Okta Release notes and new features

Multi-Factor Authentication: Exponential Backoff for Phone MFA SMS Delivery

Auth0 now supports exponential backoff for phone MFA SMS delivery on Enterprise plans to mitigate SMS pumping and toll fraud.

Agent Mode for the Auth0 CLI

Agents are increasingly operating the CLI to configure Auth0 on behalf of developers. The CLI wasn't built for that. A misspelled command could exit `0` like nothing went wrong. A routine re-login could hang forever waiting on a browser click that would never come. Finding the right command meant drilling through `--help` one level at a time.

Improved Bot Detection: Enhanced IPv6 Signal Analysis

### Bot Detection Model Update We have updated our Bot Detection model to improve threat intelligence against fast-rotating distributed bot networks while preserving a seamless user experience.

Universal Login identifier and phone country controls in Early Access

Universal Login's identifier and phone country controls are available in Early Access on all Auth0 plans. Choose type-specific login entry with "Continue with" buttons, or keep the default unified field.

Tenant ACL Dashboard UX

Easily construct, sequence, and audit Tenant Access Control List (ACL) rules using our new intuitive, step-by-step dashboard interface . ### Features #### Guided Rule Builder Construct complex Tenant ACL policies directly under **Security > Access Control** using step-by-step input prompts that simplify scope, entity, and action selection without syntax...

Upcoming changes to the length of refresh tokens

As part of our commitment to maintaining the highest security and compliance standards, we will soon be updating our authentication service configuration to increase the length and entropy of our refresh tokens. ## What is changing? We are increasing the cryptographic entropy of our issued Refresh Tokens.

Custom User ID Assignment with Actions , Early Access

You can now assign a custom `user_id` to new database-connection users at signup by calling the `api.user.setUserId()` method in a `pre-user-registration` Action. Previously, Auth0 automatically generated user IDs in the standard `auth0|<id>` format for new signups.

• Custom User ID Assignment with Actions , Early Access
• My Organization API and Embeddable UI Components - Member Management in Early Access!

New Deny All Rule for Tenant ACL

You can now configure a Deny All rule within your Tenant Access Control List (ACL) to reject all incoming traffic to your assigned scope. By utilizing the new `match_all: true` attribute, this rule bypasses specific signal matching (such as IP or geolocation) to apply comprehensive protection across the full tenant scope.

My Organization API and Embeddable UI Components - XAA and third-party app access configuration in Early Acces

We're excited to announce that self-service configuration of Third-Party Application Access and Cross App Access (XAA) is now available through the My Organization API and Embeddable UI Components, in Open Early Access.

Dashboard Navigation & IA Refresh is now in Early Access

 We're excited to announce that the Dashboard Navigation & IA Refresh is now available in Early Access, bringing a redesigned sidebar, improved information architecture, consistent, breadcrumbs, and a modernized visual experience to...

Cross-App Access Requesting App now in Early Access

We're excited to announce that Auth0 now supports acting as a __requesting application in Cross-App Access flows in Early Access__. Today, every user has to click "Connect your account" for every integration, in every app, one at a time.

Custom Rate Limits available in Early Access

Custom Rate Limits allow Auth0 Customers to limit the amount of RPS their first-party, third-party, or CIMD apps can consume, so as to mitigate the risk that any one Client can exhaust the customer’s Tenant Rate Limit Entitlement on their tenant’s Authentication API Rate Limit Policy.

Custom Prompts now capture the same fields on Social and Enterprise connections

Your custom signup and login fields and consent checkboxes configured in Universal Login now capture the same data on Social and Enterprise connections as they already do on database and passwordless.

Custom Token Exchange - Session Delegation is now available in Open Early Access

We're excited to announce that __Auth0 now supports Session Delegation via Custom Token Exchange__. This release is available to all Enterprise, B2B Professional, and B2C Professional customers.

Organizations Search Expands with Advanced Filtering

We're expanding __Organizations Search__ with powerful new filtering capabilities. __What's New__ Find organizations using: __Name__ , Search by unique organization identifier __Display name__ , Search by human-readable display name __ID__ , Exact organization identifier lookup __Metadata__ , Filter by custom key-value pairs __Third-party client access__ ...

Cross App Access (XAA) for Resource Applications is now in Open Early Access

We're excited to announce that __Cross App Access (XAA) for Resource Applications is now in Open Early Access__. You can use this feature in production today at no additional cost through Auth0 Enterprise Connections, available to __Enterprise, B2B Pro, and B2B Essential__ customers, or test it during the __trial period on Free tenants__.

Self-Service Enterprise Configuration: Customer admins can now configure third-party application access during SSO setup

When generating a Self-Service Enterprise Configuration ticket, you can now delegate the third-party application access decision to your customer's customer admin , rather than setting it yourself at ticket creation time.

Google One Tap Support for Universal Login EA

Bring frictionless, one-tap authentication to your users! Auth0 now supports Google One Tap within the Universal Login prompt for Early Access. Users are greeted with a secure, non-intrusive identity overlay that lets them sign in instantly with a single tap, completely eliminating manual forms and page redirects.

IPSIE session_expiry Claim Support for Okta and OIDC Enterprise Connections

Auth0 now supports the session_expiry claim for Okta and OIDC-based Enterprise connections, in alignment with the IPSIE SL1 profile. When your upstream identity provider includes a session_expiry value in the ID token, Auth0 uses it to enforce the ceiling on the Auth0 session lifetime , evaluated as the minimum of the IdP claim, your tenant's absolute...

Tenant Log Catalog Now Available in Auth0 Docs

We now have an expansive and interactive Tenant Log Catalog available to dive deeper into [Tenant Logs](https://auth0.com/docs/deploy-monitor/logs) Codes and their associated schemas.

Automate Downstream Provisioning with Outbound SCIM for Users via Event Streams

We are excited to announce the release of our new __Outbound SCIM Action template for Event Streams__! This new capability delivers an infrastructure-free way to push `user.created`, `user.updated`, and `user.deleted` events directly from Auth0 to any `SCIM 2.0`-compliant downstream application, making it easier than ever to automate your user provisioning...

Google Workspace Directory Sync for Groups - Early Access Updates

We are happy to share that Google Workspace Directory Sync for Groups is now available in Early Access without enrolment! All [previously announced](https://auth0.com/changelog#3sQ4fmmnZQuIAu9jZBoBOS) Early Access capabilities including automated group synchronization, "Sync all" functionality, and partial group selection are now available out-of-the-box...

Improved refresh token management is Early Access

We're excited to announce the addition of two new endpoints for refresh token management, introducing granularity in search and revocation capabilities, as well as bulk revocation of refresh tokens (up to 100 individual IDs at a time): A new GET api/v2/refresh-tokens endpoint which allows retrieving refresh tokens for a user_id or a user_id + client_id...

Enhanced Bot Detection for Signup Flows

We have updated the machine learning model driving Bot Detection during the Signup Flow. This update lowers false-negative rates to intercept more automated traffic while keeping false-positive rates low for valid users.

Auth0 Teams: Delegate tenant management with the new Tenant Manager role

You can now delegate tenant-level user management with the **Tenant Manager** role. This allows you to offload day-to-day administrative tasks from Team Owners to dedicated managers, providing the autonomy they need without exposing sensitive configuration settings.

Actions - Access Token Scope Customization - EA

We are excited to announce that we are adding __new Credentials Exchange Actions Access Token Scope Interfaces__ and they are now available in [__Early Access__](https://auth0.com/docs/troubleshoot/product-lifecycle/product-release-stages#early-access "Early Access").

• Actions - Access Token Scope Customization - EA
• Custom Token Exchange - Delegated Authorization now available in Open Early Access

Suspicious IP Throttling for Custom Token Exchange

We have introduced a Dashboard configuration interface for Suspicious IP Throttling, specifically for Custom Token Exchange. This update allows administrators to easily set thresholds to throttle high-velocity traffic from suspicious IP addresses during the token exchange process.

Secure your Account API with ACR EA

Auth0's ACR EA release empowers you to secure Account API token issuance by enforcing step-up authentication for sensitive scopes. Whether your users are managing their authentication factors via Universal Login or Embedded flows, you can now gate access through Actions-driven policies or enable a secure-by-default toggle.

Auth0 Private Cloud Now Available on Azure in Japan

Auth0 Private Cloud is now supported in the Azure Japan East (Tokyo) region! Japan already has Auth0 coverage through AWS Private Cloud and our Public Cloud environment, and this addition brings Azure into the mix for the first time.