Login customization](https://images.ctfassets.net/23aumh6u8s0i/5TM8XsJKpyfPoSHrmAJjW4/452f8f2acd81876fb20e9502979448b9/universal-login-custom.jpeg.png)

### Configure and Set Up Organizations

At this point, we have a functioning application, complete with simple Auth0 powered authentication. Now, let’s enable organization support and add an organization to our Auth0 application.

Back within our Auth0 dashboard and Chat0 application, notice there is a tab called _Organizations_. Go ahead and click on that tab.

![Screenshot of Auth0 organization settings page](https://images.ctfassets.net/23aumh6u8s0i/2sEk40iRY0ADpuIxlm3WbO/f9c7befb5c3435147a65bfb2261c1210/enable.jpeg)

Go ahead and toggle the green _Display Organization Prompt_ button. As it states below, this will prompt users to enter their organization name before logging in.

![Authentication prompt for organizations](https://images.ctfassets.net/23aumh6u8s0i/2fDmJPNHNWzbE2RAZBtN3d/69e8dcbc8fce760e5727e8f60822251c/universal-login-2.jpeg)

With the Universal Login ready to accept a user’s input for their organization, let’s now create an organization within our tenant.

On the left-hand sidebar, click on _Organizations_. Then on this page, click on the button that says _CREATE ORGANIZATION_.

![Screenshot of organizations tab within Auth0 dashboard](https://images.ctfassets.net/23aumh6u8s0i/6Z3aYFlcAnFRQMXeG5VXQk/dc050e0f0d41dd03f2e5b044bc42ccaf/dashboardorganization.jpeg)

After clicking on the _CREATE ORGANIZATION_ button, we are directed to this page to add basic information about our new organization.

![Screenshot of how to add an organization](https://images.ctfassets.net/23aumh6u8s0i/2848XRMQCXWk7HWSw2S229/3e49ae7ede2ed1ab7d2481aac6159c73/addorganization.jpeg)

As the text on this page states, the name is a human-readable identifier for the organization. Also, the display name is a friendly name for the organization. For example, I choose `acme` for the name and then `Acme` for the display name.

Once you are satisfied with the new organization, click on _ADD ORGANIZATION_.

You will then see your newly created organization.

Within this screen, you have the power to do a lot of customization. As you can see in the picture below, I have branded my new organization with some colors and a logo.

![Screenshot of an individual organization view](https://images.ctfassets.net/23aumh6u8s0i/39FS8nQYPsJoCSuumYfLfH/fda0ecc4622cbe9952fb33bd8a94026f/individualorg.jpeg)

At the bottom of this page, you can add custom metadata about your organization for extensibility purposes.

The _Members_ tab shows all of the current members within the organization. The _ADD MEMBERS_ button allows you to add a member to this specific organization.

Let’s create a new user and add them to this organization. So on the left-hand side of the page, click on _User Management_ and then _Users_. Here we can click on the _CREATE USER_ button and enter information about a new user. Once this is saved, back in our organization, we can click on the _ADD MEMBERS_ and add this new user to the organization.

The _Invitations_ tab provides the functionality to invite users to this specific organization.

![Screenshot of the members’ tab within Auth0 dashboard](https://images.ctfassets.net/23aumh6u8s0i/3YCjKOoeqzlgNV0Uwy6xnL/0b5d9be884e2813d6f1f182e954df635/invite.jpeg)

After clicking on the _INVITE MEMBERS_ button, you can choose your application from the initial dropdown (only ones with organizations enabled will show in the list).

Then you can add email addresses, determine which connections can be used and what role to assign them as a member of that organization (if there are any roles defined within your tenant).

Finally, on the _Connections_ tab, you can choose which connections you want to enable for this specific organization. Instead of enforcing the same connections to all applications within your tenant, you can control how each organization’s members can log in.

![Screenshot of the connections tab within organizations](https://images.ctfassets.net/23aumh6u8s0i/1kUkcgHRQYH7MrdIAviGLq/7cc069d1394cedade92f597ad6e9053d/connections.jpeg)

And that’s it!

When you go back to Chat0, which is running locally, click on the _login_ button in the header. It will show you the Chat0 Universal Login prompt asking for an organization.

![Authentication prompt for organizations](https://images.ctfassets.net/23aumh6u8s0i/34QV5KntgVMfvl5m54Gh7l/1df56e270aa9144b368ef0e7f6c8166f/universal-login-2.jpeg)

After entering _acme_ (the name of the newly created organization), it’ll open up the Acme-specific login.

![Authentication prompt for the acme organization](https://images.ctfassets.net/23aumh6u8s0i/3R0aMeqwdCOzTq5I8MKMtH/8eba028a984741815073a7aeaabe06f2/acme.jpeg)

Login with the user you created earlier, and then you will be redirected to the Chat0 dashboard for Acme users.

![Screenshot of a dashboard branded with the acme logo](https://images.ctfassets.net/23aumh6u8s0i/3SLUeDBuqPkcMceXiPZZEi/198df05368106dbf4482cf1a41e7d2c9/acmedashboard.jpeg)

Remember when we discussed conditionally setting the `organization` prop on the `Auth0Provider` component above? Within the `Sidebar.js` component, we set this `id` within `localStorage` when we get it.

```javascript
const { user } = useAuth0();
useEffect(() => {
if (user.org_id) {
localStorage.setItem("organization_id", String(user.org_id));
}
}, [user.org_id]);
```

The Auth0 React SDK provides the `user` object. This includes basic information about the user after successful authentication.

Setting and retrieving the authenticated organization id is what keeps the user authenticated when refreshing the page.

## Taking It Further

This article barely scratches the surface of the full functionality of Organizations. Using these new features, you can:

- Represent the teams, business customers, and partners that use your applications as organizations in Auth0.
- Set up branded, federated login flows for each organization.
- Manage organization members in a variety of ways, including just-in-time membership and email invitations.
- Define roles to represent what end users can do in your applications and assign those roles to organization members to have different roles in different organizations.
- Build administration capabilities into your products so that administrators in those organizations can manage their membership and access levels.

## What’s Next

As of today, Organizations is available for Auth0 subscribers on our Enterprise and Startup plans. You can find [technical documentation here](https://www.auth0.com/docs/organizations). We’ll be introducing new capabilities to improve organizations. We’d love to hear your thoughts about what we should focus on next; just comment below or send us questions [in the community forum](https://community.auth0.com/).

Introducing Auth0 Organizations

kaycie-east

As PR Manager, Kaycie supports public relations and global communications efforts for Auth0 in the AMER region. When not promoting the Auth0 brand, Kaycie can be found hiking, traveling, or searching for the next best bite to eat.

PR Manager, AMER Region

Kaycie East

New private cloud deployment option offers customers greater choice, scalability, and reliability

**BELLEVUE, Wash. – Oct. 13, 2021 –** The [Auth0 Identity Platform](https://auth0.com/), a product unit within Okta (NASDAQ: OKTA), today announced the launch of the [Auth0 Identity Platform on Microsoft Azure](https://auth0.com/cloud/azure). The launch gives customers the ability to choose Azure as their cloud deployment option from Auth0. The addition of Azure as an Auth0 private cloud platform option unlocks a secure cloud deployment option for organizations seeking strategic fit with their technology stack, supporting regional data residency capabilities and higher control over customer data.

Today, organizations moving to the cloud and selecting a [Customer Identity and Access Management (CIAM)](https://auth0.com/blog/what-is-ciam/) solution require significant control over sensitive customer data and may require local data residency capabilities. They often have to make a hard choice of selecting either a CIAM solution that supports their product differentiation goals or one that meets their technical requirements and regulatory needs. Auth0’s modern identity platform eliminates the need to choose by providing organizations with tools designed to support security, compliance, and data residency needs that may apply to them across multiple regions globally. The platform’s design can accelerate their time to value and go-to-market strategies to meet their long-term growth goals. 

Key benefits of the Auth0 Identity Platform on Azure include:

* **Technology Stack Alignment:** Organizations have the flexibility to choose Azure as their preferred cloud vendor for greater technology stack alignment with existing investments in Azure. 
* **Data Residency:** Improved data residency capabilities for Auth0 customers with Azure’s widespread geographic infrastructure.
* **Streamlined Experience with Private Cloud:** A modern, cloud-native platform built with a focus on security and compliance at every level. Organizations requiring data residency options can take advantage of periodic feature updates while maintaining control over the timing and the ability to roll back without the hassle of having to maintain them — resulting in faster time to market and a more seamless experience for organizations and their customers.

“As more applications move to the cloud and expand globally, organizations depend on their identity service to protect and manage access for their most critical users, applications, and data,” said Shiv Ramji, Chief Product Officer at Auth0. “The Auth0 Identity Platform on Azure can help unlock a secure and compliant cloud deployment experience for organizations seeking support across CIAM use cases. This is especially true for organizations in industries like retail or financial services where selecting vendors that are not competitive to their business is top priority, organizations operating in regions where certain cloud providers have higher geographic availability, and those that have existing technology investments in Azure.”

“Companies like Auth0 add value by integrating their solutions with Microsoft Azure,” said Mandana Javaheri, Global Senior Director, SCI Business Development at Microsoft Corp. “With Azure, Auth0 customers have ultimate performance capabilities and control over their environment without the hassle of maintaining it, allowing customers to focus more on their core business proposition.”

More detailed information on the Auth0 Identity Platform on Azure can be found on [Auth0’s blog](https://auth0.com/blog/auth0-on-microsoft-azure-as-a-private-cloud-deployment-option). Auth0 will discuss this offering in greater detail with Okta at Showcase21 taking place today, Oct. 13, 2021. To learn more, visit: [https://www.okta.com/showcase/register](https://www.okta.com/showcase/register)  

<include src="asides/AboutAuth0" />
### Media Contacts:

Global Communications<br />
Auth0<br />
[press@auth0.com](mailto:press@auth0.com)<br />

Matter Communications for Auth0<br />
[auth0@matternow.com](mailto:auth0@matternow.com)<br />

### Investor Contact:
Investor Relations<br />
[investor@okta.com](mailto:investor@okta.com)<br />

"customer"