andrea-chiarelli

I have over 20 years of experience as a software engineer and technical author. Throughout my career, I've used several programming languages and technologies for the projects I was involved in, ranging from C# to JavaScript, ASP.NET to Node.js, Angular to React, SOAP to REST APIs, etc.

In the last few years, I've been focusing on simplifying the developer experience with Identity and related topics, especially in the .NET ecosystem.

Principal Developer Advocate

Andrea Chiarelli

Checking your customers' email addresses is a basic rule for securely onboarding them in your B2B SaaS application. Learn how to do it in your Blazor Web App.

The very first thing to do when a user signs up for your application is to verify that they actually have access to the email address they provide. Although email verification is not the only security measure you should take to ensure the user's identity, this contributes to reducing spam and fraud. Auth0 provides [a few approaches to email verification](https://auth0.com/docs/manage-users/user-accounts/verify-emails), depending on your specific use case. In this article, you will learn how to leverage the built-in email verification process based on verification links to validate the email address provided by the user during their signup for a Blazor Web application.

## The Sample Application

A previous article showed [how to manage the onboarding of a customer](https://auth0.com/blog/enable-self-subscription-in-blazor-b2b-saas-application/) who signs up for a service offered by a B2B SaaS application implemented with Blazor. On that occasion, we did not consider verifying the client's email address as we wanted to focus mainly on self-registration and creating an Organization via code. Now, we will integrate that application by adding the verification step for the self-registering customer's email address.

Download the sample project to start with this command:

```shell
git clone --branch organization-via-code --single-branch https://github.com/andychiare/MyBlazorSaaS
```

Follow the attached README file instructions to register and configure the application with Auth0. If you don't have an Auth0 account, [you can sign up for free](https://a0.to/blog_signup).

## The Email Verification Process

By default, Auth0 sends a verification link to users when they sign up, but it's up to you to check if their email is verified before allowing them to access your application or perform specific actions.

In the context of your Blazor application, you will implement the following email verification process:

1. Once the customer signs up, Auth0 automatically sends an email to the user, and your application shows a message inviting the user to check their inbox.
2. The page showing the message provides a button to resend a new verification link in case the user didn't receive the first email.
3. If the user attempts to access any other application page, your app checks if the user's email has been verified before granting access.
4. Once the email is verified, the customer can create the Organization for their new subscription.

## Wait for Email Verification

The current customer onboarding flow implemented in your Blazor App allows users to create their Organizations as soon as they sign up. From a visual perspective, they pass from the signup form to the Organization creation form. You need to make sure the customer's email has been verified before allowing them to create their new Organization. Let's start by implementing a page that fulfills points 1. and 2. mentioned earlier.

### The verification waiting page

In the `MyBlazorSaaS/Components/Pages/Onboarding` folder, create a new file named `Verify.razor` and add the following code:

```csharp


@page "/Onboarding/Verify"
@rendermode InteractiveServer
@using Auth0.ManagementApi.Models
@using System.Security.Claims

@inject NavigationManager NavigationManager
@inject IAuth0Management auth0Management

<h1>Verify your email</h1>

 Please check your inbox for a verification link to continue creating your account.


<div>
 <button class="btn btn-primary" @onclick="ResendVerificationEmail">Resend Verification</button>
</div>

<div>
@Message
</div>

@code {
 [CascadingParameter]
 private Task<AuthenticationState>? authenticationState { get; set; }
 private string Message = "";

 private async Task ResendVerificationEmail()
 {
 if (authenticationState is not null)
 {
 var state = await authenticationState;
 var userId = state?.User?.FindFirst(c => c.Type == ClaimTypes.NameIdentifier)?.Value;

 try {
 var managementClient = await auth0Management.getClient();
 await managementClient.Jobs.SendVerificationEmailAsync(new VerifyEmailJobRequest() { UserId = userId });
 Message = "The verification e-mail has successfully been sent. Please check your inbox";
 } catch (Exception) {
 Message = "Failed to resend verification e-mail.";
 } 
 } else {
 NavigationManager.NavigateTo("/Onboarding/Signup");
 }
 }
}
```

This page will display a message that invites the user to check their inbox and offers a button to resend the verification link if needed. It will be rendered as shown in the following image:

![Verify email screen in your Blazor Web app](https://images.ctfassets.net/23aumh6u8s0i/72gdEry0IJzomAqT4P95gF/a099d96c8531367d3c8b567ac3853081/blazor-verify-email-screen.png)

Since the current onboarding flow shows the Organization creation page after the user signup, you need to change it. Open the `Program.cs` file in the `MyBlazorSaaS` folder and replace the line of code shown below:

```csharp
// MyBlazorSaaS/Program.cs

//...existing code...

app.MapGet("/account/signup", async (HttpContext httpContext, string login_hint) =>
{
 var authenticationProperties = new LoginAuthenticationPropertiesBuilder()
 //.WithRedirectUri("/onboarding/createOrganization") // 👈 old code
 .WithRedirectUri("/onboarding/verify") // 👈 new code
 .WithParameter("screen_hint", "signup")
 .WithParameter("login_hint", login_hint)
 .Build();

 await httpContext.ChallengeAsync("OnboardingScheme", authenticationProperties);
});

//...existing code...
```

This ensures that the user will be redirected to the verification waiting page instead of the Organization creation page.

### Resend the verification link

The verification waiting page shows a "Resend Verification" button. Let's take a closer look at the code triggered by that button to learn how to resend the verification link:

```csharp

 
//...existing code...

@code {
 [CascadingParameter]
 private Task<AuthenticationState>? authenticationState { get; set; }
 private string Message = "";

 private async Task ResendVerificationEmail()
 {
 if (authenticationState is not null)
 {
 var state = await authenticationState;
 var userId = state?.User?.FindFirst(c => c.Type == ClaimTypes.NameIdentifier)?.Value;

 try {
 var managementClient = await auth0Management.getClient();
 await managementClient.Jobs.SendVerificationEmailAsync(new VerifyEmailJobRequest() { UserId = userId });
 Message = "The verification e-mail has successfully been sent. Please check your inbox";
 } catch (Exception) {
 Message = "Failed to resend verification e-mail.";
 } 
 } else {
 NavigationManager.NavigateTo("/Onboarding/Signup");
 }
 }
}
```

The `ResendVerificationEmail()` method gets the user ID from the authentication state, gets an instance of the management client, and uses the `SendVerificationEmailAsync()` method, passing an instance of `VerifyEmailJobRequest` with the user ID value. This method of the Management API client corresponds to calling [the email address verification endpoint](https://auth0.com/docs/api/management/v2/jobs/post-verification-email), which will generate a new ticket, include it in a verification link, and send it to the user via email.

## Customize the Email Verification Template

The default email message with the verification link sent to the user will look like the following:

![Email verification message](https://images.ctfassets.net/23aumh6u8s0i/6cP7skL9tqxBUnCAwC1cOa/0e31a5311fbd6506e75e010c091218a9/email-verification-message.png)

You can customize this message using your Auth0 dashboard. Go to the [Branding > Email Templates](https://manage.auth0.com/#/templates) page, select the *Verification Email (Link)* template, and apply the changes you want. You can customize the sender address, the subject, and the message body using [HTML and Liquid syntax](https://auth0.com/docs/customize/email/email-templates/use-liquid-syntax-in-email-templates). You can also customize other settings and use [common variables](https://auth0.com/docs/customize/email/email-templates#common-variables) to include some contextual values in your message. Read [this document](https://auth0.com/docs/customize/email/email-templates) to learn more about email template customization.

By default, nothing visible happens on your application when a user clicks the verification link. Auth0 will mark the user's email field as verified and show a page confirming that the email verification process was successful, as you can see in the following image:

![£mail address verified by Auth0](https://images.ctfassets.net/23aumh6u8s0i/4pgKFqZDlk93OnekyTrElS/1b3bf679d107f68279e8c4f711267836/email-address-verified.png)

However, in our self-subscription flow, we would like the user to be redirected to the next onboarding step after their email is verified, which is the organization creation screen. The email verification template provides a *Redirect To* field that allows you to specify the URL of the page you want the user to land after the email verification. You can parametrize the URL using one of the common variables mentioned above. Specifically, enter the following value in the *Redirect To* field and click the *Save* button:

```
{{ application.callback_domain }}/onboarding/createOrganization
```

That's all! Now, your user will be redirected to the Organization creation page after the email verification.

<include src="Auth0TemplatesForDotnetCTA" />

## Require Email Verification

One small piece is missing to complete the customer onboarding flow. You need to ensure that they cannot access the protected pages of your application if their email has not been verified yet. This means that when you check if the user is authenticated, you also need to consider checking that their email is verified too.

### A basic approach

You don't need to check if the user's email is verified when they access the `Home.razor` page, `Signup.razor`, and `Verify.razor` pages: the first two are public pages, and the third one is specifically designed for users who haven't verified their email yet.

You need to check the validity of the user's email on the `CreateOrganization.razor` page. To this purpose, apply the changes highlighted here on the `CreateOrganization.razor` page:

```csharp


//...existing code...

 protected override async Task OnInitializedAsync()
 {
 if (authenticationState is not null)
 {
 var state = await authenticationState;

 // 👇 new code
 var isEmailVerified = state.User?.FindFirst(c => c.Type == "email_verified")?.Value?.ToLowerInvariant() == "true";
 // ☝️ new code

 // 👇 changed code
 if (state.User?.Identity?.IsAuthenticated??false && isEmailVerified)
 // ☝️ changed code
 {
 Email = state.User?.FindFirst(c => c.Type == ClaimTypes.Email)?.Value??String.Empty;
 UserId = state.User?.FindFirst(c => c.Type == ClaimTypes.NameIdentifier)?.Value??String.Empty;
 } else {
 NavigationManager.NavigateTo("/Onboarding/Signup");
 }
 }
 }

//...existing code...
```

You can see that a new variable `isEmailVerified` has been introduced. This variable gets a boolean value coming from the value of the `email_verified` claim. You will use this variable as an additional condition to go ahead with the Organization creation step.

### A more structured approach

You need to apply the email verification check to most of the protected pages of your application. This depends on your application, of course. In our case, you should also apply the same check to the `Weather.razor` page on the server side and the `Counter.razor` and `FetchDat.razor` pages on the client side.

Applying the earlier approach would work, but it's ineffective in terms of code duplication and maintenance. You will use [ASP.NET Core policy-based authorization](https://learn.microsoft.com/en-us/aspnet/core/security/authorization/policies) instead.

First, open the `Program.cs` file in the `MyBlazorSaaS` folder and add the code highlighted below:

```csharp
// MyBlazorSaaS/Program.cs

//... existing code...

// 👇 new code
builder.Services
 .AddAuthorization(options => {
 options.AddPolicy("VerifiedEmail", policy =>
 policy.RequireAssertion(context =>
 context.User.HasClaim(claim =>
 ( claim.Type == "email_verified" &&
 claim.Value?.ToLowerInvariant() == "true")
 )
 )
 );
 });
// ☝️ new code

// Add services to the container.
builder.Services.AddRazorComponents()
 .AddInteractiveServerComponents()
 .AddInteractiveWebAssemblyComponents()
 .AddAuthenticationStateSerialization();

//... existing code...
```

This code defines an authorization policy named `"VerifiedEmail"`. This policy checks if the current user has a claim `email_verified` set to `true`. This is the [standard claim](https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims) coming from the ID token issued by Auth0.

Now, let's create a page to which the user will be redirected when attempting to access a page without the required authorization. By default, Blazor redirects unauthorized users to an `Account/AccessDenied` page. So, create an `Account` folder in the `MyBlazorSaaS/Components/Pages` folder and add an `AccessDenied.razor` page with the following code:

```csharp

 
@page "/account/accessdenied"

<PageTitle>Access Denied</PageTitle>

<h2>You are not authorized to access this page</h2>

@Reason

@code {
 [CascadingParameter]
 private Task<AuthenticationState>? authenticationState { get; set; }
 private string Reason = "";

 protected override async Task OnInitializedAsync()
 {
 if (authenticationState is not null)
 {
 var state = await authenticationState;

 var isEmailVerified = state.User?.FindFirst(c => c.Type == "email_verified")?.Value?.ToLowerInvariant() == "true";

 if (state.User?.Identity?.IsAuthenticated??false && isEmailVerified)
 {
 Reason = "Your email is not verified yet!";
 }
 }
 }
}
```

This page shows a generic message to the unauthorized user and attempts to show a specific message about the actual reason. In particular, it checks if the user has the `email_verified` claim set to `true` and displays a message accordingly.

Finally, specify the policy `VerifiedEmail` in the `Authorize` attribute of your protected pages as shown below:

```csharp

 
@page "/weather"
// 👇 changed code
@attribute [Authorize(Policy = "VerifiedEmail")]
// ☝️ changed code
@attribute [StreamRendering]

//...existing code...
```

Apply this change to the `Counter.razor` and `FetchData.razor` pages in the `MyBlazorSaaS.Client/Pages` folder as well.

That's all! Your customer onboarding flow now includes the email verification step to mitigate the risks of spam and fraud.

<include src="SignupCTA" text="Try out Auth0 authentication for free." linkText="Get started →" />

## Recap

Auth0 always sends an email verification message when a user signs up for your application. However, it's up to you to determine in which scenario to check whether the user's email has been verified.

In the example shown in this article, we took the case of onboarding a customer of a B2B SaaS application developed with Blazor and added the email verification step before allowing them to create a new Organization.

We also saw how to allow the resend of the verification email and prevent access to the application's protected pages when the user's email has not been verified yet.

You can find the final code of the project created during the article on [this GitHub repository](https://github.com/andychiare/MyBlazorSaaS/tree/email-verification).

Enforce Customer Email Verification in Your B2B Blazor Web App

Aliyah Winfrey

I'm Aliyah Winfrey, a staff design researcher who’s passionate about creating clarity and alignment in complex research spaces. I thrive on asking the right questions and uncovering insights that drive meaningful design. Outside work, I tend to my garden, experiment with new baking recipes, or get lost in a classic PS2 game.

Staff Design Researcher

Brandon Simons

Brandon Simons is a Principal Product Manager at Auth0, where he has spent over three years dedicated to empowering customers to build great login experiences. His focus is on providing the right balance between ease of development and maintenance, while ensuring a delightful end user journey. Prior to his role at Auth0, Brandon spent over a decade working in SaaS at companies large and small.

Principal Product Manager

The benefits of leveraging social connections for your customers

Social Login has become a login method across [numerous regions, ages, and community types](https://auth0.com/blog/digital-identity-what-users-think-about-devices-and-logins/). Globally, we are connected through social media, and leveraging social login allows us to fortify those connections through a seamless and secure login. However, many everyday people don’t understand [how social login or social connections work](https://auth0.com/blog/analysis-of-social-connection-data/) or, more importantly, if [social login is a safe way](https://auth0.com/blog/social-login-on-the-rise/) to log in or sign up. 

Social login uses existing social media accounts, such as Google, Facebook, X (Formerly Twitter), Apple, and Microsoft, to sign in or go up for websites. It reduces the cognitive load of users remembering another username and password or, worse… _reusing a password_ 😱 over 70% of general users do. Over thousands of our customers have integrated Social Login in their authentication flow. Social login offers the following.

1. Frictionless and rapid method for users to sign up/log in via a 1-click solution
2. Implementing social login significantly increases the conversion rate.<a href="https://auth0.com/blog/how-to-use-social-login-to-drive-your-apps-growth/#Increase-Your-Sign-Up-Conversion-Rate-by-20-">1 </a><a href="https://www.marketone.com/articles/maximizing-conversion-rates-with-social-sign-in">2</a>
3. Security of social login 

However, internal research of general population users cited the sentiment that social login is the most vulnerable identifier to cyberattacks.

![Social login](https://images.ctfassets.net/23aumh6u8s0i/13wdcxqs5xSsqyzL1bkQjx/2dad6f825cb64537ce2ae1dd1d4884c5/Social_Login.png)

Given this sentiment, let’s break down three common myths about Social Login among general users and share some key points to keep in mind when using it in your applications.

## The Myths of Social Login

> **Myth #1**: Logging in via my social account (Facebook, Google, or Microsoft) gives away the data in my social account.

Social account hacking is a huge and serious concern for everyday users. However, many social login services such as Google, Facebook, Apple, and Microsoft do not grant full access to your account and share only what’s necessary, such as name and email. Social Login providers share limited information with the application or website users are logging in to. Social login minimizes the data you store when signing up for accounts. The less data you store, _the better_.

This means they are not sharing your data on your social login account. Social login only grants authentication rights to create or log into an account. Additionally, many social login providers allow users to review, control, and revoke access to their account settings, meaning users must grant permission to access _any_ account data. Social login does not give the application or service users a sign-up for access to data such as private messages, browsing history, or other sensitive information.

> **Myth #2**: Social login is less secure than a password.*

Social login is often more secure than using a password for a few reasons. Traditional login methods, such as passwords, are prone to reuse and have general weaknesses, such as hackers guessing simple passwords. Social login reduces the risk by offering a passwordless way to authenticate. Moreover, users' risk of credential theft and phishing is diminished, given they are not creating and storing credentials to log in to third-party sites and services. Social Login often provides built-in Multi-Factor Authentication (MFA) as an added layer of security in comparison to relying on a password, which may or may not offer MFA.

Social login utilizes big companies like Google, Microsoft, and Apple's investment in keeping users’ accounts safe with a team of security experts working 24/7. These companies monitor accounts for unusual and suspicious activity, unauthorized access, and hackers. \

> **Myth #3**: Social Login isn’t safe cause it’s too easy.*

It’s really that simple. Ease of access ≠ lacks security. Social Login simplifies authenticating users as who they say they are while leveraging leading security measures. In other words, it’s simple authentication that does not sacrifice security. Remembering a password is more challenging and less secure. Weak or reused passwords pose a greater risk to personal data and security.

## Let’s Enable Our Users and Build Trust

Building trust with users is about more than just convenience. It requires a strong commitment to security, clear communication, and giving users the tools to protect themselves. Social login makes signing in easier while keeping accounts secure, but users should take extra steps to stay safe. Enabling MFA, reviewing permissions in Google, Microsoft, or Apple account centers, and staying aware of account activity all help strengthen security. When an organization provides these options and offerings, such as Auth0, allow for seamless integration, users take advantage of them, and online interactions become both safer and simpler.

Ready to rethink social login? Start implementing it in your apps, and learn more [here](https://auth0.com/learn/social-login)! Or [review some of our social login Labs](https://developer.auth0.com/resources/labs?topic=authentication)”

Demystifying Social Login

samantha-murphy

Samantha Murphy is a Principal Product Marketing Manager for Okta. She leads the Customer Identity Security portfolio, driving go-to-market strategy, messaging, launches, and strategic growth initiatives. Before Okta, Sam spent over six years in product management roles in Identity and Access Management.

She holds a Bachelor of Commerce degree from Queen’s Smith School of Business and is from Ottawa, Canada.

In her free time, Sam makes the most of winter by playing an awesome ice skating sport called ringette.

Principal Product Marketing Manager, Customer Identity

Samantha Murphy

Find out how you can improve your customers' security and authentication experience using CIBA.

Imagine you're a customer trying to resolve an urgent issue over the phone—for example, a bank transaction, an online order, or a technical support request. Before the agent can help, they need to verify your identity. They ask you for your security passcode, which you’ve forgotten. Then come the security questions: your birthday, your last bank transaction, your best friend's name. These questions are easily compromised and create security concerns.

This frustrating experience is all too common across industries. From financial services to retail, organizations face the challenge of verifying customers securely and efficiently for online, over-the-phone, and in-person interactions. That's where CIBA comes in.

In this blog post, we’ll explore how our new [**Client-Initiated Backchannel Authentication (CIBA**](https://auth0.com/docs/get-started/authentication-and-authorization-flow/client-initiated-backchannel-authentication-flow/user-authentication-with-ciba)**)** feature, part of Auth0, improves customer authentication for call centers and in-person interactions. CIBA makes authentication faster, more secure, and eliminates the need for outdated PINs or security questions.

## Moving Beyond Less Secure Security Questions and OTPs

Call centers are just one out-of-band scenario currently burdened with inconvenient and insecure authentication protocols. Say you’re trying to verify your Identity so you can personalize the settings in your new car, but in order to do so you need to go through a cumbersome process: open the car’s app, scan a QR code, open a browser and log in –all before you can update your personal settings. Or maybe you’re trying to pick up a retail order in person, but in order to do so, you need to authenticate yourself with security questions or personal information. The problem is that these questions are vulnerable to data breaches and phishing attacks (just like passwords) and revealing private information directly to agents creates obvious privacy concerns that customers shouldn’t have to deal with.

Some organizations may try to get around this by using SMS or emailing one-time passwords (OTPs). However, these methods often introduce an additional, cumbersome step into the authentication process and present security challenges. SMS for example is vulnerable to SIM Swapping, which allows attackers to intercept SMS OTPs. Email OTP assumes that the email account is secure, which may not be the case. Plus, both email and SMS OTPs are vulnerable to the typical phishing and social engineering attacks that trick people into compromising their OTP, and they lack biometric authentication methods (e.g. face ID, fingerprint, etc.).

CIBA offers a more consumer-friendly and secure way of authenticating “out-of-band” customers.

## CIBA: A Superior Approach to Out-of-Band Authentication

Safe, seamless brand experiences go beyond the login box. They extend to critical customer touchpoints—like when customers seek support over the phone, online, or in person. CIBA empowers businesses to deliver **both enhanced security and a smoother user experience**, leading to stronger customer satisfaction and better business outcomes. Let’s unpack what CIBA is and how it drives business success:

**Client Initiated Backchannel Authentication (CIBA)**—also known as a **decoupled authentication flow**—is a protocol that enables a client application (e.g., call center systems, POS terminals, in-person service tools, or autonomous AI Agents) to initiate the authentication process on behalf of the customer.

Let’s walk through an example workflow.

A user would like to withdraw from their bank and agrees to initiate the CIBA mobile app verification process.

![Initiate the CIBA verification process](https://images.ctfassets.net/23aumh6u8s0i/4Z2y3Etq6z8cYdxMHwEHDJ/636c00a03bb28fc64e73e1daebff455d/Uploaded_from_Okta_CIBA_blog_v1)

Right away, the user gets a notification on their phone to approve the request and authenticates with biometrics through the app.

![CIBA flow: the user gets a notification on your device](https://images.ctfassets.net/23aumh6u8s0i/3F7yYxI2qaHLys12sLQcuB/dcb6b0227f0388a95f369023b95f69f3/Uploaded_from_Okta_CIBA_blog_v1)

Lastly, the user approves the request and seamlessly and securely continues their withdrawal.

![CIBA flow: User approves the authentication request](https://images.ctfassets.net/23aumh6u8s0i/QOu1PqIN7gV6Bn5Mars8Q/bd13772e469354c82bfb62a0c780c77a/Uploaded_from_Okta_CIBA_blog_v1)

## Achieving Better Business with CIBA

CIBA improves your business and your customer experience with some great features:

### Stronger Security and Privacy

Traditional out-of-band authentication methods, like security questions or email/SMS one-time passwords (OTPs), are insecure and frustrating. CIBA replaces these outdated approaches with **secure, seamless in-app biometric authentication** (e.g., Face ID or fingerprint). A simple push notification lets customers verify their identity effortlessly with **just one tap**, without sharing sensitive personal information.

### A Financial-Grade Protocol

Trusted by financial institutions, CIBA is a **financial-grade protocol** that provides stronger safeguards against phishing and data breaches. By securing highly sensitive customer interactions, CIBA acts as a **robust fraud prevention tool**, protecting both businesses and customers from scams and breaches.

### Non-Repudiation for Trust

A CIBA authentication flow with the [Guardian mobile SDK](https://auth0.com/docs/secure/multi-factor-authentication/auth0-guardian) supports **non-repudiation**—so that neither party in a communication can deny their involvement. For example, in a call center scenario, this prevents customers or agents from disputing that certain information was exchanged. Non-repudiation builds trust and ensures authenticity for sensitive interactions.

### Enhanced Customer Experience (CX)

CIBA delivers smoother CX with **one-tap in-app authentication** —no browser redirects. This simple, efficient flow reduces abandonment rates, increases app engagement, and empowers customer-facing teams to drive satisfaction and business growth.

With [**Auth0 Guardian SDK**](https://auth0.com/docs/secure/multi-factor-authentication/auth0-guardian), you can further enhance CX by customizing every aspect of the CIBA customer journey to reflect your brand and meet unique business needs—creating an experience that’s as secure as it is smooth.

## CIBA in Action: Real-World Examples

A decoupled authentication flow leveraging CIBA adds a much-needed security boost to sensitive interactions, all while supporting seamless customer experiences across a number of different scenarios and use cases:

*   **Call center verification**.
Say you’re a financial services institution, and a customer is calling in to request help with their bank account. Using CIBA, the bank teller can authenticate the customer by sending a push notification to the banking app your customer has installed on their phone. There, they can confirm their identity using the already-enabled biometric sign-in. No more asking customers to share SMS passcodes or make their social security numbers, and (forgotten!) answers to security questions vulnerable by speaking them out loud.

*   **In-person verification**.
In all kinds of in-person scenarios (e.g., withdrawing money at a bank, checking into a hospital, picking up meds at the pharmacy) CIBA gives employees the option of confirming customers’ Identity in real-time by initiating a push notification sent immediately to their phone. The alternative in these situations is often asking customers to present physical documentation such as utility bills or their driver's licenses––an insecure authentication method that can leave customers vulnerable to fraud if they are stolen or compromised.

*   **Connected device verification**.
CIBA also allows internet-connected devices to initiate push notifications in IoT scenarios. For example, if a customer is registering a new car and customizing their settings, CIBA lets them kick off this process in an easy, authenticated manner by confirming their Identity through a push sent directly to a consumer app. Not only is this a more secure means of authentication, it also allows customers to avoid clunky options currently on the market, e.g., scanning a QR code that redirects to the app.

*   **POS terminal**.
In a retail environment that increasingly favors hybrid shopping experiences (e.g. ordering furniture online and picking it up in person) a CIBA flow allows customers to confirm their Identity on-site through self-serve kiosks that initiate a push notification sent to the customer’s phone. This not only keeps the transaction secure, but it also eases any labor constraints retailers might be experiencing by preventing employees from getting roped into the authentication process.

**Better security. Better CX. Better business.**.
CIBA represents a new addition to the security toolbelt for organizations looking for a more secure, more seamless way of authenticating users in call center scenarios and beyond.

Curious about where CIBA can improve your operations––and your bottom line? [Schedule a demo with your account rep](https://auth0.com/contact-us) to see it in action.

CIBA: Authenticate Customers in Call Centers and Other Out-of-Band Scenarios

eric wu

With over 7 years of experience in product marketing, I am passionate about creating and delivering impactful marketing strategies that drive customer value, business growth, and competitive differentiation. I have a strong background in launching new products, especially in Security, Generative AI and Cloud domains, where I have led several successful end-to-end product releases. I currently work as a Senior Product Marketing Manager at Okta, a leading identity and access management platform that empowers organizations to securely connect their people and technology.

Product Marketing Manager - Customer Identity Cloud

Eric Wu

Self-Service Single Sign-On (SSO) reaches General Availability (GA) status

As Independent Software Vendors (ISVs) quickly learn, in addition to building the core functionality of your software-as-a-service (SaaS) apps, you must also provide features that support your business customers’ administration, integration, and security needs.

One of the most challenging features to implement is Single Sign-On (SSO) due to the many competing standards and protocols available. Plus, merely supporting SSO is only one piece of the puzzle — it also has to get deployed:

* **From the perspective of each of your business customers**, setting up SSO for each and every app they’ve adopted can be a tedious process, often involving lots of back and forth with your customer service reps — and perhaps even your developers
* **For you as an ISV**, helping each and every business customer set up SSO for your app is just as tedious and time-consuming

Both parties benefit from a quick and simple deployment approach, which is why we’re excited to announce that our Self-Service SSO feature has reached General Availability (GA) status.

## SSO Is an Enterprise Imperative

Due to its associated benefits, Single Sign-On (SSO) — an Identity solution that allows multiple applications to use the same authenticated session — is an essential element of modern Identity and Access Management (IAM). SSO is so important, in fact, that it’s a foundational element of [the emerging Interoperability Profile for Secure Identity in the Enterprise (IPSIE) security standard](https://www.okta.com/blog/2024/10/oktane-2024-the-future-of-identity-security/).

On top of providing a convenient user experience, SSO dramatically reduces the number of credentials in use and helps to ensure that security policies are consistently applied across all of an organization’s applications, since the policies can be enforced at an organization’s Identity Provider (IdP).

Now that Identity has emerged as the primary enterprise security entry point, and with [organizations deploying more apps than ever before](https://www.okta.com/businesses-at-work/), SSO is needed more than ever.

### Simplifying SSO configuration saves time, reduces errors, and manages information risk

Self-service SSO refers to a flow that allows your business customers to set up and edit SSO connections themselves.

This capability delivers several valuable benefits, including:

* **Saving time for everyone:** Building Identity solutions isn’t your core business, and any time spent doing so pulls your team from product extension and innovation. With Self-Service SSO, your developers can focus more on your product instead of SSO integrations.
* **Reducing the potential for errors:** Manually configuring SSO introduces the risk of errors that impede productivity and undermine security. Self-Service SSO keeps manual tasks to a bare minimum.
* **Eliminating the need to share sensitive information:** Configuring SSO often requires the ISV and the business customer to share sensitive information (e.g., client IDs, SAML certificates, etc.), but Self-Service SSO eliminates these exchanges.

## How Self-Service SSO Works

Self-Service SSO requires minimal configuration in your Auth0 tenant and provides your customers with a setup assistant that guides them through the enablement process. After a customer completes their setup, the SSO integration is automatically added to your tenant as an [Enterprise connection](https://auth0.com/docs/authenticate/enterprise-connections).

Diving a little more deeply, Self-Service SSO uses three components to delegate setup to your customers:

* **Self-Service profile:** Defines key elements of customer SSO implementations, such as the IdPs they can use for SSO and which user attributes they must capture (e.g., email address)
* **Self-Service access ticket:** Grants customer admins access to the SSO setup assistant and sets specific details for their resulting SSO integration
* **SSO setup assistant:** A Self-Service Wizard that guides customer admins through the SSO setup process — enabling your business customers’ administrators to create, edit, and test SSO connections

You also benefit from additional **observability** features, including new tenant logs to monitor ticket consumption and the creation and enablement of connections; you can monitor logs to promptly initiate any tasks once the connection has been created.

At a high level, the Self-Service SSO workflow includes the following tasks:

1. You (the Auth0 by Okta customer) create a self-service profile in your tenant using the Auth0 Dashboard or the Management API.
2. Next, you use the Management API to create a self-service access ticket that allows customer admins to configure SSO.
3. You retrieve the ticket URL from the asset created in Step 2 and send this link to your customer admin.
4. Your customer admin launches the SSO setup assistant and follows the steps provided to create an application with their identity provider.
5. After the customer completes their setup, the SSO integration is automatically added to your tenant as an [Enterprise connection](https://auth0.com/docs/authenticate/enterprise-connections).

<include src="Vidyard" id="UPTUao1LfxdMLrnD38Gsxc" />

## Getting Started

As enterprises continue to adopt best-of-breed tools, IT and security leaders will increase their focus on access management strategies, like SSO, that can simultaneously support productivity and contribute to a strong security posture.

Whether you include SSO within your base product or offer it as a premium add-on, Self-Service SSO enhances your overall value proposition.

By empowering your customers to configure their own SSO integrations with your app, you can streamline your onboarding process and grant them more autonomy over their sign-on experience — while reducing the time and costs associated with managing SSO across your customer base.

**If you’d like to learn more about this new feature**, we invite you to peruse [the Self-Service Single Sign-On documentation](https://auth0.com/docs/authenticate/enterprise-connections/self-service-SSO).

**Want to launch a B2B SaaS application quickly?** Check out our reference application, [SaaStart,](https://auth0.com/blog/speed-up-your-customer-identity-journey-with-auth0-saastart/), a complete, working example of how to implement SaaS Identity with Auth0, built with the most popular frameworks developers use today. You can gain hands-on experience on Self-Service SSO and other essential CIAM features and quickly deploy a sample Auth0 template directly within the SaaStart [repo](https://github.com/auth0-developer-hub/auth0-b2b-saas-starter) or from [our new integration](https://vercel.com/integrations/auth0) in the Vercel marketplace.

Empower Your Enterprise Customers to Set up Their Own SSO Implementations

Nelson Matias

As a Group Product Manager at Auth0, I focus on delivering innovative solutions that enhance security and user experience for both businesses and developers. With hands-on experience as a Developer, Consultant, and Solution Architect, along with years of working in Technical Account Management, I’m passionate about solving complex problems and shaping the future of identity management.
Outside of work, I often watch football, listen to music, or spend quality time with my kids.

Group Product Manager

Continuous Session Protection empowers customers to meet a wide range of session and refresh token security needs, including custom lifetimes and revocation capabilities. Let’s dive deeper into how these features can enhance your security strategy.

Continuous Session Protection Now Available for Enterprise Customers

auth0_by_okta_hero copy

Auth0 Team

Offering expanded access and optionality for self-service plans and features

**TLDR**: 
Self-service customers have access to Auth0 capabilities that previously required a call with sales. Effective immediately: (1) customers can now upgrade to our B2B Professional Plan directly through the dashboard, (2) the Enterprise Connection limit in the B2B Pro plan has been increased from 3 to 5, and (3) Pro plans customers can now add a single Enterprise MFA factor (called 'Enterprise MFA Lite') via self-service.

In November 2023, we introduced [updated self-service plans and pricing](https://auth0.com/blog/upcoming-pricing-changes-for-the-customer-identity-cloud/) to scale with our customers. As a continuation of this work and based on your feedback, we now offer self-service customers easier access to plans and capabilities that previously required a discussion with sales.

### Here’s what’s new, effective May 2024:

* You can now choose our [B2B Professional Plan](https://auth0.com/pricing) using your dashboard! The B2B Pro Plan includes: 
 * 5,000 M2M Authentications (more available as add-ons)
 * M2M Add-on
 * External Database
 * Cross App SSO
 * 5 Enterprise Connections (increased from 3)
 * 100 organizations
 * And other features included in the B2B Essentials plan.

 _To upgrade: [Dashboard > Settings (Subscription Tab)](https://manage.auth0.com/#/tenant/billing/subscription) > Select Plan & Quota > Click Upgrade or you can continue to purchase this plan through our Sales team._

* **5 Enterprise Connections** for the B2B Professional Plan's Enterprise Connection limits have increased from 3 connections to 5 connections via self-service. This will allow more of our SaaS customers to scale more effectively. As a reminder, there is no limit on [Okta Enterprise Connections](https://auth0.com/docs/authenticate/identity-providers/enterprise-identity-providers/okta) for customers on all of our B2B plans.
* **Enterprise MFA Lite** is now available through self-service for both B2C and B2B Professional. This capability was only available via a contract with Sales, but it can now be added via the dashboard.
 * Enterprise MFA Lite allows you to add either SMS, push, or voice notifications to Professional plans for an additional fee. Fees vary by the amount of MAUs; find more information on [Dashboard > Settings (Subscription Tab.)](https://manage.auth0.com/#/tenant/billing/subscription)
 * This includes the support of push, [SMS, and voice notifications](https://auth0.com/docs/secure/multi-factor-authentication/multi-factor-authentication-factors/configure-sms-voice-notifications-mfa), (SMS charges for MFA are charged separately by carriers supported by Auth0). Under Enterprise MFA Lite, subscriptions will be limited to one MFA factor on the subscription. 

### MFA Offerings Explained

MFA ([Multi-Factor Authentication](https://auth0.com/blog/multifactor-authentication-mfa/)) provides a method to verify a user's identity by requiring them to provide more than one piece of identifying information. For example, **something you know**: a password, PIN, or security question, **something you have**: a smartphone, security token, or smart card, or **something you are**: your fingerprint, face scan, or voice pattern.

Some of our MFA offerings include: 

* **Pro MFA** &mdash; included in B2C Professional, B2B Essentials, B2B Professional, and Enterprise plans 
* **Enterprise MFA Lite Add-on** &mdash; an add-on for B2B and B2C Professional plans and Enterprise plans
* **Enterprise MFA** &mdash; included in our Enterprise Plans 

![Pro Plan Improvements for Self-Service Customers - May 2024](https://images.ctfassets.net/23aumh6u8s0i/sTrHbEBf42kTVlbfp6mRt/2459de4604259c2031a9808dd2111efa/MFA_Table.png)

<div class="alert alert-info alert-icon">
 
 Please note that upgrading to B2B Professional and adding Enterprise MFA Lite to B2B and B2C Professional plans will incur additional fees. Visit our <a href="https://auth0.com/pricing">pricing page</a> for more information. 
</div>

### Which MFA factor(s) are best for my product?

Choosing the right [MFA factor](https://auth0.com/docs/secure/multi-factor-authentication#mfa-factors) is all about striking a balance between security and user experience. Consider the sensitivity of the accounts you're protecting, the technical comfort level of your users, and the accessibility of the MFA factor across different devices. 

![Not All MFA is Created Equal](https://images.ctfassets.net/23aumh6u8s0i/5TgjqFrUJwTDkldGCqov7o/6d80ca9d9c0d29faebea01578a02e0b6/Not_All_MFA_is_Created_Equal.png "Not All MFA is Created Equal")
From blog post: <a href="https://auth0.com/blog/not-all-mfa-is-created-equal/">Not All MFA is Created Equal</a>


To help evaluate our MFA offerings, visit this [blog post](https://auth0.com/blog/not-all-mfa-is-created-equal/) to learn about your options and for more details on factor types and authentication assurance levels, check out [this datasheet](https://www.okta.com/resources/datasheet-factor-assurance/).

### Have more questions about your plan or our MFA offerings?

We’re here to help! If you’re on a paid plan, our [Support team](https://support.auth0.com/) can help, and if you’re on a free plan, you can post in our [Community forum](https://community.auth0.com/). Thanks for being a valued customer. We hope this allows for more flexibility and optionality during your auth journey. Happy authenticating!

Pro Plan Improvements for Self-Service Customers - May 2024

Shreya Gupta

Shreya is the Developer Advocate for Auth0 for Startups. She previously founded a non-profit called Bit Project, worked at a YC-backed Startup as a Developer Advocate, and currently hosts The Developer Diaries podcast. Through each experience, she has found her love for building resources and tools that help move the needle for developers. Outside of work, she enjoys traveling, watching K-Dramas, and drinking boba.

Developer Advocate, Startups

Calah Vargas

Calah Vargas is the Associate Manager of Product Led Growth, focusing on nonprofits, startups, and partnerships. She works on product marketing and customer marketing initiatives. Outside work, you can find her cooking, trying new restaurants, and traveling with friends and family.

Associate Manager, PLG

Before you start working with AI developer tools, understand what it could mean for you, your product, and your customers.

<div class="alert alert-info alert-icon">
 
 Note: 
 This blog post is based on interviews conducted with startup founders, engineering managers, data scientists, and risk analysts in the Artificial Intelligence and Machine Learning space. 
</div>

Evaluating tools that can help optimize your development processes? Maybe you’re entirely building alongside [Devin, the first AI software engineer](https://www.cognition-labs.com/introducing-devin) to get your app to market faster, generating code snippets for your React app with [V0.dev](https://vercel.com/blog/announcing-v0-generative-ui), or using [GitHub CoPilot](https://thehackernews.com/2024/03/github-launches-ai-powered-autofix-tool.html) to help patch your website’s security flaws.

While productivity and efficiency are hallmarks of development success, security and privacy are just as paramount to protect your product and maintain customer trust. According to [Snyk’s 2023 AI Code Security report](https://snyk.io/reports/ai-code-security/), **80% of developers are bypassing security policies to use AI**.

But modern-day [Generative AI](https://news.mit.edu/2023/explained-generative-ai-1109) tools don’t typically have the built-in capability to determine whether the data it is exposed to is sensitive. It’s completely up to the user to take precautions and set up the proper protocols when choosing to use one of these tools. Let’s explore the potential risks of using AI tools in the dev process and what questions you could ask yourself to help make more informed decisions – for you, your product, and your customers.

## Productivity vs. Risk

According to Snyk’s blog, [How to Embed Security in AI-assisted software development](https://snyk.io/blog/snyk-and-atlassian-embed-security-ai-assisted-software-development/), “Code generation, using generative AI… is the area that stands to offer the greatest productivity benefits — **and the highest potential for introducing risk**.“

AI tools can help accelerate the process of taking an idea and building an MVP with limited resources. Although engineering productivity cannot be tracked by a single metric for all, it’s easy to see how these tools are already helping developers reduce time spent in generating code and improving the quality of code.

Like with all third-party tools, to strike the perfect balance between productivity and risk, it’s important to recognize ways in which these tools can hurt your product and customer security, now and in the future. In many situations, risk cannot be quantified, but companies can have an increased or decreased risk factor (risk tolerance) depending on:

* Industry
* Product type and use case
* Company stage

For example, risk tolerance can be higher for startups in growth mode, especially in industries outside of security.

## Risk Prevention Strategies

Let’s explore the most common risks associated with AI tools and mitigation strategies outlined by some engineers. 

Nonprofit OWASP (The Open Worldwide Application Security Project) documented a [list of potential security risks](https://owasp.org/www-project-top-10-for-large-language-model-applications/) when deploying and managing Large Language Models (LLMs) – some examples include:

* Sensitive Information Disclosure (LLM06) - LLMs can inadvertently disclose sensitive, proprietary, or confidential information leading to privacy breaches, intellectual property theft, and unauthorized access
* Prompt Injection (LLM01) - Attackers can manipulate LLMs through crafted inputs, causing the LLMs to execute the attacker’s intentions
* Overreliance (LLM09) - Systems or people overly dependent on LLMs without oversight may face misinformation, miscommunication, legal issues, and security vulnerabilities due to incorrect or inappropriate content generated by LLMs

When adding these tools to your tech stack, do these questions come to mind?

* How are you deciding which tools to use to increase your efficiency and productivity? 
* Do you have an internal vetting process for third-party vendors? How are you updating this for AI tools?
* Will you be prompting the AI tools with customer data and PII or proprietary restricted information? Are you in line with your applicable regulatory compliance frameworks? (GDPR, etc.)
* Does this tool abide by your corporate guidance?
* Do you have customer permission to use their data in this way?
* How could these tools impact you?
* What risks will you, your product, and your customers face?
* What guidance or guardrails does the tool have to protect your data as a user? Two popular types of AI developer tools are those for engineering productivity and those for general use, and the available configurations may vary.

We interviewed a few engineers (anonymously) about what they’re doing to minimize the risks associated with AI developer tools. Here’s a breakdown of some of the most common concerns and questions engineers are asking to reduce any harmful and inadvertent impact while coding with Gen AI tools.

* PI and copyright concerns
 * Once one of these tools generates code, who is the owner?
 * What happens if the tool is suggesting the same code to another customer, maybe even a competitor?
 * If you use AI tools in order to create a customer-facing chatbot, and a customer includes PII in their prompt – who is in charge of monitoring and removing this data and ensuring it isn’t being used to re-train models?
* Overreliance
 * Generating a few lines of code vs a few files of code – how familiar are you with the code in your product, and how much do you trust it?
 * Are you aware of the potential risk of [AI hallucinations](https://www.ibm.com/topics/ai-hallucinations) and how are you reducing it?
 * AI hallucinations are outputs from models that are nonsensical or inaccurate. For example:
 Question: where can I find the help center?
 Context: you’re looking for a website like [domain].com/help or support.[domain].com
 AI answer: the help center is located on the ground floor of this building.
* How are you updating your code and content review processes to deal with Gen AI?
* Data Exposure
 * Can you make sure your own data won't be used to answer prompts for competitors or malicious actors?
 * What are practical and technical strategies you can take to prevent data exposure?
 * Do you have strict policies and training for engineers when they are using these tools, or are you exploring third-party tools that tackle data leak prevention?

There’s no specific path to being completely secure from the risk of AI tools today, but there are many different strategies you can take to build strong guardrails to protect code and mitigate risk. Ensuring restrictions are very specific when engineers are using AI tools like Devin and code review is a must.

## AI Developer Tools Now and Tomorrow

AI tools for developer productivity are becoming increasingly popular. Further down the line, a startup founder might be able to ideate, possibly write [pseudocode](https://builtin.com/data-science/pseudocode), and use these tools to bring their idea to life. They might be able to start testing in a matter of minutes, not months.

If you’re an early-stage company, you might be eager to get started and may not have as much internal guidance as a large corporation. We hope this blog helps you start to outline the potential risks and considerations when evaluating AI tools for developer productivity. 

[Auth0 for Startups](https://auth0.com/startups) is empowering early-stage startups – tell us what we can do to best support you and your team!

_These materials and any recommendations within are not legal, privacy, security, compliance, or business advice. These materials are intended for general informational purposes only and may not reflect the most current security, privacy, and legal developments or all relevant issues. You are responsible for obtaining legal, security, privacy, compliance, or business advice from your own lawyer or other professional advisor and should not rely on the recommendations herein. Okta is not liable to you for any loss or damages that may result from your implementation of any recommendations in these materials. Okta makes no representations, warranties, or other assurances regarding the content of these materials. Information regarding Okta's contractual assurances to its customers can be found at [okta.com/agreements](http://okta.com/agreements)._

Security Considerations in the Time of AI Engineering

michael-swanson

I live in Austin, TX with my wife, Anneke, and our two kiddos, Ilya (5) and Everett (2). I am a native Texan but lived in multiple places across the southern US as a kid. I have family in Houston TX and Midland TX that we visit on a regular basis. Prior to joining Okta, I worked with early stage startups as a hands-on Product Manager, team lead, and product designer, while also writing (mostly frontend) code. 
 

When I am not working you can usually find me chasing my kids around, reading sci-fi or fantasy novels, or playing needlessly complex strategy board games with friends. I am also a huge Star Wars fan and am always down to talk about the latest Star Wars movies, TV, and/or books. Additionally, Anneke and I love to travel and have been all over the world together. Much of our travel focuses on getting out of the Texas heat, tasting and learning about wine, and sampling the amazing food we find along the way!

Senior Product Manager

Michael Swanson

Customers and trial customers on Enterprise and Professional plans can now customize signup and login flows to address unique needs.

Each company has unique user registration and login requirements, for example, needing to capture a first and last name during signup or requiring users to agree to terms and conditions before they can create an account. 

In order to meet specific business needs and use cases, companies often have to build and maintain different experiences – hosted pages and sites – within their account registration and login flow(s). Unfortunately, this approach slows down the time to market by introducing separate code bases that require localization and maintenance while also creating an inconsistent customer experience.

To solve this problem, we have introduced custom prompts for signing up and logging in to Universal Login. This capability is now open for early access (EA) and available to our customers and trial customers on Enterprise and Professional plans. 

## Addressing Unique Use Cases

With custom prompts for signup and login, our customers can customize and add new fields to existing signup and login prompts; this includes client and server-side validation to ensure that required data and requirements, such as Terms of Service (TOS) acceptance, are completed and validated before completing the signup or login process. 

Leveraging Universal Login and our extensibility framework, our customers can tailor these two experiences to address data capture, security, regulatory, and customer experience requirements. Use cases included:

- Add new fields in order to collect necessary customer data (name, phone number, email, preferences, consent, etc.) 
- Add new form elements for presenting and capturing TOS/privacy policy and opt-in before sign up
- Add custom content such as URLs, images, marketing information
- Localize custom text in different languages

## Getting Started

During open early access, this feature will be automatically available to all of our Professional and Enterprise customers and trial accounts. To get started, please check out our documentation [here](https://auth0.com/docs/customize/universal-login-pages/customize-signup-and-login-prompts). If you have any questions, please reach out to your Account Executive.  

Before closing, I want to give a shout-out to our customers who provided feedback during the limited EA. We had over 75 customers join and received invaluable feedback. This underscores the importance of this capability, which we’ll continue to evolve and shape based on customer feedback, so please let us know how it goes.  


_Any products, features, or functionality referenced in this material that are not currently generally available may not be delivered on time or at all. Product roadmaps do not represent a commitment, obligation, or promise to deliver any product, feature, or functionality, and you should not rely on them to make your purchase decisions._


Customizations for Sign up and Login Now in Open Early Access

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

Compromised credentials are a threat to your business and customers. Here’s how to reduce the risk.

Credential stuffing is a type of cyberattack in which a cybercriminal uses stolen usernames and passwords from one organization (obtained in a breach or purchased off of the dark web) to access user accounts at another organization.

Credential stuffing attacks are one of the most common causes of data breaches because[ 64% of all people](https://f.hubspotusercontent20.net/hubfs/3791228/2022%20SpyCloud%20Annual%20Identity%20Exposure%20Report.pdf) reuse the same password on multiple (and sometimes all) accounts. In fact, on Auth0's platform alone,[ nearly half of all login requests](https://auth0.com/resources/whitepapers/credential-stuffing-attacks) we receive each day are attempts at credential stuffing.

The opportunity for cybercriminals to use credential stuffing is only growing as more credentials are exposed through breaches; at present, literally billions of compromised credentials are circulating on the dark web. 

However, credential stuffing attacks are preventable if you implement the right cybersecurity measures. Below is what executives need to know about credential stuffing attacks and what can be done to reduce or prevent the likelihood that their organizations will be a victim of one.

> More in the following:
>
> - **[Credential stuffing whitepaper](https://auth0.com/resources/whitepapers/credential-stuffing-attacks)**
> - **[What is broken authentication](https://auth0.com/blog/what-is-broken-authentication/)**

## How Credential Stuffing Works

To execute a credential stuffing attack, cybercriminals add a list of stolen username and password pairs to a botnet that automates the process of trying those credentials on multiple sites at once. Large-scale botnet attacks can overwhelm a business' IT infrastructure, with websites experiencing as much as[ 180 times](https://auth0.com/blog/auth0-reveals-50000-credential-stuffing-attempts/) their typical traffic during an attack.

![Anatomy Credential Stuffing](https://images.ctfassets.net/23aumh6u8s0i/ohyMA4nbwQgkGF77RnSOs/b8997e017022790f156a985fb97c375d/anatomy-credential-stuffing.jpg)

Once cybercriminals find a site where a set of credentials works, they’ll have access to a user's account and personal data to do with as they please, which most commonly includes:

* **Selling access to compromised accounts:** This is particularly common for media streaming services. [Disney+](https://www.cpomagazine.com/cyber-security/new-disney-plus-streaming-service-hit-by-credential-stuffing-cyber-attack/),[ Netflix, and Spotify](https://www.engadget.com/2019/03/13/wickedgen-admin-arrested-stolen-passwords-netflix-spotif/) have all been victims of attacks in which hackers sold access to user accounts for less than the cost of a subscription.
* **E-commerce fraud:** Hackers can impersonate legitimate users at retailers' websites and order a high-value product, either for their own use or for reselling. This is a common (and for criminals, potentially lucrative) form of identity theft, which makes retail the most vulnerable vertical for credential stuffing, according to[ research from Akamai](https://www.akamai.com/newsroom/press-release/akamai-research-commerce-remains-top-target-with-over-14-billion-web-application-and-api-attacks).
* **Corporate/institutional espionage and theft:** While the above crimes have serious consequences for companies and their customers, this third form of attack has the potential to be most devastating for businesses. If an attacker successfully hijacks the account of an employee or admin, they could gain access to all sorts of sensitive personal information, like credit card numbers, social security numbers, addresses, and login credentials as well, all of which they can sell to the highest bidder.

## The Costs of Credential Stuffing Attacks

Although credential stuffing attacks often have a low success rate ([usually one to three percent](https://www.recordedfuture.com/credential-stuffing-attacks/)), their impact on organizations is often anything but small.

For example, the Ponemon Institute's ["Cost of Credential Stuffing" report](https://library.idgcommunications.net/idgcampaigns/documents/uploaded_data/d40/97b/1c-/original/the-cost-of-credential-stuffing_EN.pdf) found that businesses lose an average of $6 million per year to credential stuffing in the form of application downtime, lost customers, and increased IT costs.

Increasingly, regulators, as well as the public, are also holding companies accountable for credential stuffing attacks with stiff fines. Companies may be subject to legal action under data privacy laws such as [GDPR](https://auth0.com/docs/compliance/gdpr) if they fail to implement adequate security measures to prevent such attacks, fail to inform the public of a breach, or don't do enough to protect passwords.

For example, in 2018, the UK's [Information Commissioner's Office (ICO) fined Uber](https://www.computerweekly.com/news/252453244/ICO-fines-Uber-385000-for-data-protection-failings) £385,000 for "a series of avoidable data security flaws" that exposed the data of approximately 2.7 million UK customers. And in 2021, the French Data Protection Authority (CNIL) fined a data controller and its data processor €225,000 “for failure to implement adequate security measures to protect customers’ personal data against credential stuffing attacks on the website of the data controller.”

## Credential Stuffing Attacks vs. Brute Force Attacks

Credential stuffing is considered a type of brute force cyberattack. But in practice, the two are very different, as are the best ways to secure your systems against them.

Brute force attacks attempt to guess passwords by changing the characters and numbers (often in prescribed patterns or with commonly used base password phrases). To protect against them, you can limit the number of failed login attempts with[ brute force protection](https://auth0.com/docs/attack-protection/brute-force-protection), use a CAPTCHA, or require your users to use a stronger password.

However, a strong password won’t stop a cybercriminal from gaining access to an account via credential stuffing because the password is already known. Even CAPTCHA's or brute force protection’s ability to protect users is limited since users often[ change their passwords in predictable patterns](https://www.sans.org/security-awareness-training/blog/time-password-expiration-die) and cybercriminals have a breached password to iterate from.

## How to Prevent Credential Stuffing Attacks

Most people know password reuse is unsafe but choose to use the same password on multiple sites anyway because they have roughly[ 100 passwords to remember](https://tech.co/news/average-person-100-passwords). Password managers are an option, but [adoption rates are low](https://www.security.org/digital-safety/password-manager-annual-report/). So to prevent credential stuffing attacks, it’s up to organizations to take measures — such as removing passwords altogether — to ensure cybercriminals can’t use stolen credentials to access their users’ accounts. Based on [OWASP's Credential Stuffing Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Credential_Stuffing_Prevention_Cheat_Sheet.html), below are several methods for doing so.

### Credential hashing

Credential hashing is the first step to protecting your user's credentials from theft. [Hashing](https://auth0.com/blog/hashing-passwords-one-way-road-to-security/) scrambles a user's password before you store it in your database so that in the event that it is stolen, a hacker won’t be able to use them (in theory, at least).

In practice, not all password hashing is uncrackable. As Rick Redman, a penetration tester at KoreLogic, [explains](https://www.wired.com/2016/06/hacker-lexicon-password-hashing/), “The strength of the hash is the insurance policy. It tells you how much time users have to change their passwords after a data breach before they come to harm... If it’s just SHA1, there is no window... If it’s bcrypt, you have time to run away and change all your passwords.”

So although hashing user passwords won’t prevent a credential stuffing attack, it will limit what a cybercriminal can do with those passwords once they’ve stolen them.

### Breached password protection

Breached password protection compares the password a person uses to log in against databases of compromised credentials (like[ haveibeenpwned](https://haveibeenpwned.com/)) to prevent credential stuffing in real-time. 

For example,[ Auth0's breached password detection](https://auth0.com/docs/attack-protection/breached-password-detection) can be configured to notify a user, block them from logging in, or request an additional authentication factor (MFA) if it suspects their credentials were part of a published security breach or if a login attempt came from a suspicious IP address.

### Bot detection

As mentioned earlier, attackers use bots to execute a credential stuffing attack. [Auth0's bot detection](https://auth0.com/docs/secure/attack-protection/bot-detection) feature is able to identify a bot attempting to authenticate with [a high percentage of success](https://auth0.com/blog/auth0-bot-detection-reduces-bot-attacks-by-79/). It provides protection against credential stuffing attacks with very little friction to legitimate users. When a bot attack is detected, it displays a CAPTCHA step in the login experience to eliminate bot and scripted traffic.

### Anomaly detection

Monitoring what is happening is always a good approach to intervene earliest and stop an attack. If you have visibility of your traffic, you can understand when you are under attack, and you can take action to mitigate attacks. In Auth0, you can use [Log Streams](https://auth0.com/docs/customize/log-streams) to monitor your traffic in near real-time. After creating and configuring a Log Stream, you will start seeing Auth0 events being ingested into your chosen monitoring service. Based on your monitoring service, you can build your anomaly detection dashboard by anayzing the [Attack Protection Log Events](https://auth0.com/docs/secure/attack-protection/view-attack-protection-events).

### Multi-Factor Authentication (MFA)

[Multi-factor authentication (MFA)](https://auth0.com/multifactor-authentication) is a highly effective way to prevent credential stuffing because it requires users to log in with another form of authentication in addition to a username-password combination. For example, this could mean biometric authentication such as a fingerprint, a one-time code sent to a device associated with the user, or an email sent to a secured account — none of which a cybercriminal will have access to.

Although the adoption of MFA has been slow due to concerns about its impact on customer experience, the increase in sophistication and customizability of MFA are helping it catch on. For instance, in February 2020,[ Google announced](https://siliconangle.com/2020/02/12/google-require-nest-users-use-two-factor-authentication-enhanced-security/) it would require Nest smart home users to use two-factor authentication.

### Continuous authentication

Continuous authentication systems use factors like biometrics or behavioral patterns to verify a user’s identity in real-time (while they use an application) instead of a password. As a result, credential stuffing attacks (as well as a number of other cyberattacks) are no longer a viable method for cybercriminals to gain unauthorized access to a user’s account.

### Passwordless authentication

[Passwordless authentication](https://auth0.com/passwordless/) can prevent credential stuffing altogether because it verifies a user with something they have (a device or another account) or something they are (biometrics) instead of a password (something they know).[ Passwordless](https://auth0.com/passwordless/) also creates a better login experience for users and saves organizations time and money from dealing with password resets.

## Passwordless Authentication Is Better for Businesses and Users

Not only does passwordless authentication eliminate credential stuffing attacks, but numerous studies and reports show that it is a[ more secure](https://auth0.com/blog/is-passwordless-authentication-more-secure-than-passwords/),[ more user-friendly](https://www.lastpass.com/solutions/passwordless-access/from-passwords-to-passwordless), and[ more cost-effective](https://www.weforum.org/press/2020/01/forgotten-your-password-not-having-one-will-make-you-safer-says-world-economic-forum) solution overall than traditional username-password authentication for both businesses and their users.

“Relying on passwords as the primary means for authentication no longer provides the security or user experience that consumers demand,” Andrew Shikiar, Executive Director of the FIDO Alliance, [explains](https://www.weforum.org/press/2020/01/forgotten-your-password-not-having-one-will-make-you-safer-says-world-economic-forum) in a joint report with the World Economic Forum. Adrien Ogee, Project Lead from the World Economic Forum, adds, “Better authentication practices are not just possible; they are a necessity.”

Auth0’s platform makes it easy to implement secure, user-friendly passwordless authentication using biometrics, social logins, and more. Learn how to eliminate the risks associated with traditional username and password authentication with Auth0’s Passwordless authentication platform[ here](https://auth0.com/passwordless/).

What Is Credential Stuffing? How To Prevent Credential Stuffing Attacks

shiven_ramji

Shiv is an experienced product executive and builder obsessed with creating beautiful products. He is the President of Customer Identity at Okta, managing a $1B ARR business and overseeing the company’s product, data, security, and technology strategy and execution. Before Auth0 and Okta, Shiv was the SVP of Product at DigitalOcean, leading DigitalOcean’s products, pricing, and partnerships. Additionally, Shiv has held product leadership positions at global brands, including Amazon, NBCUniversal, LiveIntent, and The Nielsen Company. Shiv was the recipient of the 2023 Top Global CPO Award by the Products That Count community. 

Beyond his current corporate focus, Shiv is deeply committed to fostering entrepreneurship and innovation, particularly in Africa. He is an active angel investor and startup advisor and also serves on the boards of [Products That Count](https://productsthatcount.com/) and [Aiven.io](http://Aiven.io).

President, Auth0

Shiven Ramji

Win business customers with enterprise-ready Identity

**TL;DR:** Okta has launched the [Auth0](https://www.okta.com/press-room/press-releases/okta-introduces-okta-customer-identity-cloud-to-help-businesses-grow-user/), powered by Auth0, with support for two use cases: Consumer Apps and SaaS Apps. This article explores the SaaS Apps use case and capabilities, as well as how product and engineering leaders can accelerate growth with an identity solution built for business customers.

The Software as a Service (SaaS) market is booming, with new products coming online every day. The average number of apps companies use increased to 89 this year, with as many as 187 for larger companies, according to [Okta’s Businesses at Work 2022 report](https://www.okta.com/businesses-at-work/).

All of this growth has created intense competition in the SaaS space. The companies that will win are the ones who can successfully onboard business customers quickly and move upmarket while remaining hyper-focused on their core product. 

In identity and access management terms, this is called customer identity: Learning about your customers and securely building consent-based trust by understanding who they are and how they want to engage with you.

Historically, there have been very limited customer identity options on the market for the SaaS use case, and product and engineering leaders end up using some combination of consumer and workforce identity solutions.

What if you didn’t have to use baling wire and duct tape? Could identity help you capture your market opportunity–instead of slowing you down?

## Customer Identity for SaaS Apps, Simplified 

Auth0 for SaaS Apps enables every app builder to become enterprise-ready and accelerate growth without having to become an identity expert. SaaS-specific capabilities like Enterprise Federation, Delegated Administration, Multi-factor Authentication (MFA), custom branding, and security features are available out of the box. And our robust identity product roadmap means we’re constantly innovating for you, too.

“Kandji is committed to being a pioneer in the future of work by helping companies manage their Apple devices at scale,” said Weldon Dodd, senior vice president of Product Strategy at [Kandji](https://auth0.com/case-studies/kandji). “Delivering the best experience for our customers means making onboarding as slick as possible, managing and customizing workflows, and providing the most secure experience from both an administrator and end-user perspective. We did all of this with Auth0 four times as fast as our DIY solution. And it’s working–we’re already seeing customer revenue trending up.” 

Here are a few of the ways our customers, like Kandji, Blackboard, and TripActions, are using SaaS Apps today.

### Acquire and Onboard New Customers

As your business scales, you want to streamline the onboarding process to your applications, so business customers can start using your product quickly and collaborating with their coworkers. This increases your “stickiness.” With our APIs and SDKs, you can build **Self-Service Onboarding** directly into your application so that your customers can provision access control, set up Single Sign-On (SSO), and invite other members of their organization without burdening your engineering team.

### Personalize Experiences For Your Customers

Technical teams can spend weeks configuring identity manually for each new customer, with lots of back-and-forths to implement changes. **Organizations** is our toolset that helps SaaS companies manage and model identity for business customers as organizations (under a single tenant). It allows you to provide last-mile customization on a per-organization basis to ensure the authentication experience meets their needs, including enterprise federation with any source, account provisioning, onboarding and migration flows, customized branding, and security policies that meet the most stringent requirements.

### Achieve On-Demand Security

[Credential stuffing](https://auth0.com/resources/whitepapers/2022-state-of-secure-identity-report) accounts for 34% of overall login traffic and outpaces normal traffic in some countries (61%) in the U.S. and verticals (more than 80% in retail), according to Okta’s 2022 State of Secure Identity Report. **Attack protection with [Credential Guard](https://auth0.com/blog/auth0-credential-guard-detects-breached-passwords-faster-to-prevent-account-takeover/)** and **[Bot Detection](https://auth0.com/blog/auth0-bot-detection-reduces-bot-attacks-by-79/)** enables you to secure the data of your business customers, and help prevent the most common identity-based attacks. We take the burden of managing identity security off your internal teams, so they can focus on shipping new features for your product.

### Customize Authentication For Complex Use Cases

No two business customers are the same, and there will be frequent requests to customize your platform for complex use cases. **Extensibility**–custom code blocks and extensibility points that allow for secure customization at any point in the authentication pipeline–has long been an Auth0 differentiator and is now available through Auth0. And because we maintain the extensibility framework, you can meet unique authentication needs and confidently check off RFP requirements today, with adaptability for tomorrow.

### Become Enterprise Ready and Scale

Your customer identity platform should help you grow and land larger customers more often. With SaaS Apps, customer requirements around **SSO and MFA** are available out of the box. Coupled with cloud choice across AWS and Azure, regional infrastructure for data residency, and our 99.99% SLA, you can grow your business anywhere in the world, one login at a time–without needing to host, manage, or scale an identity solution yourself.

## What’s New for SaaS Apps?

New product innovations for SaaS Apps, announced at Oktane22, are now available for all Okta customers:

* **Okta Workforce Enterprise Connection:** Okta Workforce Enterprise Connection makes it easy for SaaS app builders to offer out-of-the-box integrations to Okta Workforce Identity Cloud, providing end-users with a seamless and trustworthy login experience. This enterprise connection is included on all Enterprise and B2B self-service plans for no additional charge and is now easier to discover and configure for SaaS Apps use cases.
* **Organizations Enhancements:** To support our customer's business growth, Organizations now support greater scalability with up to two million organizations per user (tenant) and two million members per organization. We have also made it easier to search for organizations within the Manage Dashboard, making it even easier to find and administer those millions of business customers in your multi-tenant application.

Ready to accelerate your business with identity? Learn more about Auth0 for SaaS Apps at [https://www.okta.com/customer-identity](https://www.okta.com/customer-identity/).

Auth0 for SaaS Apps Explained

Convert and protect customers at the login box and beyond

**TL;DR:** Okta has launched the [Auth0](https://www.okta.com/press-room/press-releases/okta-introduces-okta-customer-identity-cloud-to-help-businesses-grow-user/), powered by Auth0, with support for two use cases: Consumer Apps and SaaS Apps. This article explores the Consumer App use case and capabilities, as well as how app builders, digital leaders, and security teams can set their applications up for success with end-users, starting at the login box.

It doesn’t matter if you’re in the public sector or selling pizzas–for every organization, in every industry, digital business is just business now.

As consumers ourselves, we know the best apps are the ones that improve our daily lives, keep us safe online, and are delightful to use. We also know what a terrible login experience feels like: 83% of consumers have [abandoned a cart or signup due to an arduous login process](https://info.auth0.com/expectation-vs-reality), and 48% are frustrated by filling in long login or sign-up forms.

In the identity and access management world, this is called customer identity: Learning about your customers and securely building consent-based trust by understanding who they are and how they want to engage with you.

While managing customer identity is a relatively new concept for marketers, app builders and security teams have been wrestling with the complexity around identity and access for years.

What would happen if we treated identity as the “digital front door”? Could we make end-users more secure, help developers launch the next big app, or put an end to passwords?


## Consumer Identity Without Compromise

Auth0 for Consumer Apps enables app builders, digital marketers, and security teams to give end-users access to everything they need online in a convenient and secure way. Consumer-friendly capabilities like Passwordless, Progressive Profiling, and Adaptive Multi-factor Authentication (MFA) ready to go out of the box help maximize conversion, retention, and loyalty without adding friction or security risk. And our 100% focus on identity means we’re keeping an eye on the latest attacks and technologies for you, too.

“Flo is committed to building a better future for female health with the number one OB-GYN recommended app, a thriving community, and science-backed resources,” said Roman Bugaev, Chief Technology Officer at [Flo Health](https://auth0.com/case-studies/flo-health). “Auth0 allows us to provide personalized insights to our users in a thoughtful and secure way, so they can take control of their health. Improving the authentication experience has also helped us reduce churn during the login process, driving our signups 12 times higher since we made the change.”

Here are a few of the ways our customers are using Consumer Apps today.

### Acquire Customers With Just One Click

Asking consumers to create (yet another) password that meets certain complexity requirements results in lower customer acquisition rates, especially on input-constrained devices. Streamline registration with fewer passwords for users and fewer password resets for your support team with **Single Sign-On (SSO) and social logins**, MFA, and more out of the box. Want to do away with passwords entirely? You can start with multiple passwordless options without adding security risk.


### Personalize Experiences for Long-Term Loyalty

Today, digital marketing teams are effective at personalization and testing around the login box, but very few are doing this within identity. Considering that the login box is the gateway to digital experiences, this is a huge missed opportunity. Features like **Universal Login** make it possible to customize the login experience to your exact audience with any number of authenticators–even without your own dedicated identity team. This is a huge selling point for marketers and the developers they work with, who have a lot on their plates already.


### Collect First-Party Data Without Friction

Have you ever had someone ask for too much information on a first date? Long sign-up forms are the digital equivalent. With web cookies going away, digital teams are turning to features like **Progressive Profiling** to collect first-party data over time as consumers sign up and engage with their website or app. Less creepy? Yes. Even more effective for building trust and personalizing experiences? Definitely.


### Protect Revenue From Bots and Brute Force

[Credential stuffing](https://auth0.com/resources/whitepapers/2022-state-of-secure-identity-report) accounts for 34% of overall login traffic and outpaces normal traffic in some countries (61%) in the U.S. and verticals (more than 80% in retail), according to Okta’s 2022 State of Secure Identity Report. Distinguishing between legitimate users and would-be attackers requires finesse and can quickly become a full-time job. Our **Attack Protection** capabilities like Bot Detection, Breached Password Detection, Suspicious IP Throttling, and Adaptive MFA give security teams the tools they need to fight fraud without damaging the user experience.


## What’s New for Consumer Apps?

New product innovations for Consumer Apps were announced at Oktane22. Okta expects these features to be available by the end of Q2 2023, with support for Highly Regulated Identity as an Enterprise Add-on.

* **Passkeys support:** Passkeys are a replacement for passwords that make it faster and safer to sign into apps and websites on any device. The technology is phishing-resistant and uses a device — usually a fingerprint or facial recognition, or a PIN — to prove a user is who they say they are. We are making it easy for app builders to turn on passkeys with the literal flip of a switch.
* **Highly Regulated Identity:** While we’re enabling app builders to offer the most exciting experiences, we also recognize some of our customers operate in highly-regulated industries like banking or utilities. Highly Regulated Identity is a new toolset that allows customers to safeguard riskier transactions with extra security and policy control. We are taking steps toward enabling customers to reach Financial Grade API (FAPI) compliance with several new product innovations, including:
    * **Pushed Authorization Request (PAR):** A new OAuth endpoint that avoids passing any sensitive information on the front channel (e.g., all authorization details won’t appear in the browsing bar or search history).
    * **Rich Authorization Request (RAR):** A framework that enables fine-grained control over authorization for any use case, including communicating fine-grained details on a transaction (e.g., payment amount) and customized consent gathering (e.g., selecting a bank account as part of the consent step).
    * **Private Key JWT:** An authentication method that improves security posture by signing with a private key rather than a password or secret that can be intercepted and used by someone other than the intended recipient.
    * **Strong Customer Authentication (SCA):** A component of the European Union’s second Payment Services Directive (PSD2) that requires at least authenticating users with at least two factors: something they have (e.g., device or hardware key), something they know (e.g., password or PIN), and something they are (e.g., biometrics).
    * **Mutual Transport Layer Security (mTLS):** A type of authentication where access tokens can only be used by the application they were specifically issued for; thus, if a token is leaked, it can’t be used by the attacker. 
* **Security Center:** At Okta, we have insights from billions of authentications about the threats facing consumer apps. We want to make sure your entire cross-functional team has this same visibility. Security Center is a single pane of glass that enables security professionals to monitor in real-time, detect, and respond to potential identity security events–either directly through your dashboard or by integrating with the security stack of your choice. With comprehensive dashboards, visualizations, and controls tailored to customer identity scenarios, this is a powerful tool for keeping your customers secure and your app operating at the highest level.

Learn more about the Auth0 and how to turn your login box into an engine for growth at [https://www.okta.com/customer-identity](https://www.okta.com/customer-identity/).

**Footnote:** _Any unreleased products, features, or functionality referenced in this blog post that is not currently available, may not be delivered on time or at all. Product roadmaps do not represent a commitment, obligation, or promise to deliver any product, feature, or functionality, and customers should not rely on them to make purchase decisions._

Inside Auth0 for Consumer Apps

Oliver Wang

A product manager at Auth0 focuses on  Ecosystem and Extensibility.  With an engineering background, Oliver always puts developers' experience first.  He has mixed industrial experience as a Product Manager, Software Engineer and Data Analyst. This diverse profile unites different team members to deliver value to our customers. Besides work, you can catch him up on a ski hill in the Canadian Rockies.

Product Manager, Ecosystem

Geoffrey Goodman

I am a curious and driven person. Until my early twenties, I was one of the top-ranked Canadian slalom skiers. While still competing, I pursued dual business majors at a Liberal Arts college in Nevada, funded by academic and athletic scholarships. I then joined EY in Montreal, where I worked with all of the four major service lines and earned my CA title. I now work with the Valuations and Business Modelling group and I am pursuing my CBV designation. 
 
I am also a self-taught computer programmer. I am comfortable in any number of programming languages. I built a website and steward a community of thousands of people across the world who rely on and benefit from its services every day.

Staff Engineer

Customers can now add custom prompts or factors in their post-login flow

We are excited to share that our customers that use Actions -  Auth0’s flagship extensibility product - can now add custom prompts or factors in their post-login flow. This enables developers and partners to confidently record the completion of a factor upon returning after a custom redirect. Auth0 delivers more tools, features, and options for developers to give them the support and capabilities they need to customize their customer’s experience through pro-code flexibility.

We have introduced a new method to the API of post-login Actions when continuing the flow after a successful custom redirect. This method allows a customer and/or partner to store the completion of that custom factor right in the user’s session. What is powerful about this is that they can then check whether that customer record is in a user session in each login and skip that prompt if it’s there already. Because it’s stored in the user session itself, it benefits from any current and future session management features within the Auth0 product offering.

## What Is the Problem We Are Solving?

Historically, there was no good way for customers to use Actions to securely implement custom prompts or custom factors in a user-friendly way. They could use user metadata or application metadata, but those objects exist across all user sessions. There was also no good way for customers or partners to see whether a user on a specific device had completed the necessary factors to login. This meant forcing users to re-perform the custom prompt or factor more often than necessary.

As an example, let's say you’re a developer for a banking app that has a special requirement to use a custom multi-factor authentication service, and you want that authentication to be associated with a user's session and or device for added security. That is where the ability to add a custom prompt enables you to build that customer experience and address that need.

## See It in the Real Example!

Let's take a look at a real example! Below is a sample Actions code for a Partner Integration implementing a custom authentication factor.

On the `onExecutePostLogin`, we trigger the custom authentication method by using Actions Redirect to send users to the customer method URL with session token information.

```js
const CUSTOM_METHOD_URL = "https://path.to.prompt";
const PROMPT_TTL = 1000 * 60 * 60 * 24; // 24h

exports.onExecutePostLogin = async (event, api) => {
    if (
        !event.authentication?.methods.some((record) => {
            // Timestamps are rendered as IS08601 strings
            const timestamp = new Date(record.timestamp);

            return (
                record.name === CUSTOM_METHOD_URL &&
                timestamp.value0f() >= Date.now() - PROMPT_TTL
            );
        })
    ){
        const sessionToken = api.redirect.encodeToken({
            payload: {
                user_id: event.user.user_id,
            },
            secret: event.secrets.SESSION_TOKEN_SECRET,
        });

        // Trigger our custom authentication method
        api.redirect.sendUserTo(CUSTOM_METHOD_URL, {
            query: { session token: sessionToken }
        });
    }
};
```

Continue with `onContinuePostLogin`, we validate the session token secret and record the completion of our custom authentication method.


```js
exports.onContinuePostLoqin = async (event, api) => {
    const payload = api.redirect.validateToken({
        secret: event.secrets. SESSION_TOKEN_SECRET,
        tokenParameterName: 'session_token'
    });

    if (!validateSessionToken(payload)) {
        return api.access.deny('Unauthorized');
    }

    // Record the completion of our custom authentication method.
    // THIS NEW API IS ONLY AVAILABLE IN 'onContinuePostLogin'
    api.authentication.recordMethod(CUSTOM_METHOD_URL);
};

function validateSessionToken(payload) {
    // Custom validation logic would go here
    return true;
}
```

Actions is an iterative platform we continually improve upon. [Start creating your Auth0 Actions](https://auth0.com/docs/customize/actions/write-your-first-action) today and customize your logic flow with the seamless low-code integration with Auth0!

New Actions Feature: Build Your Own Custom Factor

Dan McCorriston

Senior Product Marketing Manager

Now, all Auth0 customers - including those on our private cloud platform - have access to all the offerings on the Auth0 Marketplace.

Auth0 is excited to announce a newly expanded offering for [our new private cloud platform](https://auth0.com/blog/a-technical-primer-of-auth0-s-new-private-cloud-platform/) customers - Actions Integrations are now available from the Auth0 Marketplace. What that means is all Auth0 customers that utilize our new private cloud platform have access to all the offerings on the Auth0 Marketplace - SSO, Social Connections, Log Streaming Integrations, and now, Actions Integrations.

Actions Integrations will start to appear in the Development/Staging space now and will be ready in the Production environment in the coming weeks dependent on various release cadences.

### What are Actions Integrations and the Auth0 Marketplace, and why should I care?

At Auth0, we realize that many customers have unique needs, and as a result, they want the ability to customize their identity product. In order to serve these additional customer needs, Auth0 built a variety of tools to extend the functionality of identity. This concept is called **extensibility.**

Auth0 Actions and Actions Integrations is the next generation of **extensibility**. Actions is the low-code offering, and Actions Integrations allows customers to use pre-written no-code, drag and drop options to add other functionality such as ID proofing and consent management. Auth0 provides this additional functionality through integrations with **our Ecosystem partners** offered in the Marketplace.

The Auth0 Marketplace and Auth0 Actions are the two complementary ways we extend Auth0. Customers and their end users need the ability to resolve their unique identity requirements — which may include payments, subscription management, signing terms of services, etc. — to complete a successful user access journey into their application or service.

### What is Private Cloud?

Auth0’s [Private Cloud offering](https://auth0.com/cloud) provides the flexibility and agility offered by cloud deployments but also allows a customer to maintain the control and security they need to protect their customers and their businesses. Many customers that have high security and regulatory concerns - those in the financial services industry, for example - may require certain standards of uptimes, updates, failovers, and support for their deployments. The Auth0 Private Cloud deployment models come in both Standard and Managed levels, depending on the customer’s requirements.

Auth0 [recently invested in retooling the Private Cloud platform](https://auth0.com/blog/a-technical-primer-of-auth0-s-new-private-cloud-platform/) to support more automation, adopt current technologies and help scale the Private Cloud to thousands of environments.

### Benefit of Private Cloud and Actions Integrations

Private Cloud has a strong appeal for customers who have high volume or who are from certain verticals. For example, verticals like banking, where shared databases are a concern. Or customers who have data residency requirements or even those who prefer to deploy in a specific region close to their customers. Private Cloud customers do not have to be concerned with sharing space, public cloud request limits, and multiple customer’s data being present in the same deployment. 

Many of the same customers that have a need for Private Cloud also have extensive use cases for extensibility and the no-code integrations available in the Auth0 Marketplace. Easy-to-use integrations such as Identity Proofing and Customer Data Management. With Actions Integrations, developers no longer need to build or maintain custom code or make changes when we alter programming models or release new versions of Node. These Actions Integrations are built and maintained by our Ecosystem partners and are available right in the Auth0 Marketplace. 

A couple of examples of Actions Integrations available in the Auth0 Marketplace:

* [**Deduce Intelligent MFA**](https://marketplace.auth0.com/integrations/deduce-intelligent-mfa): Deduce prevents consumer-facing Account Takeover (ATO) and registration fraud via the constantly growing Deduce Identity Network, with over 400M profiles and in excess of 1.2B daily activities. Deduce risk signals significantly reduces false positive MFA challenges.
* [**Tealium User Login**](https://marketplace.auth0.com/integrations/tealium): Tealium connects customer data - web, mobile, offline, Internet of Things (IoT) - so brands can connect with their customers. Tealium empowers companies to create a unified, real-time customer data infrastructure and makes customer data more valuable, actionable, and secure.

### Is this an increased opportunity for Ecosystem Partners?

Now that Private Cloud customers have access to Actions Integrations in the Auth0 Marketplace, our Ecosystem Partners have a new and expanded pool of potential customers to reach through building and publishing Actions Integrations into the Marketplace. There’s never been a better time to become an Ecosystem Partner and market your Actions Integrations through the Auth0 Marketplace.

Make sure to visit the [Auth0 Marketplace](https://marketplace.auth0.com/) to see if there is an integration that optimizes your customer’s identity experience. To find out more about becoming a [Private Cloud](https://auth0.com/docs/deploy-monitor/deploy-private-cloud) customer, please [send an inquiry](https://auth0.com/get-started?place=documentation%20post&type=link&text=contact%20auth0%20sales) and someone from Auth0 will contact you about whether it’s a good fit for your business.

Actions Integrations Now Available in Private Cloud

Chitra Dharmarajan

A motivated CyberSecurity professional with a specialization in IIOT, Cloud Application & Infrastructure Security, Web Application Security, Product Security, and Solutions Architecture. An innovative technical leader, who has efficiently managed cross-geographical teams to successfully deliver Secure Development Lifecycle, Incident Management, Penetration Testing, Product Development & Release Management initiatives. Excels in translating strategic objectives into actionable plans and solving complex problems while delivering high-quality business results. 

Senior Director, Product Security

Confirmation that no action is needed for Auth0 customers

On July 19, 2022, a security consultancy firm released a blog post with claims related to the security of specific features for the Okta service. The areas of concern highlighted by the security consultancy firm are not vulnerabilities specific to the Okta service. Refer to the [Okta blog](https://www.okta.com/blog/2022/07/okta-response-to-security-report/) in response to the security report for further details. Product & Security teams at Auth0, an Okta product unit, conducted a thorough review and determined that the risks in the referenced report do not apply to the Auth0 product.  

To use SCIM with Auth0, our customers are expected to contact professional services to securely configure and deploy custom SCIM solutions as referenced [here](https://auth0.com/docs/authenticate/protocols/scim).

Additionally, Auth0 enforces HTTPS in all Auth0 controlled data transfer channels. 

### What to do if you are an Auth0 customer

At this point, no action is needed for Auth0 customers. We advise the following best practice recommendations, which you should consider in the context of your specific configuration.

1. Always use HTTPS to ensure the secure transmission of data.
2. Enable MFA for all user accounts. MFA should be enforced for all dashboard users that have privileged tenant access. Auth0 encourages all users, not just admins, to require MFA on their accounts.
3. Utilize Auth0’s [Dashboard Role-Based Access Control](https://auth0.com/docs/get-started/manage-dashboard-access/feature-access-by-role) to provide finer grain access controls to dashboard users. 
4. Perform periodic [access reviews of dashboard role assignments](https://help.okta.com/oie/en-us/Content/Topics/Reports/admin-role-assignments-report.htm) and ensure access is limited to authorized personnel.
5. Monitor and periodically review the actions performed by dashboard users recorded in [the tenant logs](https://sec.okta.com/articles/2022/06/unlocking-mystery-700-okta-system-log-events).

If you are an Auth0 customer who is looking for security best practices, you may find additional information in these links:

- [https://auth0.com/docs/secure](https://auth0.com/docs/secure)
- [https://auth0.com/docs/customize/rules/rules-best-practices/rules-security-best-practices](https://auth0.com/docs/customize/rules/rules-best-practices/rules-security-best-practices)

Auth0 Response to Security Report

Build an Actions Integration and connect with Auth0 customers

## Why Should You Become an Ecosystem Partner?

Whether you’re a developer of a newly launched solution, or part of a larger, enterprise-level organization, you want to get your product in front of potential customers. Therefore, developing and growing your reach through an Extensibility Ecosystem strategy is a vital part of any organization’s overall strategy.

At Auth0, we consider extensibility to be one of our essential product capabilities. While our endless options for integrations are an excellent way to customize your own unique solution, it can be difficult and time-consuming for our customers to figure out how to implement them.

Enter the [Auth0 Marketplace](https://marketplace.auth0.com/).

We built the Marketplace as a way to connect our customers with service providers and builders who implement these types of integrations regularly. Listing your integration with Auth0 promotes your company with our customers who are looking to do more with their authentication pipeline.

![Ecosystem](https://images.ctfassets.net/23aumh6u8s0i/5rRXDrFl5g647jL7dPbjR/c7d099307234ef118b05e3c6f1215fda/Marketplace_Partner_Spotlight_Separator_V02A_3x.png)


## What is an Ecosystem Partner?

More and more SasS companies are offering developer customers the flexibility and capability to stay within their own ecosystem as much as possible in order to find solutions that fit their own and their customers’ needs. A rich and diverse catalog of integrations can give developers all the low and no-code capabilities they need to build out their own customer journey.

**Auth0** provides an authentication and authorization service built on open standards like OIDC, OAuth2, SAML, and others. But, more than that, we provide tools so our customers can outsource user centralization and management alongside components of application security, and we also help connect networks of applications to a single source of identity.

An important part of this is enabling partners, such as yourself, to create an ecosystem of integrations that can be used to enhance and extend what we already provide. We do this by providing extensibility points and methods to allow customization. This means more functionality for customers with less maintenance burden for them.

Almost 90% of our customers extend the Auth0 platform for their unique requirements. By working with you to solve common identity problems and use cases, we can expedite the time it takes our customers to implement their identity workflows.

Joining Auth0 as an ecosystem partner by building and marketing your Action Integration has some very important opportunities to take advantage of.

### Opportunities:

#### Audience Reach
Auth0 has more than 90k active tenants in production. Some customers have multiple tenants, and some only have one, but this is a large reach of potential customers for your Action Integration. Once your Action Integration is in the Marketplace, customers will have the opportunity to discover, consider, and install your integration into their customer identification flow.

#### Co-marketing
Once you’ve successfully published your Action Integration into the Marketplace, take the next step to expand your reach through GTM initiatives. While we encourage you to drive some GTM initiatives on your own, we also have many opportunities for you to market your integration with us. From blogs and newsletters to demand generation and webinar programs, we have multiple opportunities to help you market your integration.

#### Early to market
The earlier you create your Action Integration and are published to the Marketplace, the better chance you have of creating your own virtuous cycle of early adopters of your integration, marketing your case study, and growing your customers through the ecosystem.

#### Take advantage of Actions technology
Auth0’s new universal extensibility toolset - Actions - is the latest advancement on our commitment to delivering best-in-class extensibility to developers. Developers can take advantage of the easy-to-use interface, drag and drop functionality, version control, a serverless environment, pre-production testing, and debugging.

## How Do You Start?

If you want to learn more about becoming an ecosystem partner and building an Action Integration, visit [Integrate with Auth0](http://autho.com/integrate) to learn more. Here are the main steps you’ll take on your journey to becoming a partner:

## Develop a Use Case for a Customer Need

Some of the considerations you should make when developing a use case for your integration are:

* What does your service do, and how will this help our end customer? (ex. low conversion rates caused by interrupted security measures like MFA, spam signups and content submission, too much or unhelpful log data).
* Do you target specific industries and customer types? (ex. B2C, B2B)

Some of the most popular categories are:

* Identity proofing where customers need to prove they are who they claim to be
* Multi-Factor Authentication, where customers are required to use more than one step to prove their identity
* Consent Management that asks, records, and stores a customer’s approval or denial to use their information.

 
![Ecosystem](https://images.ctfassets.net/23aumh6u8s0i/5J18zBKKTWj49BiFo9cjfz/6363b6e28cf2492c47507b71666e8ca2/Marketplace_Partner_Spotlight_Separator_V02B_3x.png)
 

There are dozens of other use cases and perhaps many we haven’t thought of. If you’ve got a great solution that fits into the identity flow, let us know.

#### Start building your Action Integration
Get build support once you have created your solution use case. There are step-by-step instructions on how to develop your Action Integration. As your start building, you can get support from our comprehensive documentation, blogs, and forums. Live developer support is available for certain build scenarios.

#### Get published in the Auth0 Marketplace
Once your code has been tested and gone through the QA process, you are ready to deploy your Action Integration to the Auth0 Marketplace. Your integration will not only be discoverable in the Marketplace but easily found and installed from the developer dashboard.

#### Go To Market Opportunities
Now it’s time to find some customers and get them to install your Action Integration. Auth0 will partner with you on a Go-to-Market plan through newsletter, direct email, and social media marketing, as well as drive customers to webinars and demo content. Your success is our success.

There are more details and information at [Integrate with Auth0](http://auth0.com/integrate), so check it out to find out how to become an Auth0 ecosystem partner.

Become an Ecosystem Partner

eugenio-pace-new-avatar

Pace co-founded Auth0 in early 2013 with CTO and “brother-in-arms” Matias Woloski while living 7,000 miles apart from each other. Since then, Pace has played an instrumental role in growing Auth0 into a leading identity management company that is loved by developers and trusted by global enterprises. He loves traveling and has visited more than 35 countries for business and pleasure. He currently lives in Redmond, Washington with his wife, two sons, and their labrador retriever. In his spare time, he enjoys the outdoors, rowing, riding bikes, spending time with his family, restoring his 1970 Karmann Ghia, writing his blog, and reading history and philosophy.

CEO and Co-Founder

Eugenio Pace

Identity leaders combine developer and enterprise expertise, offering customers more flexibility

Okta, Inc, today (May 3, 2021) announced the successful completion of its acquisition of Auth0. Together, Okta and Auth0 address a broad set of digital identity use cases, providing secure access and enabling everyone to safely use any technology. 

Auth0 will operate as an independent business unit within Okta, led by Auth0 Chief Executive Officer and Co-Founder Eugenio Pace, reporting directly to Todd McKinnon, Chief Executive Officer and Co-Founder of Okta. Both Okta’s and Auth0’s platforms will be supported, invested in, and integrated over time — accelerating innovation and making the Okta Identity Cloud even more compelling for the full spectrum of customers and users. 

“Identity is one of the most strategic investments an organization will make today. A single, unified identity platform has the power to transform an organization by providing seamless and secure access for both customers and employees,” said McKinnon. “Okta and Auth0 have always shared a vision for the identity market. We’re also both cloud-first, customer-first companies. By joining forces, we’ll give our customers more choice and flexibility, driving tremendous value and enabling them to accelerate innovation. Together, we will shape the future of identity on the internet, empowering developers to build with identity at the foundation.”

"As Okta and Auth0 join forces today, bringing together two exceptional companies, I'm more confident than ever that we will deliver on our shared vision to secure access for everyone," said Pace. "Auth0's focus has always been on enabling product builders to innovate, and now as one company with a shared vision and combined resources, that innovation will only increase."

Okta’s and Auth0’s comprehensive, complementary, and flexible identity platforms solve every identity use case, regardless of the audience or user. Okta pioneered cloud-based identity, offering enterprise-grade reliability and world-class security while prioritizing customer success for organizations of all sizes. Auth0 was built by developers for developers. Application builders around the world are loyal to Auth0 for its extensibility, ease of use, scope of documentation, and developer-friendly experience. With combined expertise across developer communities and the enterprise, Okta and Auth0 will provide enhanced depth and breadth of identity solutions and will be even better suited to integrate quickly into the modern tech stack of today’s developers. 

“At Kiva, we’re on a mission to expand financial access to help underserved communities around the world thrive. Identity plays an essential role in making that happen," said Ken Leung, EVP of Engineering, Kiva. "Today, we leverage Auth0 to provide secure authentication to Kiva's partners and lenders, and Okta for workforce identity, giving our team access to the critical technologies they need to best serve the millions of global entrepreneurs in our network. We trust both Okta and Auth0 to connect our people and technology, and are excited to see how they evolve and innovate together."

“Credence goes to those who can help us identify one another in a digital world,” said Jay Bretzmann, Program Director for Cybersecurity Products, IDC. “Okta and Auth0 provide the cloud-ready, developer-friendly tools to help in the fight. They're building the platforms and technology we’ll need to take the next steps. Simple, elegant, and customer-centric." 

## Cautionary Language Concerning Forward-Looking Statements

This blog contains forward-looking statements relating to expectations, plans, and prospects including statements relating to the anticipated benefits that will be derived from this transaction, the expected acceleration of Okta’s growth as a result of this transaction, the impact to the Okta Identity Cloud, expected synergies resulting from the transaction and expansion of Okta’s customer base. These forward-looking statements are based upon the current expectations and beliefs of Okta’s management as of the date of this release and are subject to certain risks and uncertainties that could cause actual results to differ materially from those described in the forward-looking statements including, without limitation, the risk of adverse and unpredictable macro-economic conditions, the failure to achieve expected synergies and efficiencies of operations between Okta and Auth0, the ability of Okta and Auth0 to successfully integrate their respective businesses, the failure to timely develop and achieve market acceptance of the combined business, the loss of any Auth0 customers, the ability to coordinate strategy and resources between Okta and Auth0, and the ability of Okta and Auth0 to retain and motivate key employees of Auth0. Additional factors that could cause actual results to differ materially from these forward-looking statements are detailed from time to time in the reports Okta files with the Securities and Exchange Commission, including in Okta’s Annual Report on Form 10-K for the fiscal year ended January 31, 2021. All forward-looking statements in this press release are based on information available to Okta as of the date hereof, and Okta disclaims any obligation to update these forward-looking statements.

<include src="asides/AboutAuth0" />

Okta Completes Acquisition of Auth0

Our commitment to delivering a Tier 0 service for our customers

Resiliency, reliability, and adaptability are foundational tenets to how we build at Auth0. Last year, we recognized the need to deliberately double down on our resilience efforts in order to address some of the failures we had seen. In November 2021, I wrote about our [plans to improve the resilience of our platform](https://auth0.com/blog/improving-our-platform-resiliency-and-upcoming-holiday-plans/) and the additional steps we were taking to address the peak holiday traffic. I’m proud of the hard work and diligence by our teams during the holiday season that moved us considerably towards our goal of providing a Tier 0 service. Today, I want to provide updates to that work, share the progress to date, as well as provide insight into our upcoming efforts.

## Update on Our Resiliency Focus Areas to Date

As a reminder, a big focus area for our team was to reduce the load on our datastores. We made significant progress in this area:  

*   Reduced the database read/write workload by 50%. Our initial target was a 10% reduction, so we greatly surpassed our initial estimates
*   Reduced 45% of inserts/deletes from our database in US-1, 50% in EU, and 20% in the rest of our environments. The team's initial target was 40% in US-1 so we also beat this estimate

We also actioned all the initially identified resiliency priorities. These were all implemented either prior to the Thanksgiving holiday in the US or in early December:  

*   Added noisy neighbor protection for our extensibility stack (Webtask)
*   Expanded our caching approach for common Authentication API requests
*   Enforced new Auth API global rate limits for all production tenants
*   Enforced 100 RPS for non-production enterprise tenants
*   Refactored our connections schema and deleted unused entries/rows; in US-1, we reduced the table size by ~25X.
*   Overprovisioning of our stack was done in anticipation of holiday traffic, we’ve since downsized based on usage data and some of the other protections put into place

While we made great progress on our improvement initiatives, I want to acknowledge that in December we experienced a few issues related to our network edge, which caused unfortunate customer impact. We have met with our network edge provider to ensure our expectations around incident response and service levels are understood and upheld. We’ve also initiated a new internal effort to review our Edge resiliency plan and kicked off the discovery work. We’ll provide further updates as we make meaningful progress on this effort.

## What’s Next in 2022

Resiliency has been and remains a top priority for Auth0 in 2022. The work that I outlined above has laid strong foundations that will serve as a springboard for our ongoing priorities. Below are a few key highlights of what to expect this year.

### New Environments
This is one of our top priorities for the first half of 2022. Construction efforts have kicked off for three new production environments that will enable us to shift load as required for our demand response strategies and limit the blast radius of disruptions and outages. These environments will be launched in 1H 2022 and will feature two new options in the US and one in the EU.

### Automated Tenant Migration Process

In addition to new environments, our team has been working on our capabilities to move tenants from one environment to another in order to further reduce the blast radius. The early design work began in Q3 2021, with a focus on high-touch migration of select targeted customers based on feature usage, workload, and configuration. As we iterate and learn from that effort, we will shape up our tenant migration process from “high-touch”/manual intensive to a more automated process.

### New Platform Rollout

We are laser-focused on our platform modernization efforts which have an underlying architecture that is responsive and resilient to meet all current and anticipated customer needs. The new platform is already powering our product that [launched on MS Azure](https://auth0.com/blog/auth0-on-microsoft-azure-as-a-private-cloud-deployment-option/) in November 2021. I will share details about the availability of this new platform on AWS as we get closer to launch in Q1 2022.

Thank you for the continued trust that you place in Auth0 to meet your identity needs. We have exciting things in the works that will enable us to continue our delivery of a Tier 0 service with all of the product innovation you have come to rely on for your applications.

A Look Back to Our Platform Resiliency and What’s Next

auziros:mckenzie-mayer

Customer Identity (CIAM) Product Comms lead, driving collective storytelling across Okta and Auth0. Making technology accessible for everyone.

Customer Identity Product Comms Lead at Okta

McKenzie Mayer

Global travel marketplace uses Auth0 to eliminate passwords and block suspicious login activity for millions of customers

**LONDON – 13 January 2021** –[ Auth0](https://auth0.com), a product unit within[ Okta](https://www.okta.com/) (NASDAQ: OKTA), today congratulates its customer, [Skyscanner](https://skyscanner.net), the global travel marketplace, on receiving the 2021 European Identity and Cloud Award for Customer Authentication, presented by [KuppingerCole Analysts AG](https://www.kuppingercole.com/). The winning customer identity project, designed to put travelers first with a simple and secure user experience, helped Skyscanner eliminate nearly all passwords for millions of customers, while blocking suspicious login activity that could signal an attack.

“Skyscanner’s mission is to lead the global transformation for modern and sustainable travel. This includes leveraging Auth0’s modern identity platform to give our customers a complete booking experience, while keeping their data secure,” said Brett Bunting, principal product manager at Skyscanner. “It is an honor and a privilege to receive this award from KuppingerCole, as we work to make booking travel safe and friction-free for everyone.”

Using the Auth0 platform, Skyscanner’s development team introduced [“passwordless” authentication](https://auth0.com/resources/whitepapers/passwordless-authentication), along with intelligent security features to detect and stop malicious attempts to access user accounts. Travelers can now sign up for a Skyscanner account simply and securely with just one click using either a one-time password (OTP) delivered via email, or Google One Tap, which prompts users to log in with their existing Google account. 

Skyscanner was also among the first to use Auth0’s Attack Protection suite to defend against breached passwords, suspicious IP addresses, and bots and scripted attacks, without adding friction for legitimate customers. Travel and retail brands are targeted most by brute force attacks, followed by organizations in the industrial services, government, and technology sectors, according to [Auth0’s 2021 State of Secure Identity Report](https://auth0.com/resources/whitepapers/state-of-security-identity-report). 

“Eliminating passwords and replacing them with strong yet adaptive and frictionless multi-factor authentication is the approach we as security experts have been promoting for years, and yet successful projects of this kind are still quite rare,” said KuppingerCole Senior Analyst Alexei Balaganski in his laudation at the award ceremony. “All this makes the project we honor today even more impressive, considering its sheer scale: Skyscanner serves millions of users from all around the world, seamlessly supporting a broad range of authentication options and protecting its customers and own infrastructure from cyberattacks.”

For the list of 2021 European Identity and Cloud Award winners, please visit the [KuppingerCole website](https://www.kuppingercole.com/eic-2021-awards).

<include src="asides/AboutAuth0" />

Skyscanner Wins KuppingerCole Customer Authentication Award with Auth0

Cosmetics firm replaces home-built authentication with Auth0 to optimise developers’ time and simplify security for customers and staff throughout the business

**LONDON. – 9th November, 2021** – The [Auth0 Identity Platform](https://auth0.com/), a product unit within Okta, has been selected by [Lush](https://www.lush.com/uk/en), the global cosmetics retailer, to provide a superior login experience for customers and staff interacting with the online brand. Auth0 will initially power the login experience for Lush’s new chat function and add website authentication, along with centralising its point-of-sale (PoS) system to simplify access to information throughout the organisation, while helping to ensure privacy.

When it comes to pursuing more [ethical ways of doing business](https://weare.lush.com/lush-life/our-ethics/digital-ethics/), Lush is no stranger to pushing the limits. Founded in the 1990s, its commitment to sustainable, cruelty-free production was initially an outlier in cosmetics, but the brand has influenced the direction of the industry as a whole. In the process, it has grown into a successful multinational business and operates in 47 countries with 937 global Lush shops. The latest business numbers can be found on [Lush’s company information website](https://weare.lush.com/numbers).

Traditionally, Lush preferred to build its digital services in-house following its digital ethics code. However, when it restructured its digital business using a microservices architecture, the company found that its approach to authentication complicated its ability to protect customer data, which raised security concerns within the company. What’s more, the time taken for developers to maintain its internally-built authentication system strained innovation across other parts of the business.

“While we didn't experience any major data leaks, our home-baked solution raised red flags for our internal data privacy team, and that posed a huge risk for us since we are a business built on ethics,” said Simon Ince, Lush’s creative technology and innovation lead. “During the development of a new customer chat function, we hit a roadblock with our existing authentication system. Time was not on our side, so we evaluated open standards as an alternative to building in-house. That’s when we discovered Auth0, and the problem was solved in thirty minutes.”

Following the success of the chat system, Lush evaluated Auth0’s solution for use across other parts of the business — including its website redesign and centralizing its global POS system — to create a more seamless, secure, and personalized end-user experience. With Auth0, just two developers were able to add authentication to Lush's website without impacting Lush's existing timeline or roadmap.

“When business and consumer needs rapidly evolve, and the security landscape becomes even more complex, maintaining in-house systems can be a difficult and time-consuming process — one that takes developers away from other, more pressing tasks,” said Steven Rees-Pullman, SVP International at Auth0. “Auth0’s identity platform enables Lush to refocus its development teams where they can bring the most value, while meeting the company’s ethical standards for data privacy and customer security.”

Learn more about [Lush’s implementation](https://auth0.com/case-studies/lush-cs/) on Auth0.com.

<include src="asides/AboutAuth0" />
### Media Contacts
Auth0 Global Communications 
[press@auth0.com](mailto:press@auth0.com)

Lush Transforms its Login Experience with Auth0

We are committed to delivering a Tier 0 service for our customers

Over the last few months, there has been an increase in service degradation and outages that has shaken our customer’s confidence in Auth0. Our number one mission is to provide you with the highest level of service and reliability at all times, for the full spectrum of customers from free users to enterprise. The production environments in US-1 and EU have been impacted the most frequently and, in extreme cases, has caused downtime for some of our customers. As the Auth0 CPO, I sincerely apologize for the pain this caused you and your customers. We take ownership for the failures and recognize how disappointed you are.

We know that identity plays a critical role in your company, and it is our responsibility to make our service reliable. It is also our responsibility to provide guidance to our customers on appropriate architecture patterns. When we experience failures or degradation of our service, we correct them as swiftly as possible. Today, I wanted to share the active measures we are taking to protect against similar issues from occurring in the future.

## First, What Caused the Outages?

Before we explore all of the actions we have taken, it’s good to understand the patterns we have observed in these environments:

### Noisy neighbors in our large multi-tenant environments create throughput bottlenecks

The noisy neighbor phenomenon is a well-known issue in multi-tenant environments. In our case, one co-tenant may experience a spike in traffic which can lead them to monopolize resources available and thus reduce the throughput (requests-per-second) on the environment for the other co-tenants.

Most of our customers in the US-1 and EU environments have enjoyed many years of uninterrupted service. These environments have grown significantly and are now the longest-running and largest, which exacerbates the noisy neighbor impact.

We have not strictly enforced restrictions to the frequency of customer API calls (rate limits) and at times allowed for a 10X increase in requests-per-second (RPS) for certain tenants in a single environment. Typically, our architecture would allow us to absorb these spikes as it is the case in most of our environments, but given the volume and size of the customers in US-1 and EU, these concurrent requests restrict throughput for other tenants. We do not fault our customers for their peak traffic needs and it is on us to put in place the right protections and guardrails around each tenant. Unfortunately, we are not able to actively load shed today (i.e. automatically move tenants to other environments such as US-3, because we don’t currently have the migration tooling nor can we do it without any downtime). There are some customer scenarios where a planned migration by a customer is possible, but it requires time and effort on your part. I will cover migration scenarios and timing in the ‘Looking beyond the next 60 days’ section below.

### Region Mean Time To Recovery (MTTR) outside of our 15-min target

The other item we are solving is meeting our 15 minutes target for region failover. This is caused by dependencies on an underlying managed service that doesn’t support automated failover within our target timeframe. Our teams are in the final stages of completing the switch, a managed service that allows us to automatically failover within 15-minutes, in Q1 2022.

We can successfully failover Availability Zones (AZ) today within our 1-minute target window as validated by quarterly testing.

## What Actions Have We Taken Already?

### Slowing down and invoking our change freeze earlier

Effective Sept. 30, 2021, we’ve significantly reduced the number and frequency of changes that we’re introducing into production for the remainder of the year. This is to introduce increased testing and soak time in pre-production environments. Heading into the holiday season, our protocols may change slightly, however, we anticipate continuing a conservative posture to maintain the stability of our production environments. We are mostly allowing changes that are related to our resiliency initiatives or security patches. Being an authentication platform, security-related changes are non-negotiable, as is our mission to protect you and your customers.

### New staging environment

As of early October, we have a staging environment that has the same load as US-1, so that we can simulate test cases reproducing production traffic at large scale. The volume and high load-related issues described above can now be more easily detected.

### Additional resources and re-prioritization of our roadmap

We have added team members and reprioritized resilience projects in order to complete these improvements in time for the holiday season. I am personally doing a daily stand-up with our Engineering leadership team to ensure there is an elevated review process and all blockers are actively being addressed. In addition, all new product and feature initiatives have been deferred until the new year.

### Resilience and holiday readiness efforts

After our outage on April 20th, a dedicated team of 40 engineers completed a 10-week task force to reduce the load on our environments that resulted in:

* Reduced cache load by removing unused feature flags and added in-memory caching of multiple per-environment feature flags.
* Removed 2 collections from our database that reduced total database writes by 10%.
* Reduced reads to the collection with the most reads within the database by 12%.
* Added limits to refresh tokens queries from the Management API.
* Added missing indexes for new collections in the database.

Some of the improvements identified were multi-quarter projects that are still underway and are expected to be completed this November. These projects will:

* Reduce the read/write workload by 10%.
* Reduce 40% of inserts/deletes from our database.
* Reduce 30% of inserts/deletes from our database in US-1 enviroment. This requires a deprecation of opaque access tokens and will take 6 months to complete.

In October, we started the following remediation projects to further reduce the probability of these failures:

* Refactoring our connections schema to remove high cardinality issues.
* Addressing noisy neighbor issues in our extensibility stack (also known as Webtask).
* Implementing an additional caching layer for reading requests.
* Proactively and significantly over-provisioning our stack in an effort to get ready for holiday traffic.
* Enforcing global active rate management per tenant at the edge.

The projects listed above are also scheduled to be live and in production by November 10. We know that all of the initiatives above will reduce the load on our environments and should significantly reduce the noisy neighbor issue I referenced above.

We are also initiating code change freeze windows over the holidays:

🟧 **Orange Change Freeze** 10/12 - 11/11 

🟥 **Red Change Freeze** 11/12 - 11/29 

🟧 **Orange Change Freeze** 11/30 - 12/16 

🟥 **Red Change Freeze** 12/17 - 01/03 

🟧 **Orange Change Freeze:** During this window, all production deployments are halted, and only work related to stability for Mission Critical Services, security patches or urgent releases on other components may be deployed. Changes must meet testing and approval criteria. 

🟥 **Red Change Freeze**: During this window, all production deployments are halted. Exceptions allowed only to resolve critical customer issues or security patches. Changes must meet testing and approval criteria. 

## Looking Beyond the Next 60 Days

### New environments and migration capabilities

We are now actively working on creating new environments in our US and EU regions. Our target is to progressively introduce 4 new environments in the US and up to 3 new environments in the EU in CY Q1 2022. The new environments allow us to dynamically allocate load as part of our demand response strategies and significantly reduce the blast radius of disruptions and outages. Our team is also actively scoping and designing an automated tenant migration process. We expect to have an automated tenant migration tool that will enable us to work with you and migrate you over to one of our newer environments beginning late CY Q1 2022.

### New platform rollout across clouds and regions

We began working on a modern platform last year that is poised to roll out across the regions and clouds that we operate in. This month we began the gradual rollout of this new platform and made it available on Microsoft's Azure cloud. This new platform architecture has been purposefully designed from the ground up to deliver a scalable, reliable, and resilient service that meets the current and future needs of our customers. We are targeting to make this available on AWS starting CY 1H 2022.

Finally, we truly appreciate your trust in Auth0 and will do everything that we can to keep that trust. I will post another public update in early CY Q1 2022 to share the results of all of our work in future blog updates including the progress of the improvement initiatives listed above.

_Please note: any unreleased products, features, or functionality referenced in this disclosure may not be currently available and may not be delivered on time or at all. Product roadmaps do not represent a commitment, obligation, or promise to deliver any product, feature, or functionality, and you should not rely on them to make your purchase decisions._

Improving Our Platform Resiliency and Upcoming Holiday Plans

tyler-clark

Tyler works as a developer advocate engineer at Auth0. He's worked as an engineer at small to enterprise level companies and loves everything about tech. You'll frequently find him ether out with his family, playing sports, or coding something. He's also an instructor on <a target='_blank' rel='noopener noreferrer' href='https://egghead.io'>egghead.io</a>, and his profile is online at <a target='_blank' rel='noopener noreferrer' href='https://tylerclark.dev'>tylerclark.dev</a>.

Senior Developer Advocate Engineer

Tyler Clark

Easily manage the business customers that access your applications

We're very excited to announce a new way to enable businesses and teams to access your applications: **Auth0 Organizations!**

Auth0 is a software-as-a-service product. Like many SaaS platforms, Auth0 can be used by individuals, but more often than not, it is used by teams. When building SaaS, or any B2B application, developers need a way to represent and manage those teams.

Often, SaaS products will have dashboards that allow each of their customers’ administrators to manage their organizations:

- Manage membership and access levels of their team members
- Invite new members with predefined roles
- Connect their identity provider for single sign-on
- Define authentication factors and security policies

We’re forced to build this all from scratch each time we create an application, which cuts into the time we have to build the app itself. We’ve struggled with this at Auth0 when building our applications, like [our Dashboard](https://manage.auth0.com/), and when we speak with engineers and architects that work at our customers’ companies, we’ve heard similar stories.

These problems are common enough to deserve a purpose-built solution, and that is why we built Organizations.

## How Does it Work?

We’re introducing a new “organization” entity that will live in your Auth0 tenant. You can create organizations representing teams, business customers, partner companies, or any logical grouping of users who should have different access to your applications.

![Screenshot of a list of organizations within the Auth0 dashboard](https://images.ctfassets.net/23aumh6u8s0i/62tk5hrj3iPvHwgckwvkDJ/3b549543665a5ec999533d4da0ad52a5/approved-asset-three.jpeg.png)

Using Organizations and New Universal Login, you can configure and customize the log-in experience that end users in these organizations have when accessing your product. You can mix and match your branding with your customers in the login experience and email communications and easily configure federation for your larger customers and partners that need it.

![Side by side view of universal logins](https://images.ctfassets.net/23aumh6u8s0i/2UBgf6RIt2WX6kbToKKzg6/28717eead2542bdd0f7c463f030a72ab/asset-blog-2-APPROVED.png)

You can choose from various methods for membership and access management of the different organizations that access your product:

- Define roles for your applications, then invite users to organizations with those roles predefined. Also, the same user can have different roles in different organizations, so you can model user isolation or cross-organizational access as needed for your app.
- Turn on just-in-time membership so that anyone logging in from a specific federated connection becomes a member of the organization.
- Add members via the Manage Dashboard or API, or expose all of this functionality in your application so that your customers can manage their membership!

![Invite members to organizations and edit authentication of organizations](https://images.ctfassets.net/23aumh6u8s0i/12YZpXmHDIoEGhgHuESANn/3c834b9cee90b16711809f80f45b971b/asset-blog-3-APPROVED.png)

## Let’s Build a SaaS App with Organizations!

<AmpContent>
<amp-youtube
 data-videoid="BcUxeThMq74"
 layout="responsive"
 width="480" height="270">
</amp-youtube>
</AmpContent>
<NonAmpContent>
<iframe width="560" height="315" src="https://www.youtube.com/embed/BcUxeThMq74" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>
</NonAmpContent>

Before we walk through a demo application utilizing organizations, let’s chat briefly about who the target audience is again. As the title suggests, SaaS (Software as a service) companies provide cloud-based applications that typically charge on a subscription model. Their platforms help other businesses focus on their core product by relieving stress on other business needs. Think about products like Slack or DataDog. When you log in to these platforms, they need to know what company or workspace you belong to before getting you to the correct login flow and, ultimately, the appropriate tenant in their platform.

With businesses as the target customer for SaaS and B2B companies, handling authentication of users within these businesses can be complicated. How are users organized within a specific target business? What about separate branding, access control, and SSO for each business?

Let’s answer these questions with a demo application and Auth0 Organizations!

### Chat0

Introducing our demo app: Chat0, the demo SaaS company that provides state-of-the-art communication services 😀!

![Screenshot of Chat0 dummy app](https://images.ctfassets.net/23aumh6u8s0i/NlvSED8ZuEQz9KtKjMQ1D/134de05a845d028a5696c84b9e0e9332/orgs-overview-2.jpeg.png)

You can try Chat0 yourself by cloning and installing the repo found [here](https://github.com/twclark0/orgs-sample-app).

Once you have this repo cloned to your local machine, navigate into its directory and then run the following commands:

`npm install`

And then

`npm start`

After running this last command, open Chat0 on your browser of choice at `http://localhost:3000/`.

Chat0 is a React single-page web application for this demo, which means that it doesn’t have a back end. With our artificial SaaS company, we invite businesses to sign up for our communication services.

Once businesses have created an account with Chat0, they can send messages (not included in the demo app code) and view stats of their company’s communications.

![Screenshot of the Chat0 dashboard](https://images.ctfassets.net/23aumh6u8s0i/2Ck8zg899VCR0VrTcJBDiR/e15c935d7db75b7d0ff9260b32efb811/chat0-dashboard.jpeg.png)

As you can see above, we want users of a business to see the data after authenticating. However, we want this page to be branded and have data specific to the user’s business/organization. Again, this is similar to the flow you see when you try logging into Slack and DataDog. The result is your company’s or workspace’s brand and data.

So let’s work with a SaaS company (Chat0), add authentication with organization capabilities, brand those two Universal Login experiences, set up individual connections, and invite new users to an organization.

### Set up Auth0 and Configure the React SDK

![Screenshot of Auth0 applications dashboard](https://images.ctfassets.net/23aumh6u8s0i/ECqJSSY7cAaG82huQqHGc/5b064214fb171f3bbf1a3112cd335d92/applictions.png)

You will first need to [sign up for an Auth0](https://a0.to/blog_signup) account if you do not already have one.

Once you’ve signed up for or logged into your account, you’ll land on the dashboard.

Within the left navbar, click on _Applications_ and then _Applications_ again. Press the _Create Application_ button in the top right corner. Choose the Single Page Web Applications option and give it a good name.

After the application is created, the only configuration you need to do is to update three text boxes:

- _Allowed Callback URLs_
- _Allowed Logout URLs_
- _Allowed Web Origins_

We will update these text boxes with `localhost` for local development.

![Screenshot of Auth0 magic mirror application](https://images.ctfassets.net/23aumh6u8s0i/4HphywO1Dwx0bLISHm8kYc/72cc3194241080779688cf8932013621/applicationsettings.jpeg.png)

I filled out those text boxes as follows:

_Allowed Callback URLs_

`http://localhost:3000/`

The above value is the URL that Auth0 can use to redirect your users after they successfully log in.

_Allowed Logout URLs_

`http://localhost:3000/`

The above value is the URL that Auth0 can use to redirect your users after they log out.

_Allowed Web Origins_

`http://localhost:3000/`

Now inside Chat0’s code, we need to update the React SDK provider values with the ones created when we created the new application within Auth0.

On the `AuthWrapper.js` page, we need to update the props provided to the `Auth0Provider` component. We need to update the `domain` and the `clientId` with the _domain_ and _clientId_ shown within the Auth0 Application page we just created.

```javascript
export const AuthWrapper = ({ children }) => {
const currentOrganization = localStorage.getItem("organization_id");
const options = {
domain: "dev-rm3u1yq4.auth0.com",
clientId: "OgdvG5snvJGpeIrW9FKXbB5D9UmSQufP",
redirectUri: window.location.origin,
...(currentOrganization ? { organization: currentOrganization } : null)
};
return <Auth0Provider {...options}>{children}</Auth0Provider>;
};
```

The `redirectUri` value is where you want your application to redirect to when logging out.

The `organization` prop is being conditionally passed depending on if we've stored an organization id within the browser yet. We'll talk more about this after we configure Organizations within this application. So hang tight!

If you want to learn more about the Auth0 React SDK, check out this [video](https://www.youtube.com/watch?v=1rgeO_EbSGg)!

### Brand Your Auth0 Application

Auth0 provides easy customization of your Universal Login. Back within your Auth0 account dashboard, click on _Branding_ and then _Universal Login_. This is the login page that Chat0’s business customers will see when they want to authenticate.

If you scroll down to the bottom of the page, you can provide a link to your SaaS company’s logo and colors. As you can see, these are the values I provided for Chat0.

![Screenshot of Auth0 Universal Login customization](https://images.ctfassets.net/23aumh6u8s0i/5TM8XsJKpyfPoSHrmAJjW4/452f8f2acd81876fb20e9502979448b9/universal-login-custom.jpeg.png)

### Configure and Set Up Organizations

At this point, we have a functioning application, complete with simple Auth0 powered authentication. Now, let’s enable organization support and add an organization to our Auth0 application.

Back within our Auth0 dashboard and Chat0 application, notice there is a tab called _Organizations_. Go ahead and click on that tab.

![Screenshot of Auth0 organization settings page](https://images.ctfassets.net/23aumh6u8s0i/2sEk40iRY0ADpuIxlm3WbO/f9c7befb5c3435147a65bfb2261c1210/enable.jpeg)

Go ahead and toggle the green _Display Organization Prompt_ button. As it states below, this will prompt users to enter their organization name before logging in.

![Authentication prompt for organizations](https://images.ctfassets.net/23aumh6u8s0i/2fDmJPNHNWzbE2RAZBtN3d/69e8dcbc8fce760e5727e8f60822251c/universal-login-2.jpeg)

With the Universal Login ready to accept a user’s input for their organization, let’s now create an organization within our tenant.

On the left-hand sidebar, click on _Organizations_. Then on this page, click on the button that says _CREATE ORGANIZATION_.

![Screenshot of organizations tab within Auth0 dashboard](https://images.ctfassets.net/23aumh6u8s0i/6Z3aYFlcAnFRQMXeG5VXQk/dc050e0f0d41dd03f2e5b044bc42ccaf/dashboardorganization.jpeg)

After clicking on the _CREATE ORGANIZATION_ button, we are directed to this page to add basic information about our new organization.

![Screenshot of how to add an organization](https://images.ctfassets.net/23aumh6u8s0i/2848XRMQCXWk7HWSw2S229/3e49ae7ede2ed1ab7d2481aac6159c73/addorganization.jpeg)

As the text on this page states, the name is a human-readable identifier for the organization. Also, the display name is a friendly name for the organization. For example, I choose `acme` for the name and then `Acme` for the display name.

Once you are satisfied with the new organization, click on _ADD ORGANIZATION_.

You will then see your newly created organization.

Within this screen, you have the power to do a lot of customization. As you can see in the picture below, I have branded my new organization with some colors and a logo.

![Screenshot of an individual organization view](https://images.ctfassets.net/23aumh6u8s0i/39FS8nQYPsJoCSuumYfLfH/fda0ecc4622cbe9952fb33bd8a94026f/individualorg.jpeg)

At the bottom of this page, you can add custom metadata about your organization for extensibility purposes.

The _Members_ tab shows all of the current members within the organization. The _ADD MEMBERS_ button allows you to add a member to this specific organization.

Let’s create a new user and add them to this organization. So on the left-hand side of the page, click on _User Management_ and then _Users_. Here we can click on the _CREATE USER_ button and enter information about a new user. Once this is saved, back in our organization, we can click on the _ADD MEMBERS_ and add this new user to the organization.

The _Invitations_ tab provides the functionality to invite users to this specific organization.

![Screenshot of the members’ tab within Auth0 dashboard](https://images.ctfassets.net/23aumh6u8s0i/3YCjKOoeqzlgNV0Uwy6xnL/0b5d9be884e2813d6f1f182e954df635/invite.jpeg)

After clicking on the _INVITE MEMBERS_ button, you can choose your application from the initial dropdown (only ones with organizations enabled will show in the list).

Then you can add email addresses, determine which connections can be used and what role to assign them as a member of that organization (if there are any roles defined within your tenant).

Finally, on the _Connections_ tab, you can choose which connections you want to enable for this specific organization. Instead of enforcing the same connections to all applications within your tenant, you can control how each organization’s members can log in.

![Screenshot of the connections tab within organizations](https://images.ctfassets.net/23aumh6u8s0i/1kUkcgHRQYH7MrdIAviGLq/7cc069d1394cedade92f597ad6e9053d/connections.jpeg)

And that’s it!

When you go back to Chat0, which is running locally, click on the _login_ button in the header. It will show you the Chat0 Universal Login prompt asking for an organization.

![Authentication prompt for organizations](https://images.ctfassets.net/23aumh6u8s0i/34QV5KntgVMfvl5m54Gh7l/1df56e270aa9144b368ef0e7f6c8166f/universal-login-2.jpeg)

After entering _acme_ (the name of the newly created organization), it’ll open up the Acme-specific login.

![Authentication prompt for the acme organization](https://images.ctfassets.net/23aumh6u8s0i/3R0aMeqwdCOzTq5I8MKMtH/8eba028a984741815073a7aeaabe06f2/acme.jpeg)

Login with the user you created earlier, and then you will be redirected to the Chat0 dashboard for Acme users.

![Screenshot of a dashboard branded with the acme logo](https://images.ctfassets.net/23aumh6u8s0i/3SLUeDBuqPkcMceXiPZZEi/198df05368106dbf4482cf1a41e7d2c9/acmedashboard.jpeg)

Remember when we discussed conditionally setting the `organization` prop on the `Auth0Provider` component above? Within the `Sidebar.js` component, we set this `id` within `localStorage` when we get it.

```javascript
const { user } = useAuth0();
useEffect(() => {
if (user.org_id) {
localStorage.setItem("organization_id", String(user.org_id));
}
}, [user.org_id]);
```

The Auth0 React SDK provides the `user` object. This includes basic information about the user after successful authentication.

Setting and retrieving the authenticated organization id is what keeps the user authenticated when refreshing the page.

## Taking It Further

This article barely scratches the surface of the full functionality of Organizations. Using these new features, you can:

- Represent the teams, business customers, and partners that use your applications as organizations in Auth0.
- Set up branded, federated login flows for each organization.
- Manage organization members in a variety of ways, including just-in-time membership and email invitations.
- Define roles to represent what end users can do in your applications and assign those roles to organization members to have different roles in different organizations.
- Build administration capabilities into your products so that administrators in those organizations can manage their membership and access levels.

## What’s Next

As of today, Organizations is available for Auth0 subscribers on our Enterprise and Startup plans. You can find [technical documentation here](https://www.auth0.com/docs/organizations). We’ll be introducing new capabilities to improve organizations. We’d love to hear your thoughts about what we should focus on next; just comment below or send us questions [in the community forum](https://community.auth0.com/).

Introducing Auth0 Organizations

kaycie-east

As PR Manager, Kaycie supports public relations and global communications efforts for Auth0 in the AMER region. When not promoting the Auth0 brand, Kaycie can be found hiking, traveling, or searching for the next best bite to eat.

PR Manager, AMER Region

Kaycie East

New private cloud deployment option offers customers greater choice, scalability, and reliability

**BELLEVUE, Wash. – Oct. 13, 2021 –** The [Auth0 Identity Platform](https://auth0.com/), a product unit within Okta (NASDAQ: OKTA), today announced the launch of the [Auth0 Identity Platform on Microsoft Azure](https://auth0.com/cloud/azure). The launch gives customers the ability to choose Azure as their cloud deployment option from Auth0. The addition of Azure as an Auth0 private cloud platform option unlocks a secure cloud deployment option for organizations seeking strategic fit with their technology stack, supporting regional data residency capabilities and higher control over customer data.

Today, organizations moving to the cloud and selecting a [Customer Identity and Access Management (CIAM)](https://auth0.com/blog/what-is-ciam/) solution require significant control over sensitive customer data and may require local data residency capabilities. They often have to make a hard choice of selecting either a CIAM solution that supports their product differentiation goals or one that meets their technical requirements and regulatory needs. Auth0’s modern identity platform eliminates the need to choose by providing organizations with tools designed to support security, compliance, and data residency needs that may apply to them across multiple regions globally. The platform’s design can accelerate their time to value and go-to-market strategies to meet their long-term growth goals. 

Key benefits of the Auth0 Identity Platform on Azure include:

* **Technology Stack Alignment:** Organizations have the flexibility to choose Azure as their preferred cloud vendor for greater technology stack alignment with existing investments in Azure. 
* **Data Residency:** Improved data residency capabilities for Auth0 customers with Azure’s widespread geographic infrastructure.
* **Streamlined Experience with Private Cloud:** A modern, cloud-native platform built with a focus on security and compliance at every level. Organizations requiring data residency options can take advantage of periodic feature updates while maintaining control over the timing and the ability to roll back without the hassle of having to maintain them — resulting in faster time to market and a more seamless experience for organizations and their customers.

“As more applications move to the cloud and expand globally, organizations depend on their identity service to protect and manage access for their most critical users, applications, and data,” said Shiv Ramji, Chief Product Officer at Auth0. “The Auth0 Identity Platform on Azure can help unlock a secure and compliant cloud deployment experience for organizations seeking support across CIAM use cases. This is especially true for organizations in industries like retail or financial services where selecting vendors that are not competitive to their business is top priority, organizations operating in regions where certain cloud providers have higher geographic availability, and those that have existing technology investments in Azure.”

“Companies like Auth0 add value by integrating their solutions with Microsoft Azure,” said Mandana Javaheri, Global Senior Director, SCI Business Development at Microsoft Corp. “With Azure, Auth0 customers have ultimate performance capabilities and control over their environment without the hassle of maintaining it, allowing customers to focus more on their core business proposition.”

More detailed information on the Auth0 Identity Platform on Azure can be found on [Auth0’s blog](https://auth0.com/blog/auth0-on-microsoft-azure-as-a-private-cloud-deployment-option). Auth0 will discuss this offering in greater detail with Okta at Showcase21 taking place today, Oct. 13, 2021. To learn more, visit: [https://www.okta.com/showcase/register](https://www.okta.com/showcase/register) 

<include src="asides/AboutAuth0" />
### Media Contacts:

Global Communications 
Auth0 
[press@auth0.com](mailto:press@auth0.com) 

Matter Communications for Auth0 
[auth0@matternow.com](mailto:auth0@matternow.com) 

### Investor Contact:
Investor Relations 
[investor@okta.com](mailto:investor@okta.com)

Auth0 Identity Platform Now Available on Microsoft Azure

kerry-ok

Kerry is a marketer that loves to partner with the sales organization. As our SVP for Marketing, she is focused on sharing the Auth0 narrative across the globe. Before Auth0, Kerry spent many years working in B2B Tech at Skytap and F5 Networks. She spends her spare time with her family, dog, working in the yard, and enjoying fantasy football.

Chief Marketing Officer

Kerry Ok

Taking a closer look at our recent YouGov survey results

![What Your Customers Really Want From Your Login Box](https://images.ctfassets.net/23aumh6u8s0i/3ECzfjyrDSou0kNDj6grh6/dcd039b4cd4f6f4b85d3aa4da305d679/Uploaded_from_What_Your_Customers_Really_Want_From_Your_Login_Box_-_Steven_Rees-Pullman)

We think a lot about login boxes. 

But you would be surprised by just how much your customers are thinking about them as well.

Now, we would say that, since we are in the business of making login boxes. So that’s why we went out and asked people what _they_ thought: more than 17,000 global technology leaders and consumers across 12 global markets: United States, United Kingdom, Belgium, France, Germany, the Netherlands, Australia, Singapore, Japan, Argentina, Brazil, and Mexico.

The survey report, called “[Expectation vs. Reality at The Log Inn](https://info.auth0.com/expectation-vs-reality),” and conducted in partnership with third-party research firm YouGov, revealed that most organizations fail to meet consumer expectations around login experiences.

Everywhere we looked, consumers' expectations didn’t match reality. If you’ve ever had to fill out endless registration forms just to buy a pair of jeans, or create yet another (weak) password for websites owned by the same company (even worse), you know the pain. 

And it makes sense, right? Login should be simple, invisible almost. Because it’s a marketer’s worst nightmare when you get frustrated and decide to take your business elsewhere.

At least, that _would_ _be_ the case, if anyone were paying attention to the login box.

## Won’t Somebody Think of the Login Boxes?

It’s easy to forget about login boxes. After all, no one visits a website just to play with the [CAPTCHA](https://auth0.com/blog/introducing-auth0-craptchas/) – and they are rarely the first place executives and their marketing teams look to increase revenue and reduce churn. But, if you have a website or application, it’s likely you have a login box, and it’s the first thing that customers see. 

So, what did the study show customers want?

A winning lottery ticket?

No.

They want choice.

When they arrive at your login, customers want convenience and control: they want to choose which authentication method to use – whether it’s MFA or SSO or biometrics. They want a brand experience that resembles a concierge desk: a 24/7 service where no demand is too big. To top it off, they don’t want to see any technical glitches, or have to re-sign up on another device: they want seamless omni-channel experiences – not to be left out in the cold.

* **Passwords just don’t do it for people** &mdash; Consumers rank “Creating a password that has to meet certain requirements” (e.g. number of digits, symbols) among their top frustrations with the sign-up process (47%).
* **One ID to rule them all** &mdash; Almost half (48%) of consumers are likely to sign up to an app or service if they can use Single Sign-On (SSO) – using a single ID and password for multiple related services. This number is higher for Latin American (61%) consumers compared to their global counterparts (APAC 52%, EMEA 41%, and the US 47%). 

## But Login Boxes Aren’t Really a Big Deal, Right?

To make things interesting, we asked businesses what they thought consumers thought (getting meta with this study), and they often didn’t realize just how important login experiences really are:

* **Minding the gap with biometrics**
    * 44% of consumers are likely to sign up to an app or online service if a company offers biometric authentication — only 25% of companies offer biometrics as an option.
* **Going fully passwordless**
    * LATAM (43%), US (42%), and APAC (40%) consumers are more likely than their EMEA counterparts (29%) to sign-up to an app/online service if they were able to use passwordless services. Across the globe, just 20% of companies offer passwordless authentication.


## It’s More than Just a Login Box

Not having the technologies above is not just a minor annoyance; it’s an actual turn-off for many consumers when it comes to engaging with your brand. Oftentimes your login box is actually standing in the way of users signing up to your app or making a purchase.

* **It’s not about the journey, it’s about the destination**
    * About half of the consumers (48%) are frustrated by having to fill in long login or sign-up forms. This number rises for consumers in APAC (55%) and LATAM (51%) compared to consumers in EMEA (46%) and the US (36%).
* **I’m outta here**
    * Our research shows that 83% of consumers have abandoned a purchase or an account setup because the login process was too arduous. This rises to the highest levels in Singapore (89%), Brazil (87%), Australia (86%), France (86%), US (86%), UK (85%), and Mexico (85%).

## Okay, You Have My Attention

Good. Very few executives are used to paying much attention to customer identity management (their login box). But as many of us emerge from the past year, more digital than we’ve ever been, creating safe and simple access to online services is essential. 

The opportunity to build trust is massive.

This is admittedly just a glimpse into the minds and behaviors of consumers. We are working on a series of blogs that look deeper at what consumers want, and how the login box can help.

What Your Customers Really Want From Your Login Box

auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

Joins exclusive group of AWS Partners with deep expertise and proven success in helping customers around the world build a secure digital workplace

**BELLEVUE, Wash. – June 3, 2021 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced that it has achieved [Amazon Web Services (AWS) Digital Workplace Competency](https://aws.amazon.com/products/end-user-computing/partner-solutions/?partner-solutions-cards.sort-by=item.additionalFields.partnerNameLower&partner-solutions-cards.sort-order=asc) status. This global designation recognizes that Auth0 provides identity and access management (IAM) and deep expertise in supporting customers that need to effectively support their remote workers and business continuity with end-to-end digital workplace solutions in the cloud.

AWS Digital Workplace Competency Partner solutions free end users from the office by allowing them to work securely on any device, from anywhere, at any time. Achieving the AWS Digital Workplace Competency differentiates Auth0 as an AWS Partner Network (APN) member that provides specialized demonstrated technical proficiency and proven customer success with specific focus on helping customers deploy digital workplace services on AWS. To receive the designation, AWS Partners must possess deep AWS expertise and deliver solutions seamlessly on AWS.

“The onset of COVID-19 has accelerated the transition to digital services and remote work, and identity is an essential role in that shift,” said Eric Snyder, Senior Director of Business Development at Auth0. “As a remote-centric company since 2013 and a leader in helping organizations across all industries secure their valued assets and data more firmly, we are proud to achieve AWS Digital Workplace Competency status and are dedicated to helping companies achieve their technology goals by leveraging the agility, breadth of services, and pace of innovation that AWS provides.”

AWS is enabling scalable, flexible, and cost-effective solutions from startups to global enterprises. To support the seamless integration and deployment of these solutions, AWS established the [AWS Competency Program](https://aws.amazon.com/partners/competencies/) to help customers identify Consulting and Technology AWS Partners with deep industry experience and expertise.

Auth0 is an AWS Partner in the APN and recently joined the [AWS Public Sector Partner (PSP) program](https://auth0.com/blog/auth0-joins-the-amazon-web-services-public-sector-partner-program/). Additionally, the company achieved the [AWS Security Competency](https://auth0.com/blog/auth0-achieves-aws-security-competency/) status in 2020 and provides AWS customers with seamless access to [professional services in AWS Marketplace](https://auth0.com/blog/auth0-supports-the-launch-of-professional-services-in-aws-marketplace/). For more details, please see [Auth0’s AWS integration options](https://auth0.com/docs/integrations/aws).

[Auth0, recently acquired by Okta](https://auth0.com/blog/okta-acquisition-announcement/), provides a modern identity platform that helps organizations meet the security, privacy, and convenience needs of their users. Please visit [Auth0 Identity Platform](https://auth0.com/identity-platform) to learn more.

<include src="asides/AboutAuth0" />
### Media Contacts
Global Communications 
Auth0 
[press@auth0.com](mailto:press@auth0.com) 

Matter for Auth0 
[auth0@matternow.com](mailto:auth0@matternow.com)

Auth0 Achieves AWS Digital Workplace Competency Status

joey devilla headshot 900px

I’m a Senior Developer Advocate at Auth0, and I like to work on various technologies. I’ve developed software for all sorts of platforms, from CD-ROM and the PalmPilot to my current area of focus, mobile phones, IoT devices, and AI. When I’m not looking for strange new platforms to write software for, I’m playing a strange old instrument — the accordion!

Senior Developer Advocate

Joey deVilla

Here’s an easy-to-understand analogy to help your non-technical friends and customers understand public keys and private keys, and how they relate to cryptography and digital signatures.

**If you work in cybersecurity or any computer-related field, sooner or later, you’ll have to explain public-key cryptography and digital signatures to non-technical people.** With the recent rise of remote work and stories about system breaches, computer security has become a topic of discussion even among laypeople.

After trying to explain public-key cryptography and digital signatures to some clients with varying degrees of success, I wanted to develop an analogy that explained them and was easy to remember. I’ve found that even techies get confused by the formal definitions, and many non-technical explanations just seem unsatisfying.

That’s when I stumbled upon [Panayotis Vryonis’](https://twitter.com/vrypan) article, [*Public-key cryptography for non-geeks*](https://blog.vrypan.net/2013/08/28/public-key-cryptography-for-non-geeks/). It became my go-to analogy until my computer science professor, [Dr. Robin Dawes](http://research.cs.queensu.ca/home/dawes/) pointed out a flaw. I refined it with his help, and a suggestion from Matthew Ernest, and the result is below. I hope you find it helpful when trying to explain these concepts to anyone!


## The Box

Imagine a box with a special lock, as pictured below:

![Photo of a box with a lock. There is a key inserted into the lock. Caption: "The box has a lock with three positions: Locked (at the 9:00 position), unlocked (at the 12:00 position), and locked (at the 3:00 position)."](https://images.ctfassets.net/23aumh6u8s0i/4nm7EvXpqVqMxfOPkjUlXe/bca6b7d8d0a00658045dd4f3fd0a5c7f/the_box_has_a_lock_with_three_positions.png)

The lock has three positions:

1. When the lock is at the “9:00” position, the box is locked, and its contents are inaccessible.
2. When the lock is at the “12:00” position, the box is unlocked, which means you can open it and view its contents.
3. When the lock is at the “3:00” position, the box is locked, and its contents are inaccessible.

In order to avoid wandering into endless “What if...?” tangents, assume that it’s prohibitively costly to pick the lock or break the box.


## The Keys

There are two kinds of keys that work with the box’s lock.

### The private key

The first kind of key belongs to you, and only you. You don’t share it with anyone else, which is why it’s called the **private key**. You might make a backup copy in case of emergencies, but you keep it in a safe place that only you know.

![Photo of a single key. Caption: "You keep the private key to yourself."](https://images.ctfassets.net/23aumh6u8s0i/2PJXCaqzggdgTpN4FSm8Qj/4a1228e2e8a6a46ad103c01ffd197e58/you_keep_the_private_key_to_yourself.png)

The private key fits the lock, but it has a particular limitation: it can only turn *clockwise*.

![Photo of the box with lock and key. An arrow indicates that the key is being turned clockwise. Caption: "The private key only turns clockwise."](https://images.ctfassets.net/23aumh6u8s0i/qqPVi6JTc2HOW4SuE4sEj/8fcd841021e55b659a3c5b92ad9b2da2/the_private_key_only_turns_clockwise.png)

### The public key

You treat the second kind of key very differently. Unlike the first key, you’ve made many, many copies of these keys. You’ve given them to everyone you know, and even people you don’t know. You’ve left them in as many public places as you could reach: restaurants, stores, busy streets, dark alleys, and any place you happened to pass through. You’ve even left them in other towns, and even other countries! Because of the way you treat this key, it’s called the **public key**.

![Photo of hundreds of keys hanging on hooks on a wall. Caption: "You hand out copies of the public key freely."](https://images.ctfassets.net/23aumh6u8s0i/2LTNf9JxfjDuB4rMZyM7K6/4a3a6264b81bf2b90efaffe469d3406c/you_hand_out_copies_of_the_public_key_freely.png)

Like the private key, public keys also fit the lock, and they also have a particular limitation — but in the opposite direction. They can only turn *counterclockwise*.

![Photo of the box with lock and key. An arrow indicates that the key is being turned counterclockwise. Caption: "The public key only turns counterclockwise."](https://images.ctfassets.net/23aumh6u8s0i/6QVsGSSoLuNdRgpfHznh6H/b5f42c68a9d5aa9e322e898cac14aeb3/the_public_key_only_turns_counterclockwise.png)


## How They Work Together

The lock, private key, and public keys work together to produce these interesting outcomes:

* If the box is locked with a public key, only the private key can unlock it.
* If the box is locked with the private key, only a public key can unlock it.

The keys are designed so that you can’t use one key to figure out how to make the other key.

We can use the box and keys to create two useful kinds of secure communication:

1. I can send you a secret message.
2. You can send me a message with proof that you (and not some impostor) sent it and that it wasn’t altered *en route*.

Let’s take a closer look at each of these kinds of secure communication.

## Sending Secret Messages

Suppose I wanted to send you a message that I wanted only you to read. We have enemies in common who’d love nothing more than to know what’s in the messages I send you.

We each have a cadre of minions to deliver our messages. We trust them... to a limited extent. It would be all too easy for our foes to intercept our messages through force or bribery. 

There must be a way to send messages to you secretly, and that’s where the box comes in. I can use the box to send the message so that no one but you can read it. 

You have the only private key. Everyone else has at least one of the public keys because you’ve been giving them away like candy. 

I put my message in the open box. Since it’s open, it’s unlocked, which means the lock is at the “12:00” position. 

I use one of the many copies of the public key that I own to lock it, turning it counterclockwise from the unlocked “12:00” position to the locked “9:00” position.

![Photo of the box with lock and key. An arrow indicates that the key is being turned counterclockwise. Caption: "I lock the message in the box with the public key..."](https://images.ctfassets.net/23aumh6u8s0i/3WnNKlXN7MC0BfDdEU8GyX/2bcc1521f829c80ff548cf7234078bba/i_lock_the_message_with_public_key.png)

The message is now ready for a minion to deliver to you.

I’m not worried that my minion or anyone other than you will be able to read the message while it’s in transit. Even though anyone can easily find the public key, they can’t use it to unlock the box. Only the private key can unlock the box if it’s been locked with the public key.

When you receive the box, you use the private key to unlock it, turning the key clockwise from the “3:00” position to the “12:00” position.

![Photo of the box with lock and key. An arrow indicates that the key is being turned clockwise. Caption: "...and you unlock it with the private key."](https://images.ctfassets.net/23aumh6u8s0i/2kwG5ogtYDYCkDtjC0MqgN/75f2cb365ea0014a0af58a7dbc90c481/you_unlock_it_with_the_private_key.png)

In summary: to send you a secret message, I use a public key to lock the message so nobody can read it, and you use a private key to unlock the message so that you can read it.

This is the general idea behind public-key encryption: **encrypt with the public key, decrypt with the private key.**

## Signing Messages

The “secret messages” use case for the box and private and public keys is intuitive: anyone with a public key can lock a message, but only the holder of the private key can unlock it.

There’s another way to use the box and keys: you can lock a message with the private key, which anyone with the public key can unlock. What could a possible use case there be for a system where anyone can unlock the box?

Suppose one of our common enemies has been trying to break up our alliance and that I’ve been receiving very hurtful messages that appear to have come from you. (I’ll leave the content of those messages to your imagination.)

That enemy has either been sending fake messages or has been intercepting and altering your real ones. There has to be a way to package a message in order to prove that it’s actually from you!

There *is* a way: the box!

In this scenario, you put your message in the open box. Since it’s open, it’s unlocked, which means the lock is at the “12:00” position. 

Using the private key, you “sign” the message by locking it, turning the key counterclockwise from the “12:00” position to the “9:00” position.

![Photo of the box with lock and key. An arrow indicates that the key is being turned clockwise. Caption: "You 'sign' the message with the private key..."](https://images.ctfassets.net/23aumh6u8s0i/1U2aOr7mKgMtGdZM8lPLWT/82ff89d7160d93b04fff8ac635fd41d7/you_sign_the_message_with_the_private_key.png)

One of your minions delivers the box to me.

Since you locked the box with the private key, anyone can unlock it with any one of the many public keys you have distributed. Our common enemy, knowing that this message is in transit, could intercept it and replace your invitation to tea with a “top ten” list of very cutting insults that would surely dissolve our alliance.

The problem with the enemy’s plan is that it won’t work. Intercepting and altering the message means that they would have to do one of two things before forwarding the box to me.

1. They could leave the box unlocked. Since the box is supposed to arrive locked, this is an obvious sign that the message may have been tampered with.
2. They could lock the box. They would have to do it with a public key, which means that only the private key can unlock it. I wouldn’t be able to unlock the box with the only key I had — the public key — which would lead me to conclude that someone had unlocked the box before I did.

If the box arrives at my doorstep and...

* It’s locked
* I can unlock it with the public key

...then, I can be assured that the message came from you and wasn’t changed *en route*.

![Photo of the box with lock and key. An arrow indicates that the key is being turned counterclockwise. Caption: "...and I verify your 'signature' with the public key."](https://images.ctfassets.net/23aumh6u8s0i/4Fax8BanX5Qts7KJzW7166/b4dc34b169f6eca961c8d8f3c7452af4/i_verify_your_signature_with_the_public_key.png)

In summary: to send me a message with proof that you are the sender, you use the private key to lock the message. You’re the only person with the private key, and only a public key can unlock messages locked with the private key. If one of the public keys can unlock that message, I know that it came from you.

This is the general idea behind digital signatures: **sign with the private key, verify with a public key.**

## How About Sending a Message That’s Both Secret *and* Signed?

You might think that sending a message that is both secret and signed is paranoid. I would answer by saying, “Paranoia is the ***mistaken*** impression that people are out to get you.”

Suppose I wanted to send you a secret signed message. I could do it with two boxes:

1. A smaller box, which I own. It will prove that I sent the message. I have the private key for this box, and you have one of its public keys.
2. A larger box, which you own. It will keep the message secret. You have the private key for this box, and I have one of its public keys.

I would lock the message in my smaller box using my private key and then lock it in your larger box using your public key.

When you receive the delivery, you will unlock your larger box first, using your private key. This would reveal my smaller box inside, which you would unlock with my public key.


## It’s Not Keys and Boxes, but Numbers and Algorithms

Of course, we’re not really dealing with boxes, keys (at least the kind that goes into locks), or minions. Here’s a list of elements in these stories and their real-world equivalents:

* **The message**: Anything that you’d want to send that can you can view or edit with a computer. It could be text, one or more pictures, an audio or video recording, a database, or even an application. As far as the computer is concerned, messages are just a long series of numbers.
* **The private and public keys**: Very large numbers that are used in a lengthy math process to encrypt, decrypt, sign, and verify messages.
* **The box**: An algorithm that takes the message and keys and performs the math process to encrypt, decrypt, sign, and verify messages.
* **Minions**: The way in which the message is sent. This could be the internet but could just as easily be an actual minion, such as an unsuspecting summer intern with a USB key.

In the alternate universe where messages are sent with boxes and keys, everyone would have their own set of boxes with their own private keys, as well as copies of other people’s public keys. In the real world, we run applications that run public-key encryption and digital signature algorithms to secure our messages. We still use public and private keys in the real world; they’re just digital.

How to Explain Public-Key Cryptography and Digital Signatures to Anyone

Lucy McGrath

Lucy is VP, Privacy at Auth0. She's a lawyer and global data privacy expert with diverse experience working with some of the world's leading media and technology companies. As Auth0’s VP, Privacy, she leads global data privacy strategy and is driven by a passion for further embedding privacy-by-design and continuing to shape our culture of privacy that starts with finding the humans that we impact every day.

VP, Privacy

Enabling Auth0 customers to comply with dynamic privacy requirements

At Auth0, our continuing mission is to secure the world’s identities so innovators can innovate. The core to delivering this mission is trust, including Auth0’s commitment to security and privacy.

Following our post in June, we are pleased to announce we have updated our Data Processing Agreement (DPA) to include the new [Standard Contractual Clauses](https://auth0.com/blog/auth0-statement-on-new-standard-contractual-clauses-issued-by-european-commission/) (“new SCCs”) to support our customers with European users. We’ve also made changes to our Subscription Agreement, including adding a direct reference to our updated DPA, and clarifying some of the language related to our personal data processing.

The new clauses and information about the changes can be found here [auth0.com/legal](http://auth0.com/legal).

All new customers can take advantage of these new terms immediately.

For existing customers – your Tenant Administrators will receive a notification about how you can transition to the updated DPA and new SCCs. If you have any questions or have not received this notification, please contact your account manager, or if you are a self service customer, reach out to the Self Service Team at [selfserviceteam@auth0.com](mailto:selfserviceteam@auth0.com).

At Auth0, we know that privacy regulation is complex and changing rapidly. We are working to help our customers respond to this dynamic and fast-paced environment by continuously improving the resources and information we make available.

Auth0 Publishes Documentation to Help with New Standard Contractual Clauses

Gartner Peer Insights Customers’ Choice distinction based on feedback and ratings from enterprise users

**BELLEVUE, Wash. – June 22, 2021 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced it has been named by Gartner Peer Insights as a [Customers’ Choice for Access Management](https://auth0.com/resources/ebooks/gartner-peer-insights-ciam). Per Gartner, “Access management (AM) applies to technologies that use access control engines to provide centralized authentication, single sign-on (SSO), session management, and authorization enforcement for target applications in multiple use cases (e.g., B2E, B2B, and B2C).”

Auth0 believes the goal of Gartner Peer Insights is to help IT leaders make more insightful purchase decisions and help technology providers improve their products by receiving objective, unbiased feedback from their customers. The Customers’ Choice distinction is reserved for the vendors that are rated the most highly by their customers and who also receive review coverage across industry verticals, company sizes, and deployment regions. 

Those closely involved with implementing identity know how complex it can be. Auth0’s extensible platform, in combination with its deep customer-centric approach, can help enterprises address their identity needs quickly and securely. Auth0’s impact on its enterprise customers are well-expressed in these reviews: 

* “Auth0 has been an easy platform to integrate into our different authentication platforms and experiences. Their product line continues to mature, providing more layers of security on top of supporting the industry standards in the authentication.” &mdash; [VP of Enterprise Architecture, Media industry](https://www.gartner.com/reviews/market/access-management/vendor/auth0/product/auth0-platform/review/view/3535167)
* “Auth0 comes with great features out-of-the-box. We went live easily with Auth0 as our Identity Provider. The platform/vendor does not just support us in a technical angle, but also understanding our user journey and sharing their experience (with other clients) and what approaches to take to minimize risk and even enhance user experience during the migration.” &mdash; [VP, Core Product Development, Retail industry](https://www.gartner.com/reviews/market/access-management/vendor/auth0/product/auth0-platform/review/view/1363099 )
* “The experience of implementing Auth0’s solution on top of a legacy system was excellent. We found a way to solve each and every problem we faced in a robust and sustainable way.” &mdash; [Product Owner, Transportation industry](https://www.gartner.com/reviews/market/access-management/vendor/auth0/product/auth0-platform/review/view/1390492) 

Additional reviews from satisfied enterprise users can be accessed on the [Auth0 Peer Insights](https://www.gartner.com/reviews/market/access-management/vendor/auth0) page. 

 
“Being named a 2021 Customers’ Choice for Access Management represents the commitment we have to our customers to provide a world-class product with an outstanding customer experience to support it,” said Eugenio Pace, CEO, and co-founder of Auth0. “We continue to innovate and execute our product roadmap to meet the needs of our customers and are grateful for the feedback they share with us on Gartner Peer Insights.”

For more information on this Customers’ Choice distinction, please review Auth0’s [Gartner’s Voice of the Customer report](https://auth0.com/resources/ebooks/gartner-peer-insights-ciam). 

## Gartner Disclaimer

Gartner Peer Insights reviews constitute the subjective opinions of individual end users based on their own experiences and do not represent the views of Gartner or its Affiliates.

The GARTNER PEER INSIGHTS CUSTOMERS’ CHOICE badge is a trademark and service mark of Gartner, Inc., and/or its affiliates and is used herein with permission. All rights reserved. Gartner Peer Insights Customers’ Choice constitutes the subjective opinions of individual end-user reviews, ratings, and data applied against a documented methodology; they neither represent the views of nor constitute an endorsement by Gartner or its affiliates.

Gartner does not endorse any vendor, product, or service depicted in its research publications and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner’s research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all warranties, express or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.

Gartner Peer Insights’ Voice of the Customer’: Access Management, Peer Contributors,13th April 2021.


<include src="asides/AboutAuth0" />
### Media Contacts
Global Communications 
Auth0 
[press@auth0.com](mailto:press@auth0.com) 

Matter for Auth0 
[auth0@matternow.com](mailto:auth0@matternow.com)

Auth0 Recognized as a 2021 Gartner Peer Insights Customers’ Choice for Access Management

Auth0 is preparing new documentation for its customers with European users.

At Auth0, our continuing mission is to secure the world’s identities so innovators can innovate. The core to delivering this mission is trust, including Auth0’s commitment to security and privacy.  

Auth0 welcomes the new Standard Contractual Clauses (“new SCCs”) issued by the European Commission, and is happy to see that they reflect a broader set of transfer scenarios and the European Court of Justice’s (ECJ) decision in the Schrems II case last year. 

As required by the European Commission’s decision, Auth0 will begin using the new SCCs for new customers on or before September 27, 2021 (with a goal of late July / early August). Once we have a generally available version of a new Data Processing Addendum (DPA) that incorporates the new SCCs, we will also be able to make this available to existing customers.

Once we have had an opportunity to consider final guidance on the new SCCs to be provided by the European Data Protection Board, we will update this post to summarize the transition program, including issues such as:

* Whether we anticipate making changes to our form of Subscription Agreement
* What changes we will be making to our DPA (“new DPA”)
* How existing customers will be able to transition to the new DPA and new SCCs 

During this transition period, we will continue to adhere to existing contractual obligations set out in the existing Standard Contractual Clauses (“old SCCs”) that are available [here](https://auth0.com/legal).

Lucy McGrath
VP, Privacy, and Data Protection Officer
Auth0, Inc 

Auth0 Statement on New Standard Contractual Clauses issued by European Commission

Hear from Auth0 customers how CIAM supports scalability and drives transformation

With people not only working but also shopping, banking, socializing, and receiving healthcare via digital platforms, identity management has become not just [a competitive advantage](https://auth0.com/blog/why-auth0-b2b-federation-is-your-secret-weapon-for-enterprise/) but a requirement. Organizations across industries need to manage identity in a secure, scalable, and seamless way. Part of the challenge is that identity is disseminated across multiple applications and devices, effectively making [identity itself the perimeter](https://auth0.com/resources/whitepapers/identity-perimeter). To satisfy user expectations and meet business needs in this new ecosystem, organizations are embracing third-party [identity-as-a-service (IDaaS)](https://auth0.com/blog/what-is-idaas/) solutions like Auth0.

At the core of the IDaaS space is [identity and access management (IAM)](https://auth0.com/blog/what-is-iam/), which involves authenticating users’ identities and controlling their access to online resources. A key enabler for organizations undergoing digital transformation, IAM encompasses:

* **Authentication**, or how you determine whether someone’s claimed identity matches their actual identity. [Multi-factor authentication (MFA)](https://auth0.com/multifactor-authentication) is increasingly recognized as the standard method of authenticating identity.
* **Authorization**, or the allocation of permissions to individual users or types of users. For instance, if an administrator leaves your organization, you can revoke their permissions; you can also add users or expand permissions according to your needs.

Typically, organizations have to manage identity for different types of users: customers, employees, and enterprise partners. Because each type of user has different priorities and expectations of your platform, each type demands its own carefully calibrated balance of convenience, privacy, and security. For example, your employees and contractors will probably put up with time-consuming, headache-inducing processes to get paid and access other benefits because they have few alternatives. Customers, on the other hand, have lots of choices, and if you can’t deliver a swift, effortless login experience, they’ll find one of your competitors who can.

[Customer identity and access management (CIAM)](https://auth0.com/blog/what-is-ciam/) platforms are built to optimize the balance between convenience, privacy, and security for each type of user. With the right CIAM platform, you can:

* Deliver a secure and frictionless login experience
* Guide compliance with data privacy laws
* Protect data assets against malicious intrusion
* Derive more specific, meaningful insights from customer data

Using four Auth0 customers as examples, let’s explore how CIAM can help you allocate resources more effectively, secure identity across your entire infrastructure, and deliver more value to your users. 

In [our new whitepaper](https://auth0.com/resources/whitepapers/ciam-transformation), we delve more deeply into each of these customer stories and suggest strategies for choosing and implementing the right CIAM platform. If you find this content useful, be sure to [download the full whitepaper](https://auth0.com/resources/) or check out some of our other [identity resources](https://auth0.com/resources/).

## Enable Expanding Use Cases

With 170 superstores across the UK, furniture retailer [Dunelm](https://auth0.com/case-studies/dunelm/) describes themselves as “product-obsessed.” In 2018, they began a massive digital overhaul of their existing internal infrastructure in favor of a modern, flexible cloud data platform that would transform the digital experience for their customers, employees, and external vendors.

> A key aspect of Dunelm’s [buy-rather-than-build](https://auth0.com/resources/whitepapers/build-vs-buy-for-b2b-evaluating-identity-management) approach to their digital infrastructure was replacing their in-house identity system with Auth0. This move has saved them significant time, effort, and staffing costs.

Initially, Dunelm planned to use Auth0 for straightforward customer authentication, but they soon incorporated the service into multiple business operations serving customers, employees, and partners.

From here, Dunelm plans to further expand its Auth0 use case and add more customer value through personalized, frictionless shopping experiences.

![CIAM](https://images.ctfassets.net/23aumh6u8s0i/5rQhP0U1KzmX0aJfsAuZh3/dbc28afb39fa3f557119114372a086bc/CIAM_ecommer_e_recorte1.png)

## Centralize Identity across Platforms

UK-based conditioning brand [Gymshark](https://auth0.com/case-studies/gymshark/) is one of the most recognizable functional training apparel brands in the world, with a social media following of 10+ million and customers in over 170 countries. During the development process for their conditioning app, Gymshark realized they needed a centralized authentication solution that worked across both their online and mobile applications. They had one major priority: a seamless customer experience.

While they briefly considered building their own solution, Gymshark ultimately decided to entrust Auth0 with their CIAM needs. With Auth0 handing IAM for customers and employees, Gymshark can focus on creating apps and other technology that advances their core mission. Auth0 is a critical enabler for Gymshark’s tech-powered, user-centric future. 

## Replatform and Eliminate Legacy Code

[Kiva](https://auth0.com/case-studies/kiva-implements-auth0-rules-mfa/) is an international crowdfunding nonprofit focused on expanding financial access to help underserved communities around the world thrive. Kiva had built their own authentication solution in-house over time, adding functionality when they needed it to meet business requirements, but they knew they needed to replatform to a microservice architecture with a dedicated identity service to support future growth.

With Auth0, Kiva was able to eliminate more than 22,000 lines of legacy code, freeing up engineering resources considerably and allowing the company to focus its efforts on core business functions rather than on managing identity. Investing in CIAM now also prepares Kiva for successful mobile implementation, which is key to their growth strategy. The bottom line: CIAM enables Kiva to shift and scale securely and with minimal friction. 

## Achieve Smooth Scalability

[TVNZ](https://auth0.com/case-studies/tvnz-cs/), New Zealand’s state-owned, commercially funded broadcaster, reaches more than two million New Zealanders every day. TVNZ also offers OnDemand streaming services that reach up to half of the country’s five million citizens with 2.5 million registered accounts. At a moment in history when a trustworthy news source is more important than ever, the broadcaster needed a CIAM partner who could help them rapidly scale, migrate users, and maintain their reputation.

When they signed on with Auth0 to handle authentication for their OnDemand streaming web and mobile platforms, TVNZ was faced with the task of migrating data for 2.5 million accounts. To avoid forcing all of their customers into a password reset, TVNZ opted for an automatic migration in which customer data was migrated only when a person logged in.

But another challenge lay ahead. TVNZ’s digital platforms faced unprecedented demand during the pandemic lockdown, with weekly streaming rates jumped by 50% and tens of thousands of users logging in more or less simultaneously to watch Prime Minister Jacinda Ardern’s daily addresses. With Auth0 handling their identity needs, TVNZ experienced “no real issues,” reported [Michael Robinson](https://www.linkedin.com/in/faceleg/?originalSubdomain=nz), Head of Digital Capability at TVNZ. Entrusting CIAM to Auth0 allows TVNZ to stay on mission and maximize the value of their development resources.

![CIAM](https://images.ctfassets.net/23aumh6u8s0i/1fjzGfRtdlHhMCsxgeDZdp/86223bf45b185cfa9ddee428eefa28b6/CIAM_ecommerce_recorte2.png)

## What Challenges Could CIAM Solve for You?

Is your login process so painless that customers barely register it? Do your customers trust you to handle their personal information? Do you have all the insights into customer behavior you need? Are you confident that your customer identity solution can scale in response to escalating demand without lags or outages? Unless the answer to all of these questions is an unambiguous “Yes!” (in which case, nice work!), investing in CIAM is a sound decision.

Ask yourself what your team could accomplish if they didn’t have to worry about managing customer identity and access. For a closer look at the customer stories we’ve summarized here, and to learn more about how CIAM can enable digital transformation at your organization, [download the whitepaper](https://auth0.com/resources/whitepapers/ciam-transformation).

<include src="asides/AboutAuth0" />

Four Ways CIAM Empowers Your Business

Nearly zero downtime now standard for Enterprise customers

**BELLEVUE, Wash. – March 3, 2021 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced its 99.99% availability service level agreement (SLA) guarantee for authentication services across all [Auth0 cloud](https://auth0.com/cloud) deployments&mdash;shared and dedicated environments. With private cloud deployments already supporting ‘four 9s’ availability, this SLA now extends to Auth0 public cloud deployments, making 99.99% a reality for all enterprise customers. 

Auth0 authenticates and authorizes more than four billion logins per month, demonstrating the scale at which its global customers operate. Whether authenticating consumers, business partners, or employees, reliability and uptime are crucial for every application&mdash;even more so for those with a continuously high volume of traffic. Any kind of downtime in high-demand applications can severely impact revenue, productivity, and brand perception. 

“We deeply understand how critical Auth0’s identity management platform is for the success of our customers’ businesses,” said Shiv Ramji, Chief Product Officer. “The 99.99% availability guarantee across all cloud deployments gives current, and future customers added reassurance of superior reliability and security, and an optimal end-user experience for all of their applications.” 

Auth0 continues to invest in improving the resilience of its platform and the reliability of its application services. While 99.99% is now a guarantee for customers on Auth0’s enterprise plan, platform uptime across Auth0’s U.S. public cloud environments in the past 12 months has been 99.999%+, or five 9s, as seen here: [https://status.auth0.com/](https://status.auth0.com/). 

More information about this reliability standard and Auth0’s cloud deployment options can be found here: [https://auth0.com/cloud](https://auth0.com/cloud). 

<include src="asides/AboutAuth0" />
### Media Contacts
Auth0 Global Communications 
[press@auth0.com](mailto:press@auth0.com) 

Matter for Auth0 
[auth0@matternow.com](mailto:auth0@matternow.com)

Auth0 Guarantees 99.99% Availability on Public Cloud

jonathan-keen

I head up the legal function for Auth0 in the EMEA region (Europe, Middle East & Africa). I advise the business on commercial, IP, technology and data protection related legal matters - helping to ensure Auth0's interests are protected and that we remain ahead of the curve in a very dynamic legal and regulatory environment.

Associate General Counsel

Jonathan Keen

Making sense of regulatory uncertainty in Brexit impact planning

Auth0 understands the regulatory uncertainty and operational challenges that the United Kingdom (UK) 's exit from the European Union (EU) may be causing for our customers. The intention of this guidance note is to inform and reassure so that Auth0 is one less supplier that you need to worry about in your Brexit impact planning. 

### Q: What does the EU-UK Brexit deal mean for transfers of personal data?

**A:** Further to the recent announcement of the EU-UK Trade and Cooperation Agreement (the "Brexit Deal"), it's business as usual in terms of Auth0's post-Brexit data flows, which means the positions described in the blog post of 20 November 2020 (below) remain accurate. 

The Brexit Deal allows for the continued free flow of personal data between the EU and the UK for six months or until an EU adequacy decision comes into effect. During this period, it is recommended that UK organizations still put in place appropriate safeguards with EU organizations that transfer personal data to them, which will include the EU Standard Contractual Clauses (SCCs). 

Auth0 customers without a Data Processing Addendum (DPA) in place are able to countersign Auth0's standard DPA, which incorporates the SCCs. A pre-signed version of the DPA is available here: [www.auth0.com/legal](http://www.auth0.com/legal). 

<div class="alert alert-info alert-icon">
 
 REMINDER: 
 As described in more detail in the main blog post below, the primary location in which Auth0 will conduct its core processing of your customer data is chosen by the customer when they create an Auth0 tenant. For our UK and EU customers, this is almost always the AWS EU region, which is made up of a primary data center in Frankfurt (Germany) with failover to a second data center in Dublin (Republic of Ireland). This means if a customer selects the EU region, then all data processing activity by Auth0 will take place within the EU aside from a few limited exceptions (Management Dashboard & Customer Support, as covered in more detail below). 
</div>

### Q: Hasn't the UK already left the EU? 

**A:** The UK officially left the EU on 31 January 2020 but then entered into a transition period, during which the UK would remain aligned with all existing EU law. In short, during the transition, nothing has really changed, and EU laws must still be followed. This transition period ends on **31 December 2020**, unless it is extended to allow negotiations between the UK and the EU to continue. 

### Q: What does this mean for my customer data being processed by Auth0? 

**A:** UK and EU privacy laws only apply to **personal identifiable data** or "**personal data**." The UK currently bases its own data privacy laws on the EU's General Data Protection Regulation (GDPR), but little is known about its post-Brexit plans for data privacy. 

For GDPR purposes, our customers are data controllers, and Auth0 is the data processor, which means the customer is responsible for managing their own personal data flows and ensuring they have valid transfer mechanisms in place for all international transfers of such data. 
 
### Q: So, where does Auth0 process its data? 

A: It depends on which AWS region our customers have chosen to host their Auth0 tenants. 

The primary location in which Auth0 will conduct its core processing of your customer data is chosen by the customer in their Auth0 Sales Orders and when they create an Auth0 tenant. For our UK and EU customers, this is almost always the AWS EU region, which is made up of a primary data center in Frankfurt (Germany) with a failover to a second data center in Dublin (Republic of Ireland). This means that aside from a few limited exceptions (covered below), if a customer selects the EU region, then all data processing activity by Auth0 will take place within the EU. 

_**Limited Exceptions**. As disclosed in our contracts with our customers and described in more detail below, Auth0 conducts some limited processing of personal data outside the EU. Please note that for both examples, the transfers will be: (i) within the customer's control; and (ii) covered by Auth0's intra-group Standard Contractual Clauses (Model Clauses)._ 
 
**Management dashboard:** For public cloud customers, Auth0 may temporarily process tenant data in the US for display on the Auth0 Management Dashboard. Dashboard web servers are located in the US. This data is not automatically transferred but is only served up when a tenant dashboard administrator requests it for viewing. When this occurs, the data itself is ephemeral, is not permanently stored on our systems, is encrypted during transit, and is only used to display information on the dashboard to the requesting administrator. 

This data can include any information that can be viewed through the Auth0 Management Dashboard, which typically includes the user's e-mail address or other UID and basic metadata about that user, such as creation date, last login time, user agent, and the identity provider used.

_**The dashboard exception does not apply to the Private Cloud.**_ For customers on Auth0's private cloud deployment, all dashboard processing occurs within the AWS region the customer has selected for its tenant for private cloud customers, e.g., if the customer selects the EU region, then dashboard processing will remain in the EU.

**Support tickets and logs:** If a customer includes personal data in a support ticket, then this may be viewed by Auth0 support personnel outside the EU. In order to resolve the ticket, Auth0 personnel may review activity logs to help understand the underlying error. Personal data in those logs typically consists of a user ID (e.g., e-mail) and IP addresses.

### Q: What does Brexit mean for our existing European customers? 

**A:** In terms of international data transfers and data processing locations, it's business as usual. If you are an Auth0 customer based in the EU and have selected the AWS EU (Frankfurt, with failover to Dublin) as your deployment region, then no personal data will be exported to the UK via Auth0 in the provision of Auth0's core services. 

_Support Service Qualifier_. If an Auth0 customer based in the EU chooses to insert personal data into a support ticket (as described above) or share personal data with an Auth0 support operative based in the UK, then a transfer of personal data from the EU to the UK will occur. Please note, however, that such a transfer will be: (i) within the customers' control; and (ii) protected by Auth0's intra-group Standard Contractual Clauses (Model Clauses). 

### Q: What does this mean for our UK customers? 

**A:** The situation remains fluid in terms of the status the EU will afford the UK (and vice versa) with respect to transfers of personal data. If the EU recognizes that the UK has a suitably robust data privacy regime and makes an **adequacy decision** in its favor (as it has done with Japan and Argentina), then transfers of personal data from the EU to the UK will be permitted, and data will be able to flow freely between the two regions. 

_**UK to EU transfers of personal data**_

Currently, the UK's data privacy regulator - the ICO - has confirmed that it will recognize the EU as a region with adequate protections in place for exporting the personal data of UK nationals, i.e., UK to EU transfers of personal data are permitted. 

This may change if the EU does not reciprocate and grant an adequacy decision in the UK's favor. Given the UK's post-Brexit data privacy regime is currently unknown, no one can say with any certainty what alternative transfer measures the UK may require for the export of UK personal data. It's reasonable to imagine such a transfer mechanism might be similar to the EU's Standard Contractual Clauses (Model Clauses). 

### Q: What can Auth0's UK customers do to mitigate against personal data flow uncertainty?

**A:** If you are an Auth0 customer without a DPA in place with Auth0, you may want to consider countersigning Auth0's current DPA - which attaches the GDPR Standard Contractual Clauses / Model Clauses covering the transfer of personal data to a third party country. Auth0 has published a pre-signed Data Protection Addendum (DPA) at [www.auth0.com/legal](https://auth0.com/legal). 

UK customers may wish to countersign the DPA as follows: 

1. If a customer has **end-users** that are **EU citizens**, in order to ensure a transfer mechanism is in place for the potential **EU to US transfers of personal data** under the dashboard and support ticket exceptions described above;

2. If a customer has **UK end-users only**, in order to put a preemptive post-transition period transfer mechanism in place for the UK to EU transfers of personal data. Such measures may not be necessary if the UK continues to recognize the EU as an approved country for personal data exports. Please note that we do not know what form, if any, the UK's standard contractual clauses will take for exports of UK personal data to third parties. There is no guarantee that the Standard Contractual Clauses attached to our DPA will be sufficient to cover such transfers. Regardless, we will be following developments and will make updated Standard Contractual Clauses or their equivalents available as the situation becomes more certain.

### Q: What if UK data sovereignty is an absolute requirement? 

If you are a UK Auth0 customer with UK only end-users, and it is essential that minimal personal data leave the UK, then Auth0's [Private Cloud](https://auth0.com/docs/private-cloud) deployment option may provide a solution. 

With one of Auth0's Private Cloud deployments, all customer personal data is ring-fenced on the AWS data center that the customer chooses to create its Auth0 tenants. So if a customer chooses the AWS London (UK) region as its desired location to host its Auth0 Private Cloud deployment, then there will be no transfers of customer personal data as part of the core Auth0 services from the UK to either the EU or the US. Please note that even on Auth0 Private Cloud, there may still be some extra-UK transfer of personal data should an Auth0 customer choose to include personal data in a support ticket (as described in the exceptions listed above) or otherwise share such data with an Auth0 customer support operative as part of our support services, e.g., by sharing your screen.

For more information with respect to Auth0 Private Cloud, please see the following link: [https://auth0.com/docs/private-cloud](https://auth0.com/docs/private-cloud). 

### Q: Aside from data privacy, will Brexit have any other impacts on Auth0's wider operations? 

**A:** Not that we envisage. 

Auth0 has a rapidly growing presence of commercial and technical staff on the ground throughout the EU member states who will continue to service our European customers. Our UK customers will continue to be looked after by our UK personnel. Operationally we are well prepared for any outcome of the UK and EU's Brexit negotiations, including a so-called "No Deal" Brexit. Auth0 services for both our UK and EU customers will not be impacted. 

### We're keeping our ears to the ground. 

Auth0 will continue to monitor Brexit developments closely, particularly in relation to data privacy arrangements. We will provide updates as and when and significant developments are announced. 

<include src="asides/AboutAuth0" />

Auth0 Customers: Your Brexit Questions Answered

Giving your customers good news can make it less likely you’ll have to give them bad news later.

Which sounds more like an email opener you’d like to write, this one:

> “_Dear customers, we’ve had a data breach, and your personal information was part of it._”

Or this one:

> “_Dear customers, another year with no data breaches! Here’s how we’re keeping your personal information private and secure._”

That’s what we thought.

The global COVID-19 pandemic didn’t cause data breaches. What it did was cause companies to realize how easily lackluster security protocols and slack remote work policies could lead to their proprietary and customer information being compromised. In fact, [nearly a third of companies](https://www.ibm.com/downloads/cas/QMXVZX6R?lnk=STW_IN_CLP_L1_TL&psrc=OPT&pexp=mob&lnk2=ar_DataBreach) will be subject to a breach sometime in the coming two years. 

The pandemic is also making people feel increasingly cut off from the world they once knew, so any communication received can have an exponential impact. And with privacy matters all over the 24/7 news feed, communication from your company that discusses the measures you’re taking to protect your customers is likely to be quite well received.

While you and your teams are hard at work locking down the [perimeter](https://auth0.com/resources/whitepapers/identity-perimeter), ensuring that remote workers are using proper security etiquette, and enabling everyone to access the resources they need when they need them &mdash; remember you’re not in a vacuum. Your customers would love to know of the steps you’re taking to ensure their private information stays private. And think of the boost to your company’s reputation when these customers tell their friends and family about the heart-felt email they just received from your CIO, telling them about the newest round of measures you deployed.

![Before You Write, Plan Out Your Campaign](https://images.ctfassets.net/23aumh6u8s0i/4SX1MxqNAsTuOPhOz97y6W/80440070b08e62080d90bcb0ef9f5d8b/breach-prevention-sep01)
 

## Before You Write, Plan Out Your Campaign

Any PR firm will tell you that it’s not just what you say but how you say it that matters. And any psychologist will tell you the same thing. They would also likely agree that when you have a lot of information to impart to your audience, they stand a better chance of internalizing more of it if you mete it out in easily digestible, bite-sized snippets.

Sit down with your security teams. Talk about what steps they’re taking, have taken in the recent past, and have on the books in the coming days/weeks/etc. See what metrics they’re using to monitor progress and what their workflow looks like. Take it all in. And take notes.

Then, back at your desk, parse what you just learned. Translate the technical jargon into plain language. Be sure you’ve got answers to all of the six W’s: Who, What, When, Where, Why, and How. Decide which pieces of information you gathered are appropriate for public consumption and which are better kept internal (there is such a thing as too much information, after all).

Now, work with your marketing and/or PR team to craft your communication campaign. Mix it up, with some information going out over each of the channels you know your customers are using blog posts, videos on YouTube, think-pieces for LinkedIn, sound-bites on Instagram Stories, and memorable one-liners for Twitter. Your customers are everywhere, consuming content via multiple channels throughout the day, and you don’t want to miss any of them.

## Internal vs. External Communication About Data Breaches

Our focus here is on how you talk with your customers about data breaches. We would be remiss; however, if we didn’t give passing attention to the other population, you need to be in contact with on this important subject, your employees. A recent Ponemon Institute study showed that [24% of breaches](https://www.centrify.com/media/4737054/ponemon_data_breach_impact_study.pdf) are caused by human error on the part of employees or contractors. That should be a wake-up call. Training is crucial to preventing such attacks.

The most prevalent root cause of human error in this context are phishing emails and other forms of social engineering. Verizon’s annual Data Breach Investigations Report (DBIR) has consistently shown that phishing scams account for [~90% of breach root causes](https://enterprise.verizon.com/resources/reports/dbir/#report). User training is the most effective way to [combat phishing attacks](https://auth0.com/blog/protecting-against-phishing-attacks/) by teaching people what to look for and how to proceed when they fear they may be being phished. There are further options as well; for example, some IAM solutions include [automated anti-phishing](https://auth0.com/blog/how-auth0-automates-phishing-response/) measures that are easy to implement and can dramatically reduce the efficacy of such attack vectors. As you can see, there is some overlap in what you’re communicating, but the language and specifics will change depending on your audience.

## 3 Keys to Successfully Communicating With Your Customers About Data Breaches

As with any written content, voice matters; along with determining the best channels to use in your information campaign, you’ll need to set the right tone as mentioned above while staying in brand voice. With sensitive yet technical information like data breach protection activities, word choice will also be a crucial piece of the puzzle to focus on. There are three primary factors you need to remember when crafting this content: transparency, concision, and empathy.

### Be transparent

Chances are you’ve been busy implementing detailed data protection measures. Some of these measures are likely things your customers will have heard of, like multi-factor authentication, malware protection, and even encryption is part of the lexicon these days. Keeping your customers in the know about the steps you’re taking in these areas will increase their goodwill toward you and the company.

At the same time, there are likely other steps, things like moving to a componentized infrastructure framework, automating IAM, and implementing a bug bounty program that would only serve to confuse the matter in their minds. Not to mention that making things like a bug bounty program public can raise concerns in those who aren’t aware of the beneficial nature of these programs.

So while you want to be transparent about your data security plan, you need to remain cognizant of the line between sharing enough and sharing too much. 

### Be concise

There are two parts to this suggestion. The first is precisely what it sounds like — don’t fluff it up. Data breaches are a subject that most people don’t want to know too much about, while at the same time understanding that they do need to know something. Presenting your content using concise language, without lengthy explanations or paragraphs full of flowery language, will show your audience that you know what you’re talking about and that you value their time.

The second part of being concise is knowing your audience. It’s only in knowing who you’re writing for that you can choose the right words to convey your message so that they’ll both understand and recognize your expertise in the subject. Use too many technical words or acronyms, and they’ll lose focus. Use kindergarten-level language, and they’ll feel you’re talking down to them. Finding the right balance is something that takes experience but is absolutely worth investing the time in.

### Be empathetic

Empathy is something that seems to be lacking in much of the technical communication going around these days. Emotionless jargon isn’t going to engender the trust and confidence you want your customers to have. Sensory language, words that make them feel you truly know where they are and how they feel, that’s what you want to use. Personalize your communications; use the words “I,” “we,” and “you.” Official business communication guidelines will say to the contrary that you should never use these words, but you need your content to resonate on a personal level, and for that to work, you need to connect on that personal level.

Tell your readers a story, the story of how you understand their concerns about data privacy and everything your awesome company is doing to ensure that their information doesn’t end up in the hands of some malicious actor. Use anecdotes include stories from your own life if applicable, and most of all, be empathetic. Powerful, evocative language helps here. Malicious, contempt, fervor, resolute, steadfast; these words evoke strong imagery for most people, and that’s exactly what you’re going for. You want your audience to see that on a deep, personal level, you get it. 

![3 Keys to Successfully Communicating With Your Customers About Data Breaches](https://images.ctfassets.net/23aumh6u8s0i/oHFerhauBupFwdc9RM1xk/2df76607817ce8aabc7f11c2bb71efa7/breach-prevention-sep02)
 

## Summary

It’s a fact of our 21st-century connected world that data breaches happen. The COVID-19 pandemic has accelerated the timeline for companies to get their infrastructure up to scratch and seal the holes in their permeable perimeters. Now is not the time to rest on your stellar track record of zero breaches in the past two years. Rather now is the time to be working full-tilt to ensure that the track record continues into the foreseeable future and beyond.

Build your perimeter and communicate with your users to instill the trust they’re looking for and that you need in order to continue growing. Remember how you reacted to those two potential email opening lines in the intro. Which one do you think your users would rather get next week?

[Get in touch with Auth0 today](https://auth0.com/contact-us) to start the conversation.

<include src="asides/AboutAuth0" />

How to Talk About Breach Prevention With Your Customers

Cloud-based identity management enables safe and convenient digital experiences for financial customers

**LONDON – 7 December 2020 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced that [Ninety One](https://ninetyone.com/en/south-africa/) has deployed its solution to authenticate retail fund investors in South Africa. Started in South Africa as Investec Asset Management, the firm spun out from parent Investec and rebranded as Ninety One this year. Ninety One replaced their on-premises identity solution with Auth0 as part to provide customers with a seamless login experience across its investment products.

Following the demerger and listing, Ninety One required its own [Customer Identity and Access Management (CIAM)](https://auth0.com/blog/what-is-ciam/) infrastructure, including Single Sign On, Multi-factor Authentication, and self-service password reset features. Ninety One’s own development team and a local transfer agency and administrative outsourcing partner, Silica, recommended Auth0 for ease of integration and the ability to host in the cloud while migrating users gradually from the previous on-premises system. 

“The move to Auth0 is indicative of our journey in other parts of the organization,” says Scott Carr, IT platforms manager at Ninety One. “We have embraced Auth0 as essential for our success as a new brand because they enable us to provide the caliber of safe and convenient digital experiences our financial services clients demand.”

IT security spending in the META region (Middle East, Turkey, and Africa) will cross $3.4B in 2023, driven by a focus on [digital identities and shifts to the cloud](https://www.biznesstransform.com/idc-predicts-major-spending-on-digital-transformation-by-the-ict-industry-in-meta/) (Source: IDC)[1]. Auth0 has been recognized as a top private cloud company in identity management on the [Forbes Cloud 100](https://auth0.com/blog/auth0-is-named-to-the-2020-forbes-cloud-100/) and by industry analysts for serving as a key enabler in customers’ [digital transformation](https://auth0.com/forrester-total-economic-impact) efforts.

“Digital transformation shouldn’t be underestimated, but it doesn’t have to be feared either,” said Steven Rees-Pullman, SVP International at Auth0. “Ninety One is looking to the cloud and replacing legacy systems with building blocks like Auth0 to be more adaptable and resilient while delivering great experiences for their clients. We’re pleased to help power their journey.”

[1] IDC Worldwide Black Book Live Edition, July 2020

## About Ninety One

Ninety One is an independent, active investment manager dedicated to delivering compelling outcomes for its clients, managing more than £119 billion/R2.6 trillion in assets (as at 30.09.20).

Established in South Africa in 1991, as Investec Asset Management, the firm started offering domestic investments in an emerging market. In 2020, almost three decades of organic growth later, the firm demerged from Investec Group and became Ninety One. Today the firm offers distinctive active strategies across equities, fixed income, multi-asset, and alternatives to institutions, advisors, and individual investors around the world.

[www.ninetyone.com](https://ninetyone.com/international) 

<include src="asides/AboutAuth0" />

### Media Contacts

Media Contacts 
McKenzie Mayer 
PR Manager, EMEA 
press@auth0.com 

Kotie Basson 
Head of Marketing, Africa Client Group 
Ninety One 
kotie.basson@ninetyone.com

Ninety One Chooses Auth0 as Foundation for Digital Transformation

Global identity management provider one of the first AWS Partners to give AWS customers seamless access to professional services in AWS Marketplace

**BELLEVUE, Wash. – December 3, 2020** – The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced that it is participating in the launch of Professional Services in AWS Marketplace. Amazon Web Services (AWS) customers can now find and purchase professional services from Auth0 in AWS Marketplace, a curated digital catalog of software, data, and services that makes it easy to find, test, buy, and deploy software and data products that run on AWS. As a participant in the launch, Auth0 is one of the first independent software vendors to quote and contract services in AWS Marketplace to help customers implement, support, and manage their software on AWS. [Click here](https://aws.amazon.com/marketplace/seller-profile?id=0079abaf-bc2f-481c-9543-d2bfedb81003) for more information. 

As organizations migrate to the cloud, they want to use their preferred software solutions on AWS. AWS customers often utilize professional services from Auth0 to help implement the Auth0 platform and enable interoperability with their applications. Until now, AWS customers had to find and contract professional services outside of AWS Marketplace and could not acquire an identity platform solution and associated professional services in a single procurement experience. With professional services from Auth0 available in AWS Marketplace, customers have a simplified way to purchase and pay for both their subscription to the Auth0 platform and related professional services in a centralized place. 

“Auth0 is proud to offer professional services in AWS Marketplace and provide AWS customers with additional support they may need for any identity implementation,” said Bill Lapcevic, VP of Business Development at Auth0. “We are excited to be one of the first independent software vendors to offer professional services as part of this launch and look forward to providing an even more comprehensive identity offering for AWS customers.”

Auth0 is an AWS Advanced Technology Partner that is participating in AWS re:Invent 2020, taking place November 30 - December 18, 2020. To learn more, visit: [https://info.auth0.com/auth0-at-aws.html](https://info.auth0.com/auth0-at-aws.html). 

<include src="asides/AboutAuth0" />

### Media Contacts
Global Communications 
Auth0 
[press@auth0.com](mailto:press@auth0.com) 

Matter for Auth0 
[auth0@matternow.com](mailto:auth0@matternow.com)

Auth0 Supports the Launch of Professional Services in AWS Marketplace

Reinforces commitment to the region with new headcount, customers, and partners

**LONDON – 25th November, 2020 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced it has doubled its business in the Europe, Middle East, and Africa region (EMEA) in the third-quarter over the same period last year. Randstad, Pret A Manger, Nutmeg, Flo Health, Libération, WeTransfer, and DPG Media, with its "Streamz" online video-on-demand platform, join the hundreds of customers across the region already using the Auth0 platform. 

"Randstad has been progressively rolling out the Auth0 solution for identity management, designed to foster collaboration among our 41,000 team members around the world," said Koen Klaassen, global identity and access management program lead at Randstad. "The Auth0 private cloud solution fits our needs in terms of compliance and scalability, delivering the right level of performance and control."

Auth0's growth benefits from the success of its modular, "building block" approach, which helps customers and developers to customize identity capabilities for their exact use case. The September launch of [Auth0 Marketplace](https://marketplace.auth0.com/) provides further extensibility by introducing native third-party solutions from technology partners, including regional companies like Onfido, MyLife Digital, and Scaled Access.

Additionally, channel partners are contributing to the adoption of the Auth0 platform in the EMEA region. Auth0 has concluded agreements with new partners across EMEA, including CMS Distribution in the UK and systems integrator Devoteam in France, who have joined 30 regional partners already offering the Auth0 platform.

"Devoteam measures its success by enabling customers to unlock greater value in their digital transformation projects," said Karim Bouami, digital identity and trust service director, Devoteam. "When identity management is a critical part of these projects, Auth0 brings a solid solution to support customers in those transformations, improving security without sacrificing engagement or experience."

Auth0 continues to scale its regional footprint to accompany increases in customer demand, increasing regional headcount to 139 in the third quarter, up more than 50% from the same period last year. With employees based across the EMEA region, Auth0 maintains a strong culture of remote working, which predates Covid-19 confinement periods in the region. 

"Our seamless transition in and out of remote working scenarios has helped keep our focus on serving our customers this year," observed Steven Rees-Pullman, SVP International, Auth0. "As we continue to evolve our offering and our organization to reflect demand, we aim to become a trusted local partner for each and every one of our customers across the region."

Auth0's regional footprint is underpinned by the strength of its technical teams, who engage with thousands of developers through a broad program of conferences, videos, and content. "Europe sets itself apart as a strategic region for engineering talent, and as a software company, Auth0 is proud of our highly-skilled engineers and designers," said Carolyn Moore, SVP People of Auth0.

In October, the prestigious [KuppingerCole KCLive Award for Customer Authentication](https://auth0.com/blog/auth0-powers-signify-s-award-winning-customer-authentication-solution/) was presented to Auth0's customer Signify for outstanding customer experience. Auth0 has also been named to the [2020 Forbes Cloud 100](https://auth0.com/blog/auth0-is-named-to-the-2020-forbes-cloud-100/) for the third consecutive year.

<include src="asides/AboutAuth0" />

### Media Contacts
Global Communications 
Auth0 
[press@auth0.com](mailto:press@auth0.com) 

_Richard Scarlett or Jamie Waddell_ 
Finn Partners for Auth0, EMEA 
[Auth0-EMEA@finnpartners.com](mailto:Auth0-EMEA@finnpartners.com)

Auth0 Doubles Business in the EMEA Region

df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing. Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

Fintech companies must evolve their identity strategy for the future of banking.

A solid customer identity and access management (CIAM) strategy is a crucial ingredient in successful digital transformation. Over the last several months, many financial services organizations have been forced to recognize that they’re not ready to operate fully online. Features and capabilities that seemed like nice-to-haves in 2019 are being rushed to market in 2020 to meet consumers’ rapidly evolving needs. Delivering a seamless user experience without compromising a strong security posture is the fintech challenge of the moment. 

CIAM is among the best tools for building digital resilience and strengthening online banking security. [Auth0](https://auth0.com/) CEO and co-founder [Eugenio Pace](https://www.linkedin.com/in/eugeniop/) and [IMDWORKS](https://www.idmworks.com/) founder and CEO [Paul Bedi](https://www.linkedin.com/in/paulbedi/) talked with Nick Holland of Information Security Media Group (ISMG) about the role of CIAM in helping banks adapt to our new remote reality and what this means for the future of banking.

## Banks Must Change How They Interact With Customers

Life for most people has changed radically over the last several months, and we’ve reached an inflection point where we’re appraising and challenging established systems and procedures. Put plainly, banks, and fintech companies must change how they interface with their customers. 

**“The way that banks interact with their customers will evolve massively.” &mdash; Paul Bedi, Founder, and CEO of [IMDWORKS](https://www.idmworks.com/).**

For instance, [telehealth](https://auth0.com/blog/how-coronavirus-is-changing-telemedicine-forever/) has gone from an occasional use case to the new default for many types of healthcare. This shift has accelerated the pace of innovation as health systems and technology providers work to redesign their products and procedures for a new system of care.

The COVID pandemic has also created new opportunities for fraud and data theft, raising the security bar even higher. [The Federal Trade Commission](https://www.cnbc.com/2020/04/15/americans-have-lost-13point4-million-to-fraud-linked-to-covid-19.html) reports that Americans have lost more than $13.4 million to COVID-related scams since the beginning of 2020. Meanwhile, [VMWare noted](https://searchsecurity.techtarget.com/news/252481832/Ransomware-attacks-see-148-surge-amid-COVID-19) an alarming 148% surge in ransomware attacks between February and March 2020, along with a 38% increase in the number of cyberattacks in the same period. It’s never been more critical to leverage CIAM to seal up the cracks and ensure your identity strategy is sound. 

### Enable Contactless Transactions

To establish a financial relationship, people used to bring proof of their identity into a brick-and-mortar bank and show it to a bank employee. Before 2020, Millennials’ preference for online banking over in-person transactions was already driving the industry towards developing better remote capabilities, but the pandemic has accelerated this shift. Financial institutions must be able to authenticate customers remotely: not just when they are accessing an established account via ATM or mobile app, but also when they are first launching their financial relationship. The cost of face-to-face interactions, whether measured in terms of public health or time optimization, has risen.

In general, a trend toward contactless transactions has become apparent. When we ordered a takeout dinner in 2019, we met our delivery driver at the door as they handed over our eagerly-anticipated meal. Now food delivery services leave our orders outside the front door and text us because neither party wants to be exposed to unnecessary risk — and because we have the technology to enable us to neutralize that risk.

Other everyday procedures such as notarization, which traditionally involves a face-to-face interaction, analog signatures, and a physical stamp, need to evolve to match the current situation. Because of pandemic-related travel barriers, pace points out, and demand is growing for technology that facilitates international transactions and interactions. It’s no exaggeration to say that we are in the process of reimagining and rearchitecting the entire technological infrastructure upon which we’ve built our lives and livelihoods.

### Earn Customer Trust With User-Centric Security

People have faith in physical banks, Holland suggests because they can see the vault and the teller; there are powerful visual clues that the bank is secure, inviolate. The structures for cultivating and reinforcing this same level of trust in online banking security need to evolve.

A data breach has a devastating impact on customer confidence. [IBM reports](https://www.ibm.com/security/data-breach) that the average data breach costs $3.92 million — of which 36% ($1.42 million) is the direct result of lost business. [A 2019 customer survey from Ping Identity](https://www.pingidentity.com/content/dam/ping-6-2-assets/Assets/Misc/en/3464-consumersurvey-execsummary.pdf) found that 81% of respondents would stop engaging with a brand online if there were a data breach, while 25% would stop engaging with the brand across all channels. 

Bedi advocates for fintech companies embracing public, user-centric security policies and guaranteeing the security of user data across online and mobile apps. “The onus is on you, the company, to protect them, the users,” he says. He urges banks and financial services to consider establishing a contact center staffed with knowledgeable people who can help customers troubleshoot and resolve fraud issues. Now more than ever, Bedi suggests, people want to place complete trust in their financial institutions; they want the reassurance of guaranteed security and genuine accessibility.

## Balancing Security and UX Requires a Fresh Authentication Approach

Maintaining a strong security posture without creating friction that drives users away is a perennial challenge. This is especially true with fintech companies and banks: They operate under heavy regulation, and their top priority is protecting user accounts. Their user bases, meanwhile, often vary wildly in terms of technical sophistication, so the authentication function must be low-friction to avoid confusing, frustrating, and ultimately losing customers. 

### Lose focus on UX and lose 32% of your users

The impact of a cumbersome user experience is easy to dismiss, especially when it’s so important to [protect customer data](https://auth0.com/blog/data-privacy-vs-data-security-why-your-business-needs-both/) (not to mention a legal requirement across 65% of the globe). But bad experiences for users translate directly to lost revenue for you. [PwC found](https://www.pwc.com/us/en/advisory-services/publications/consumer-intelligence-series/pwc-consumer-intelligence-series-customer-experience.pdf) that almost a third of customers will abandon a brand they like after just one negative experience. That’s why it’s crucial to balance high security standards and a smooth customer experience. 

Bedi argues that achieving this balance means making the security paradigm completely invisible to users. In other words, making the systems and processes involved in verifying and managing identity so seamless that the user scarcely registers them. “That’s when you know you’ve succeeded [with CIAM],” he says.

### Put authentication decisions in context

A primary consideration in balancing security and user experience, says pace, is a keen understanding of the context in which interactions are happening. Situations with different levels of risk demand different levels of authentication. For instance, just checking an account balance might require a lower level of authentication than making a transfer. When a user attempts a higher-risk action, they’re prompted with an additional verification step, like multi-factor authentication (MFA) or a [CAPTCHA](https://auth0.com/blog/reducing-the-impact-of-credential-stuffing-attacks/).

Authenticating based on context also involves looking at what time of day a request was made, from what location, and using which device. Historical behavior patterns also come into play. For example, if you always pay your bills on Monday evenings from your laptop at home, a smartphone login in the small hours of Saturday morning from an unexpected location might trigger an additional verification step, because there’s contextual evidence that you are not the one making the login request. On the other hand, a Monday evening request from your living room might not require that additional authentication — and demanding it might create sufficient friction to drive you, the user, to another bank.

Pace explains that the security world has tended to view authentication in binary terms: a user is either authenticated or they’re not. Fortunately for today’s use cases, modern CIAM technology is sophisticated enough to evolve systems to evaluate all of these contextual factors when making decisions. Requesting different levels of authentication depending on context allows fintech companies to maintain high security standards without pestering the user for authentication every time they turn around.

## The Bank of the Future Isn’t Just a Bank

No one has a clear idea of what the future of banking will be, but what is clear is that many features will remain digital. Even once it’s possible to do more banking face-to-face, plenty of customers will still prefer to bank remotely. A hybrid structure is how fintech companies will thrive going forward. 

In a post-pandemic world, real-life interactions will incur a new kind of value, and this certainly applies to financial services companies. One possibility Bedi raises is that banks will transform into offshoots of the community. Like [Capital One Cafés](https://www.capitalone.com/learn-grow/money-management/explore-capital-one-cafes/), banks might leverage their real-estate assets by opening common spaces where people can transact business face-to-face — adding another layer of value to the banking experience. Another possibility is that banking locations could become remote call centers for customers with the kinds of questions that would once have been addressed in person. 

Bedi’s predictions largely align with how pace sees banks evolving in the near future. “The emphasis will be on relationship-building,” he says. In order to keep customers coming through the doors, banks will have an opportunity to deliver value users can’t get online. A bank branch could, for instance, proactively reach out to local customers who qualify for a higher line of credit or a lower interest rate on their mortgage, instead of waiting for customers to seek out their services.

## The Future Calls for CIAM

Ultimately, no matter what new revenue streams financial companies discover in the course of hybridizing their structures, both customers and vendors will be pressuring banks to digitize more fully. A sound CIAM strategy clears the way to next-generation UX without increasing the security risk to customer accounts.

<include src="asides/AboutAuth0" />

How FinTech Benefits From IAM

randy_nasson

Director of Product Management for Customer Identity Cloud (formerly Auth0) in our Identity and Access Management (IAM) domain. I joined Auth0 in 2018 and assembled a world-class IAM product team dedicated to delivering customer value and enabling developers to quickly implement secure, robust, and seamless identity solutions. In addition to my current work with CIC, I regularly work with our Auth0 Lab team on greenfield initiatives and with our Strategic and Technical Partner teams on opportunities to drive revenue.

Director, Product Management (IAM)

Randy Nasson

Long-lived sessions can improve user experience and reduce password reset costs.

**How long should a customer stay logged in to an application?** The [Open Web Application Security Project (OWASP)](https://auth0.com/blog/a-run-through-the-owasp-top-10/) and the [National Institute of Standards and Technology (NIST)](https://auth0.com/blog/what-the-new-nist-guidelines-mean-for-authentication/) state that it's safer for customers to sign in to your app for mere minutes. Limiting your customers to hold short sessions may leave them frustrated and unwilling to come back to use your application. A pillar of customer retention is to provide both a user-friendly and secure user experience. However, balancing those two user experience components is a real challenge for most businesses.

OWASP recommends application builders to implement **short idle time outs (2-5 minutes) for applications that handle [high-risk](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Session_Management_Cheat_Sheet.md) data**, like financial information. It considers that longer idle time outs (15-30 minutes) are acceptable for low-risk applications.

On the other hand, [NIST](https://pages.nist.gov/800-63-3/sp800-63b.html) recommends that application builders make their users **re-authenticate every 12 hours** and **terminate sessions after 30 minutes of inactivity**. For intermittent re-authentication, that session termination time shrinks to 2 minutes.

These guidelines by OWASP and NIST provide an ideal foundation to implement session security in applications. However, before you choose to extend your application's session length, it's also ideal for your team and your internal stakeholders to discuss how such a decision can impact your application's user experience.

Ultimately, [balancing security and user experience](https://abacuscambridge.com/blog/why-iam-perfect-blend-security-and-customer-experience) is key to achieve customer retention. A tedious authentication process can exhaust your customers and discourage them from using your application. A seamless, perhaps even invisible, authentication process can instead encourage your users to spend more time with your application _securely_.

Auth0 offers you a feature called long-lived sessions to offset the cost of implementing a secure user experience around authentication.

<include src="TweetQuote" quoteText="UX can help you keep or lose a customer. Balance #UX and #security with Auth0 long-lived sessions."/>

## Why Customers (And Businesses) Want Long-Lived Sessions

One of the conveniences of email services like Gmail is that you can check your email sporadically without having to face repetitive login prompts. Imagine how tedious it would be if you had to log in every time that you go idle for more than two minutes.

For media companies, like [Alma Media](https://auth0.com/learn/alma-media-sees-30-total-savings-seamless-brand-access/), customers may visit their site infrequently. Registered users often visit media sites every two weeks to consume content. Returning users who face the hassle of signing back in may opt to stop visiting the site. **For a media company, losing its audience means losing ad revenue, since clicks generate payments on ads.** If the revenue strategy also involves targeted advertising, media companies require a security strategy that favors maximum engagement with minimal friction.

If a company offers an essential service, its users may not have the option to leave the site. However, they may still become vocal about their dissatisfaction with the user experience on social media or review channels.

For example, a utility company may have monthly or quarterly billing cycles where end-users access its application to pay their bills. Other companies like [Autotrader](https://auth0.com/learn/coxs-autotrader-launches-premium-experience-auth0/) have customers with usage patterns that vary widely based on purchase and maintenance cycles. For any application with long periods between end-user engagement, users understandably forget their passwords.

Some Auth0 customers have reported that as much as **22% of their customers forget their passwords each quarter**. Frustrated customers have to contact call center staff to request password resets. Forgotten passwords may lead to decreased customer satisfaction, paired with increased business operation costs.

For low-risk engagements, you can provide better user experience by implementing a longer session limit, which could become the difference between keeping or losing a customer. While Auth0 focuses on making your applications more secure, we also understand the substantial value of your end-user experience.

Everything considered, long-lived sessions work exceptionally well for organizations with periodic or even intermittent engagement cycles.

Poor user experience can lead to customer dissatisfaction. Insufficient security can amount to legal penalties, fines, and losing customer trust. **The combination of poor user experience and insufficient security can compound into a catastrophic punch to damage a brand**.

## 100 Days Inactivity/365 Days Total Timeout

Auth0 lets you customize session lengths to fit the security risk tolerance of your desired user experience. You can configure session limits with up to 100 days of inactivity (idle timeout) and up to one year in total duration (absolute timeout). 

> The motivation behind the 100-day idle timeout cap is to cover one quarter plus a few days, which provides wiggle room for people who log in to do end-of-quarter reports.

Long-lived sessions allow companies with quarterly, monthly, or other types of customer engagement cycles to reduce friction for end-users and provide secure access to low-risk content and functionality.

Whenever your customers need to perform high-risk actions, such as changing account details or updating payment methods, you can rely on Auth0 functionality to programmatically require password validation to run those actions as an added layer of security.

![Auth0 Long-Lived Sessions - New Session Limits 100 Days/365 Days total timeout chart](https://images.ctfassets.net/23aumh6u8s0i/7tmP5QwFpRVgPVuZsYhcp0/f383df39269f7cd6b732315bc4542a28/auth0-long-lived-sessions-new-session-limits)

With Auth0's long-lived sessions, session management, and Single-Sign On (SSO), you can build a better user experience for returning customers, enable personalized targeting, and reduce the costs of operations by mitigating password resets. **If you'd like to learn more about how you can customize Auth0's out-of-the-box features to fit your needs, please reach out to <sales@auth0.com>**.

"customers"